hxxps://wetransfer[.]com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?

Resubmissions

09/07/2026, 04:38

260709-e9tv7adv5x4

09/07/2026, 04:36

260709-e77z2acw6l4

09/07/2026, 04:33

260709-e6jk2sdv4t4

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?
Sample260709-e77z2acw6l

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280453797237011"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
5160	chrome.exe
5160	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1772	4360	chrome.exe	82
PID 4360 wrote to memory of 4888	4360	chrome.exe	83
PID 4360 wrote to memory of 3592	4360	chrome.exe	84
PID 4360 wrote to memory of 3592	4360	chrome.exe	84
PID 4360 wrote to memory of 5944	4360	chrome.exe	86
PID 4360 wrote to memory of 5944	4360	chrome.exe	86
PID 4360 wrote to memory of 5672	4360	chrome.exe	87
PID 4360 wrote to memory of 1844	4360	chrome.exe	88
PID 4360 wrote to memory of 5672	4360	chrome.exe	87
PID 4360 wrote to memory of 1844	4360	chrome.exe	88
PID 4360 wrote to memory of 2148	4360	chrome.exe	89
PID 4360 wrote to memory of 2148	4360	chrome.exe	89
PID 4360 wrote to memory of 5136	4360	chrome.exe	90
PID 4360 wrote to memory of 5136	4360	chrome.exe	90
PID 4360 wrote to memory of 2384	4360	chrome.exe	92
PID 4360 wrote to memory of 2384	4360	chrome.exe	92
PID 4360 wrote to memory of 2540	4360	chrome.exe	93
PID 4360 wrote to memory of 2540	4360	chrome.exe	93
PID 4360 wrote to memory of 5092	4360	chrome.exe	94
PID 4360 wrote to memory of 5092	4360	chrome.exe	94
PID 4360 wrote to memory of 5240	4360	chrome.exe	95
PID 4360 wrote to memory of 3920	4360	chrome.exe	98
PID 4360 wrote to memory of 3920	4360	chrome.exe	98
PID 4360 wrote to memory of 3428	4360	chrome.exe	99
PID 4360 wrote to memory of 3428	4360	chrome.exe	99
PID 4360 wrote to memory of 3180	4360	chrome.exe	107
PID 4360 wrote to memory of 5664	4360	chrome.exe	108
PID 4360 wrote to memory of 4968	4360	chrome.exe	109
PID 4360 wrote to memory of 5700	4360	chrome.exe	110
PID 4360 wrote to memory of 5700	4360	chrome.exe	110
PID 4360 wrote to memory of 4208	4360	chrome.exe	111
PID 4360 wrote to memory of 4208	4360	chrome.exe	111
PID 4360 wrote to memory of 5164	4360	chrome.exe	112
PID 4360 wrote to memory of 5164	4360	chrome.exe	112
PID 4360 wrote to memory of 4048	4360	chrome.exe	113
PID 4360 wrote to memory of 4048	4360	chrome.exe	113
PID 4360 wrote to memory of 5800	4360	chrome.exe	114
PID 4360 wrote to memory of 3288	4360	chrome.exe	115
PID 4360 wrote to memory of 3288	4360	chrome.exe	115
PID 4360 wrote to memory of 2980	4360	chrome.exe	116
PID 4360 wrote to memory of 2980	4360	chrome.exe	116
PID 4360 wrote to memory of 5404	4360	chrome.exe	117
PID 4360 wrote to memory of 5404	4360	chrome.exe	117
PID 4360 wrote to memory of 3840	4360	chrome.exe	118
PID 4360 wrote to memory of 5028	4360	chrome.exe	119
PID 4360 wrote to memory of 5028	4360	chrome.exe	119
PID 4360 wrote to memory of 5112	4360	chrome.exe	120
PID 4360 wrote to memory of 5112	4360	chrome.exe	120
PID 4360 wrote to memory of 5160	4360	chrome.exe	121
PID 4360 wrote to memory of 5416	4360	chrome.exe	122
PID 4360 wrote to memory of 5416	4360	chrome.exe	122
