hxxps://wetransfer[.]com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?

Resubmissions

09/07/2026, 04:38

260709-e9tv7adv5x4

09/07/2026, 04:36

260709-e77z2acw6l4

09/07/2026, 04:33

260709-e6jk2sdv4t4

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?
Sample260709-e9tv7adv5x

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280455623159102"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
732	chrome.exe
732	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4432	4588	chrome.exe	83
PID 4588 wrote to memory of 4544	4588	chrome.exe	84
PID 4588 wrote to memory of 4368	4588	chrome.exe	85
PID 4588 wrote to memory of 4368	4588	chrome.exe	85
PID 4588 wrote to memory of 4216	4588	chrome.exe	86
PID 4588 wrote to memory of 4216	4588	chrome.exe	86
PID 4588 wrote to memory of 4016	4588	chrome.exe	87
PID 4588 wrote to memory of 3684	4588	chrome.exe	88
PID 4588 wrote to memory of 4016	4588	chrome.exe	87
PID 4588 wrote to memory of 3684	4588	chrome.exe	88
PID 4588 wrote to memory of 4944	4588	chrome.exe	90
PID 4588 wrote to memory of 4944	4588	chrome.exe	90
PID 4588 wrote to memory of 2428	4588	chrome.exe	91
PID 4588 wrote to memory of 2428	4588	chrome.exe	91
PID 4588 wrote to memory of 4672	4588	chrome.exe	93
PID 4588 wrote to memory of 4672	4588	chrome.exe	93
PID 4588 wrote to memory of 1696	4588	chrome.exe	94
PID 4588 wrote to memory of 1696	4588	chrome.exe	94
PID 4588 wrote to memory of 4940	4588	chrome.exe	95
PID 4588 wrote to memory of 4940	4588	chrome.exe	95
PID 4588 wrote to memory of 888	4588	chrome.exe	96
PID 4588 wrote to memory of 888	4588	chrome.exe	96
PID 4588 wrote to memory of 1648	4588	chrome.exe	99
PID 4588 wrote to memory of 1648	4588	chrome.exe	99
PID 4588 wrote to memory of 644	4588	chrome.exe	100
PID 4588 wrote to memory of 644	4588	chrome.exe	100
PID 4588 wrote to memory of 832	4588	chrome.exe	101
PID 4588 wrote to memory of 832	4588	chrome.exe	101
PID 4588 wrote to memory of 1804	4588	chrome.exe	104
PID 4588 wrote to memory of 2456	4588	chrome.exe	108
PID 4588 wrote to memory of 2456	4588	chrome.exe	108
PID 4588 wrote to memory of 2132	4588	chrome.exe	110
PID 4588 wrote to memory of 2132	4588	chrome.exe	110
PID 4588 wrote to memory of 2240	4588	chrome.exe	111
PID 4588 wrote to memory of 2288	4588	chrome.exe	112
PID 4588 wrote to memory of 2288	4588	chrome.exe	112
PID 4588 wrote to memory of 2528	4588	chrome.exe	114
PID 4588 wrote to memory of 2528	4588	chrome.exe	114
PID 4588 wrote to memory of 3588	4588	chrome.exe	115
PID 4588 wrote to memory of 572	4588	chrome.exe	116
PID 4588 wrote to memory of 3960	4588	chrome.exe	117
PID 4588 wrote to memory of 732	4588	chrome.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe2683c728,0x7ffe2683c734,0x7ffe2683c740
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,205415990450187877,5322889641340944512,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,3584617614670088917,3393831167954454513,262144 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,9910861969384501447,10758978168667479469,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,3791615184317668677,9828992864566040563,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,7258689604539533112,12881328239300831724,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,13758742068238094802,10759624220481211707,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,8853156032418670401,9892380450923183515,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3216,i,644658471232444914,5826681499431893430,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3896,i,11546053534118504767,2536975236795520992,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4776,i,1602600981504230897,2874012686049289003,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5212,i,5049744959646061712,1914816143431031101,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5524,i,4215396059124614425,1429233455191536349,