PID 4360 wrote to memory of 4392	4360	chrome.exe	123
PID 4360 wrote to memory of 4392	4360	chrome.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9c259c728,0x7ff9c259c734,0x7ff9c259c740
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,9286791219119415041,15312107466348082123,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,14881993149517860273,17898480422210509006,262144 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,16503976429542306124,17346432962229792561,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,16601331841058595470,12289957435766844613,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,15401238768952180654,18073460418645068547,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,10704067203594858886,18433697599565699674,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,15181048845733478716,6490355218391077530,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3216,i,2038912566015806962,1133013224229627864,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3276,i,50493811712981994,1337643961974425794,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5108,i,17299329854469539243,8990077261749839404,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,16033479700583946446,13572917858385398864,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6252,i,14070197033296996174,14342072284589425309,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5468,i,15502255959012032124,9722752849290360006,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,2841364748122336335,14896984381023590642,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,14021839866606887322,10697975018590707513,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,8939013591475916483,15759935508917794515,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4992,i,17890091429143885997,1327430215356849200,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4612,i,13073697593543576286,16374974699389876138,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5532,i,12418535053073815172,1156174771179905908,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5312,i,7684787598721138105,910133531164062684,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,16382262490274366520,16634346203615394296,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5276,i,11227320129157782420,18180495463521796016,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6720,i,14064790969838164575,15688891066655164082,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6664,i,16915839243821476094,15350099465244689181,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6684,i,13991228646104734055,2932592677485365580,524288 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4612,i,7756743507859726800,8746100798113836711,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6520,i,14860591827423596399,5431053297323868227,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7024,i,5193689640641236349,3914477949389948219,262144 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7040,i,2957456906588054496,13875665513149082044,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6648,i,10231722604129631936,6676425977703851674,2097152 --field-trial-handle=2160,i,3661393237336391425,17902505876545718584,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 584ce18d99c458c2014b4c1ce4583e09a381e945d3c89f5d66dec8439b47ca85
MD5 5edad24323cae842d531580483855c40
SHA1 fe86301e25d5118ae806e49ba202cb88acade40f
SHA512 9fff8b88ab0957e9deb81922c1799e7af965e83a57aff11408a57936f0acb76e58688f9d15dc36baf4e0913267a043f9113d3aa5304b8c3ad183f22f8469b30f
TLSH
T1B9E02BA6CD21AC671CFE075870545686E750035B2B40490F7B3D920C9FF463A569585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056
Size 95KB
SHA256 d37b24b519f15ef8287304b0f84ba46a4b2ac846d0cdb19951a1aa4bd1396ef0
MD5 668c4fa55efd1f5911d140f02fe92418
SHA1 4311fe721223bd90f56585fec3d1a4fa2089a247
SHA512 88598903c334c5506fe00f9fb001f90693062b5f400cbd45c2fe6d8ea6a8a2b805e34a1dc2e84ea0573b1d38d6909bfd8e592c52285eed7e1cb52701d5f85019
SSDEEP 1536:YcwoJ+XgeP2wel8+lXRBm84WxaRFcrZbgyE/jnQYmujYEistiQ7lW5njNADkRCZr:t3+f7el8+lXLmmiD/j/0Ei/QgjNek6
TLSH
T1AD9312D66FB57CBB06DDCC048A8355CDB0818E2EEED808F6107C24BD1D29563996B2B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e0765477aab2188431d7389d06932515463d0aa08296ab0d501d1cb253bcdfab
MD5 ec3af6b2cfdcc3f2691475ca346b845d
SHA1 57157cf914d0b58fcc6530fbe117af2c5f72ac1b
SHA512 8244b57eb74973cb938a84f70b779cc741c52014652926c1ff8addb2a6479e58062d59f3fac2b87abd494b88af1b3cb7a8f454f36240591bbf8742ce6fc72285
TLSH
T11A814D8E02C370EADFC15132A39E59722764AC85583AFFA3480FF13CE8232D2C579620
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0a8968c446e4911924bad217b1981b3878cecdbe68fb2ce4c2c66e26bd720fae
MD5 3a39ee14b8cea3dafd15b796166fa012
SHA1 76b054ccc04e5bcce4490f5701cf2352adc998b2
SHA512 93dcc12cf0c5561c761451749ec870e4affa772335453427d3218bdd6c3e312e2fe82eded1be772c91b9155c12cfcaec56dd8de096510de976500491524652b8
TLSH
T14B815E8E02C770EADFC15132979D49722764ACC45836FFA3980FF13CE8632D2957A620
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd4f48009a04cf26ed3107c5f2d6d1b735504ade1337d61f5a19b09503598e90
MD5 159178a6afa748ac4a04008ebddb3a6d
SHA1 7147eca29e055d61a311a7bd161be99b4cd5b6bb
SHA512 bce8d8d73395bb3cc876917e61bf548149bc85c487adc729b22f6244ee00f5842181096deaf56bc2a89048f67902c9c10f8880ba77bc07019a9d33293d06c2e3
TLSH
T17A613D5E028370D8DFD1513153AE597227A8ADC54936FBA3880FF13DE8636D0C67AB20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ae4f37fd15198799becf0a58c8f800f815ab90f0e54d0289fbbbd83fbbaf45ac
MD5 70f61152d0cb3973ece26c6a2d777665
SHA1 8a23bc8634f0ce4576571d70c106e3cfec8f0ec3
SHA512 48573ec3db8e6de9c5810acf3f8519428ecde64fb19285b00d4cd3956b4f1edf5f0ac3ad0f1ab86e73272c2e3427a6a18b9f9aa483c9c9a9ddc361f7ba0fe16e
TLSH
T13C713C8E029370E9DFC15136539E597227A4AC855836FFA3880FF13CD8632E1C67A760
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log
Size 390KB
SHA256 b8457d5eebcdf2879598be0f70ae3021f9ac14c8ca9480465605ee0146ff4b61
MD5 218d8ae5601e8752e043fa3174f43650
SHA1 928ebcc1f5bf3d2a0f7f0dd09bb538662e39004e
SHA512 ba2a7e16d3c495a7a4aaaee1733a014015b129f6ae1bd47dbb7d3992ea3796ab5ae5de0da0d6d81e82b5dcc816c969e10a37d5109f1f8710c0603dc2b557cec7
SSDEEP 3072:0MwXL/BzW4yHqAQ7l1mODf6rrbo1puxARTBzZbL29OlXKiZc6GmYox73z988fLeK:lgf9kq
TLSH
T11584A67DCC41D837C5B7823AD5E46B8AA6B6E8017D814C0AB1DE3E4D4433F9629DAD0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 600a025ad8d9ea81c60d581a0540fe423ecec253393c7e19f63127eff0f1b8d2
MD5 5eb75f47a44cd656c7b9032ae8635107
SHA1 b9d3cb1553a6cf98537b1db84204deed7ad3a30b
SHA512 253b9a027d36409d44603d63cf626c1eb387beabce59c1b6f0d83f4cfddff900f666b7df45edf4d470668bce7e73374e57e664c16e17feaa1c4498c3a1844764
TLSH
T1BDE0685C4AC8812F122082A31070BF0FDDDBAA08EBCCFC450F01E41470C641845E86B1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 03f6f3fab90d8c578862e73bbaca8484426cbe5f4bb16567fe9604ac0a81c01a
MD5 00927b1fd3209c95e5045c0498c68dca
SHA1 d19af5b7d8944a1e2abfddf7b677165b72e0e576
SHA512 1113b1c344c27ac2aace086be7ed12fde98174768f6eb79bee919603a7800e172b386b444b62b872bd6d8a7288ca7e62d365e239d625c92619fdb173f4ac6da7
SSDEEP 384:D5921zpMHeKJuJpzIOLqaIaEdLSWA6sixitPy1J/Rk4vQ9cCrKi2NWxKH4xuGRP1:Hg8kb1GUDrAOPErYD
TLSH
T17152B1F3C3E4873DD41552F06F142E1ACD6A0428636D386785E5EE5AE3E24ABE28164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f7af13480b86af3040e861f373a3f49036e33b497fed1ea881a8d7406a8061e2
MD5 bf3560be7f37994901652b4b003e7bac
SHA1 3496582233e7bfa02a0de54e869b81733148f4bb
SHA512 57dd38b95fb3c160deedbfa08bdec964cfc23f93eb77d1eb7756d3918495923addf8a6eee926be7c0ba9542e58e145f2b446dcf6769bcedd49528fc13a333f5a
SSDEEP 192:hRSQyzhCy1lj+Odv7XpiPRp8KB9fHsb+WNnMzFc2FECB4MkwzYQAViVyIsnAUgE:hRSQyzhxZdL2XNFw+1EKDhE
TLSH
T17152C76BBD15657BACCBD229F9637B97D3F5103226902D84E6FC8A1C05EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c555317d16dae4c36d3a04a0edf9753e6b81c1cab7c5c686270ace22115622ee
MD5 1f4baebd97de764f11274f4f75c4b9e7
SHA1 bd4ec9115f5766648b147ecdc97f8911ee756634
SHA512 721364164616448961a903ef4c6e3b884ad26e7f9ee4985a9c29d29734fe4d7c1d9baf4f726b3a204f8a30a2b2abe337f2ed8764361bcad0441eb33995adbf48
SSDEEP 192:hRSQyzACy1lj+Odv7XpiPRp8qYB9fHsb+WNnMzFc2FECB4MkwzYQAViVyIsnAUgE:hRSQyzAxZdL2XmFw+1EKDhE
TLSH
T19D52C86BBD15257BACCBD229F9637B97D3F5103226902D84E6FC8A1C05EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9a2414f0330b024c93d3db69828a378328162fb2fd24f1df2f373fb383865754
MD5 f684a7e6a2ed8f7874f6b708c35257bc
SHA1 d0ff3a5df98e073933613d6ed7126e73ce6b7f0a
SHA512 94854707017bb13af109ee13f5a425084755dfeb98dd55946b0bbd4c3a1b84e75421c3663e5cd77195889c415fbb2cf64226544485e3630b8a1caefc0ad49bda
SSDEEP 192:hRSQyzhCy1lj+OBv7XpiPRp8KB9fHsb+WNnMzFcI4eQB4MkwzYQAViVyIsnAUgE:hRSQyzhxZRL2XNFw+CewDhE
TLSH
T1B552C76BBD15653BACCBD229F9637BA3D3F5103226902D84E6FC8A1C15EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9ba7bce61af262eb7e404e99915f9dd9c3e66723d46a5d772f16c0f8471299ea
MD5 663e96b93adcafd5cbce83f088a36119
SHA1 3c1530c57fbbd49c36d60985acb7f746eb0d74a6
SHA512 20fc9612b40e7f4e459719a44d44d5914331a3d2018d3951fd95b3d8083076936c2df2953303b57dcd0ee919ec6ce94a89dacab4ac44962e557fc2ec298f6a0c
SSDEEP 192:hRSQyzACy1lj+Ohv7XpiPRp8qwDB9fHsb+WNnMzFc2FECB4MkwzYQAViVyIsnAU3:hRSQyzAxZxL2XuFw+1EKDhE
TLSH
T1A352C86BBD15257BACCBD229F9637B97D3F5103226902D84E6FC8A1C05EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2b76b76db249fa3fdf6601429e6136f568066cb2020ecf9ad6b735814c9bb13a
MD5 37d6c85f61d89069d632d22aec8d765a
SHA1 e18e5d3a002586a3a4dc9eeb559cd58c4ac07eee
SHA512 f41aa2255e0a39abbd9dbf19badfcdd272c96455a76b12a03db6cdbcb4ef1f45b623945e8602029b6a7a1e29f68ee3ede05116f7cc33d13f79b9298032cb56ce
SSDEEP 192:hRSQyzLCy1lj+OBv7XpAPRp2KB9fHsb+WNnMzFcOK27B4MkwzYQAV2VyIsnAUge:hRSQyzLxZRLUXzFw+S2dDTe
TLSH
T1DA42B66ABD15653BACCBD229F9637797D7F5103226902D84E6FC8A1C05EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b2d2814dedc4a2e3cc64cbc1ed802aa2451a1707684f9ec50e91d82744ae9797
MD5 2e608613025d7662ed63be6c3730439e
SHA1 b4221e5cbe3d04a6f1e24ae380c43f6351ec0511
SHA512 20bd32044135620e100f7cc0b0468c672a9cb4a138ea42cf90a678e921612a014f1b46bb329ba38133b3003b0b8ca2dbffb3cb7688d727e3c8266bb50964cfa2
SSDEEP 192:hRSQyzLCy1lj+Ouv7XpAPRp2KB9fHsb+WNnMzFcOK2RB4MkwzYQAVUVyIsnAUgE:hRSQyzLxZKLUXzFw+S2DDVE
TLSH
T18C42C66ABD15657BACCBD229F96337A7D7F5103226902D84E6FC8A1C05EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 88441f7725ed5685a2b1d5ef5037fb37b54904dd97a8a2e234382b55065b22e8
MD5 c29b41f992c4ca55f64012533f9da5d4
SHA1 d5a8a53295507f58299f13453395eb33e04f9055
SHA512 0b1196d764e78b4d4c7d2aba28cad794876b0671219aef38c499341d98770405f20546863e3a2394172f1f8fb23b09b0b7356fa4b03378afcb84bc1a7b60ae15
SSDEEP 384:eojKB7KxkXqKf/pUZNCgVLH2Hfgslmc7pLuLcSjYZXODKZ+ErU3n6HGY3Wobe:ecKB7KxkXqKf/pUZNCgVLH2Hfgscc7pg
TLSH
T14C7207777C489A370F94CACCD8277F4FADB5025B66E9886486FA482503D5ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 62KB
SHA256 78e0e360e88cd03d4f4f0d20ac791e20d37882fbb6a05cf5b80b58f3022fd346
MD5 75218785ea1e9b4977d7da41dff7b702
SHA1 c91adf8898c64887caaf328849bbbf6fe386b7e7
SHA512 cd54ff7cf676b51e9c5e840f148e5c530923c134747ea6b563a001af09d7557ac32909df89c7fd93e68d5b5d87ed84bae3a810f5e94f6ca749dbabc9b93c481e
SSDEEP 1536:/waGJUKEXr6EYQ85iwMiJXH91gb5MV2Vhj/gkU0nIjNjHWlvkSNTV1:HsXH91gF+NjuF
TLSH
T1475319E7341B00A21FE776BFE856E9E5BC33615D6CCC8954FB30892D0384A7C166B998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 a8ebeb5355f13f2b1dc5ec0adaa825306673ad6a2892ec3d10544793b0081808
MD5 03a62d8e39d995ccac6e6325f0bfa407
SHA1 7ad3d0b11db140ca2433e9d49358968ad89623f1
SHA512 0d3c0dbab9fa7e32b140769d68f1f3ae913b154e6ada2ec55bb6ce38ea47d9ca173223de8b522b1035bb36b7d479ac2e3896984d4ea93ccd96c510659e1a25ca
TLSH
T18FC09B11CA056151C05903B455995558B1E4DEF5CB0F23C551B5656F6C3517141652D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583f56.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583f56.TMP
Size 96B
SHA256 df49c8ac703dfdcc019abcb1e152f5ad9464835704b3d40d5a266550cdd9c8ce
MD5 23f0a2c909189e9acd2a981c1795ce4d
SHA1 4ecd261bf45a904989eec0c84212156102faea8b
SHA512 4f88887990ffb753d7462fef8621995c21fb1defc8182119874001dd0b592a7bf4f3b558fec46760e1711fcf308657785a32293a277155696e3c3f297825ad26
TLSH
T13EB022A8C0033202C00203F028CCE2FC3220CF22C2032302E2E00F2ACC323300020220
MD5 SHA1 SHA512 TLSH

Submit Download

b8a63c120d1e5b84_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\b8a63c120d1e5b84_0
Size 63KB
SHA256 3d2946a313118a4581bc706fa39b7cec5e793a101fbec743b65e08832b415bfa
MD5 7f43b55034d3fda431db7754d2a13fea
SHA1 f04849f9258ec08c071c5aba1000433964d449f5
SHA512 db0da10a92a01e953a2f60c880d9dae94ff3498b34c9a8737eaf16b7bb56115a3dd8909e2acbd83f323a7fee3702342859c4bbea6b48ddf8e7f53ca64a380927
SSDEEP 768:JeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:JDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T14A535CA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 abaa2224c38fb77540f6c437a7a01031d05b2f2e36782c87d61db88de1842501
MD5 3350fbc089187793812cf48ff520e8ae
SHA1 c6a6a4fef0ab46ace97fcf737c613b5893a9b294
SHA512 e516c170eb09f19b1735d2e9a2ce2fec9d42158510b5f154f5c98f6358143491465aa53f80237986fb054d563d04a03b42c9a8ed6debd1f01d8c17c4c9255171
TLSH
T1C0A002A461814885D411567C2089DB4423357E10124D9341A4D50876EDB49524225400
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\LOG.old
Size 370B
SHA256 e350a42cad25b7e8e78fc5759c280bb717648f266355cc467e23661be1fce70e
MD5 ea7aa5bdeccad0c5f0c5ca6bf6d6141c
SHA1 6b2fdc91a15e092df4c03f7dc938b5364518a99c
SHA512 21a30706c4cd807656aea851f0dc430ad9b0f0fb6eb4ef1db05ffbefe7e45f87f4f0dd3e0b287b8ab1cf4c6b8222038b5265b5fca4e11ae527bde923c7d3fd29
TLSH
T111E0D1D95A8D81AF722544378128775C77F23D34EBCCBD410B51D07855C410496D66F4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\LOG.old
Size 370B
SHA256 3034bc03f0d585f568b726d1a6eaf809dffa67ed544462ba2ef64572ffe1a45c
MD5 4de436138f4f9fe82ed61109ade9b1b6
SHA1 ee376329306ae470f20d4eac0ff9c0bb6501e338
SHA512 e3cc47bf64b76c49cd46a31213d0cfcf28952ad7ddcf8baa8a4750c1a9b0efa449fa5994e79ee383665945c3ade486eb694dc3877e5b1b48ca88908ad8dfb31d
TLSH
T18CE09BCD6AC981AF722450578164674CBAF639359BC89E054F11D07451C60057AF5EE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old~RFe5992b1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\LOG.old~RFe5992b1.TMP
Size 329B
SHA256 93269c6aa0055399a96140c105fb384bf898035dc8a09f7f10b7c4b69bf8473e
MD5 e6f067a9c4426b2a913f46c12618f1c5
SHA1 caedb736f0c786c9f18ced2c255b15815b8412bf
SHA512 06c296f8de2d75791af20bb6c63ff065f23e71b8279fadca9b1f75d886a84b2e12f7cc3f76e462992c602c42032a1b2fd7b561ec5bd13173f33da7102468e699
TLSH
T19CE020595DC5816F2264C0B795207B4DBAF96418EFC8AD064F06E57861CE00855E82E5
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 97255ebb4c47001506f9d6ab007bd52f8b5d7a099570ee6ad1ca2ec572482a4c
MD5 8da6aae15b182a7bf7e53871ff18f77d
SHA1 5b2fd5c751ea0a139342602a58b1da9a9401ceda
SHA512 e2cbd6b9373d17864cd1ad34b9b98f5e0c77b7057b2287c160e190d095b505126c80d487b059f9a19d5128dc23caf2921d51a4689fe6af6f04d76cb846faa504
SSDEEP 3072:zdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:z0m7Rkm1tYpBeh2BAoC
TLSH
T1D2C312379D75A83B5DB5B71EB04E0F1F1DF249A2D924EE52C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 35470b51002ee2938f486ff4cbd7d936b66d08c88438d750c29db68d29ad1a94
MD5 c1a0f9c785356173f8403eec344c135c
SHA1 2e3ae4b7c8a2f752f2ccc7f26c04408178bb8151
SHA512 5c8018ad8712a537ec33db6a97a43f2a10f77bf115f72007d3a188b43587db2f3ccb30c2f05c1e6ab38ff8d5fc7ddda36d35c47e16880c8368edc2bde88f2b13
SSDEEP 3072:xdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:x0m7Rkm1tYpBeh2BAoC
TLSH
T100C312379D75A83B5DB5B71EB04E0F1F1DF149A2D924EE52C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 abe92d35fd17caa2eb85cae048f99967c4fe99c1866334eab5209e5afc5e377b
MD5 c7c8cc852840c62ebfaef9e8921f51d2
SHA1 a184d5b7fe4e91ca13c5f8a798d09c2711e12812
SHA512 3f74610a5b123d222800785cb4ec20b8fd47304cd11cd589cd83dd9414823b0813079e2392a69f99ca1060c258070ca91758a59cd0e8de38adf953c07727e776
SSDEEP 3072:KdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:K0m7Rkm1tYpBeh2BAoC
TLSH
T11DC312379D75A83B5DB5B71EB04E0F1F1DF149A2D924EE52C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9bf44bda77fff85170a1c8757ce5490e2c22c112200680cddbbc9a2def12c13c
MD5 3a90c683ec0f7d44e4a0afb08ffac055
SHA1 bcf7d74604eb84282842630d66b8c1fcbf553791
SHA512 aed3a0897937e15f1cdc26aa0d6888f07222403b6f4881e367bb039d30b992f7ed597d43a063403f4671b38eff964b5f6eedab1b259b0fe37f8765d7239d2674
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:Vm7Rkm1tYpBeh2BAoC
TLSH
T17AC312375D75A87769B9B71EB04E0F1F1EF14AB6C920DE52C8D85B0423EABCC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 33f3abd0d8200caec172f9cb10dcbb3e37376152b3ba99d40e9db3f9b635f226
MD5 8182f3a710ca1fd595fdaf62a0d96daf
SHA1 6843bdfb5351dde24d56071249ead62246394402
SHA512 6422fea948c371c5c4e83dd180e8a0aa6196d4c5f1e1ea0e2270245a9dc46e84cec25d0bedc77de5b2ed82e56c244d34d7b4184f515c4e1e81e3e5009aa2a98d
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:Vm7Rkm1tYpBeh2BAoC
TLSH
T14AC312375D71E97B69B9A71EB44E0F1F1EF149B2D920DE52C8D85A0437EA7CC0A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 16340e5ace8f344f9541426555d5c44c633e0dbe04f47c8ccdeb4692eb3d90a0
MD5 0066de78478ff6dde685e4ae2dd1dcff
SHA1 cc780d705caf9febcbedc5706f53b31ae5badbab
SHA512 8df6e19a01687960f2ab8fb5e744b4ea4433a0f5de5576fdc6bbbeacaa8e8693a356bc70e33cf0cde906b301685fc79a88d0c5bcc4084e38f7f860648a629b05
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:im7Rkm1tYpBeh2BAoC
TLSH
T1C6C312375D75A87769B5B71EB04E0F1F1EF14AB6C920DE92C8D85B0423EABCC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e83f6d41-1b2d-42b8-ac4b-3ee3118b7d1b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e83f6d41-1b2d-42b8-ac4b-3ee3118b7d1b.tmp
Size 116KB
SHA256 0ba27020bf1d97079d2be82620788231b73d2229cafa41c407d29253187911d7
MD5 f179663420342180f93f0da664b9f8c0
SHA1 951620a99792a1d7fafcb6ae16add2a04cfc1863
SHA512 47a0aa4c1caf9a75f090e3cf921848cee505c648bdc6e14e8a99c864c2e3d76752a891627f0a322fe7283f8c8fe67ce9aa448ca6f06fac8aaf265fda3b347dbb
SSDEEP 3072:NGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:Nxm7Rkm1tYpBeh2BAoC
TLSH
T125C312375D75A83B5DB5B71EB04E0E1F1DF149A3D920EE52C8D85A0423EAACC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Handout_T30 (1).htm

Path C:\Users\Admin\Downloads\Handout_T30 (1).htm
Size 9KB
SHA256 123caad3b263197a48f4e1644898cb7f9929a2eacd8cea7624e1b8967a6e3a4b
MD5 a154a22f6bfd46a50784f88bfd9058f5
SHA1 76271ca409fe59f28af97d4d8876563dce8b7e7b
SHA512 daf90fabea731e77f1f72eda4c327e3da3b59e0d1439d6b83af270e86efbe110357b14a07e550343ad122db394393af09127a2dced1cd8fc9a4e44a67514867a
SSDEEP 192:7YjKiI7TmAUNikgtcfTYbl94z5oAzyu1Oc5b26uHyxlQyJ4Y:cjhNOE5pJ13b26uHwayJT
TLSH
T13D127E7B5582641D7632D0B4E5FA634FB8824007A10D9358B657B7A383DAE4718B3B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download