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5696,i,8907382565706428994,648506492025268443,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5832,i,2564762891082796632,7236236985072787741,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6624,i,5894243274278297845,16949695301060474244,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5432,i,5519334383040249587,5676385031038900205,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5112,i,4058777643640495746,4294851012963255319,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,15138193786120682871,14389829579315113808,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5456,i,12746282696562093242,9234285911610936059,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5348,i,12490708326050247742,10981454866872460846,2097152 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,2979663414798915675,17467914440219412092,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,2689022950434176122,17224286187585676208,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,10596501255867296320,7935083270678265048,524288 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5308,i,1777468342430404381,10259415666989606964,262144 --field-trial-handle=1792,i,5118679397176293747,2427997589401379628,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1c1306b4ef191eebf4020a4e3ee3bb6e7649df7c4d0955719a3e6bc07899aebb
MD5 c6f05311fb1ea4ccd96b43c5cac907f7
SHA1 b6b742206eec19e1f420e08f0a61e9dec801b0b1
SHA512 adfaf3c95db5caa4d71431b22fcffd07f067f98dd4890dfa76d4326d0e15bdd82a88a6d2db2040fd302b8145a7497b55a949efb8ce57ead6582c85ece78c99a0
TLSH
T188E022BACD25DC2718FE072A65686782E654235F2B51AD0F7B3C960D8FB077A498281C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d2e5c6bef5c368f2471ae319c373da096de767115b1b08d8ad4959b00e28fe9
MD5 0c0689c7a62b8bc009463005e59f49c4
SHA1 4305326ea8cf7a32fd6328f10d063f5acdea7d9e
SHA512 ba22e16f418057bac17c0875e247c373b947cbd3b689dea3f525b819ab485e60f877c7f02d462d2c3f055f8afd4615ebbbfe334ee96dd35a7ff472c5c9632ee8
TLSH
T1C8715E6546DB48A8DFA4543013B2E8CD6AA48E4F610B7F83988CF7F86B12EC0045BDD4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log
Size 234KB
SHA256 88a1a79c670696c41708f9ca17cb47fff766378493ec189ffc8123b21a8888b2
MD5 9c82094dcf6087057321ebf6c4ee850b
SHA1 b2458f7469e642d48e6143cf339c5a4db5425400
SHA512 049b23ab982d26b0abae6e5bb434305dcd335a3200264ccb62121e436c02b340cf6823cf6383aba61ad3284c1fe06e8100a0eb46f5006e0ba8660c3fd7b69705
SSDEEP 3072:JMgZPNclzW4yHs9qw1/NkPRZKhPImLpZFtf31QLlvDOwJNcskjR8Y4tg8kjAugs7:d3Bi
TLSH
T13A34A8BE8C80C836C4F7463B99E16A8ABABAED017D814C49E0DE7D5C4432F563DD990D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG
Size 347B
SHA256 ca1096fea20b7f33da1520fe7731ce53410e4545939d366022b527d4c5d2b34a
MD5 b4f6c9877031f6053ac6b60a072dbebb
SHA1 281703cddb3b69c7f51ffb140d66fdc9ad4ec02a
SHA512 a7cd67958176e2461fff9702def99901639651207706bff5120184581950f7fe53f7d60f81e124e38d6a4885bcb5614ff05a80daafe5a1b254d43e176f621fea
TLSH
T17BE0D81C9AC9826F5114C2671575BB0EDEEEAB0CE7DDAC851F01E41471C580894E8272
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 dbcb5a9906f1917975b890dc1dfb106afec44af0ab3d8d1ad08f598e43db5b2e
MD5 ce55e8c0c15cefd5858f4f9a1de6413a
SHA1 2885637376c7c1890100294d4db17a9292e50475
SHA512 e3290976ded005796fdb525fa9bac816508a5e1bf32b8e94a60848418c0e54869a5f4e1269fbad02ee983db99f18731254d0a6fc634e24f7c7444dc4a8cb6fbd
SSDEEP 384:DlyRqq+C1eWv1Jy9J7QWCiaIEad5moGWpmi9bQ8y1J/Rk4qat9jC9Q4CqkWxQKq1:AqOk4rna78IzdRrPE
TLSH
T1CA62C2F3C3E4873DC41956F06B106E1BCD5A0528736D386785E5EE4AE3E24EBE18164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bf7692117b27d5ad84e4f7715e3c3f02df87c681dcf2725058d8630f86a2aad6
MD5 438bc42c860c5cd3f8d0687be6618f58
SHA1 b4dec124e78eff20d5247c91c93b76c6189ed79f
SHA512 be1f2d5c25221052a3b5fb20602d5dfe9b340fc88834587ec555b0a8a741594c608383ba8c7c27bdaf0349c20718e192b3501647ee11afacae26b70da624eb35
SSDEEP 192:ERpQCS0NeMqzv7TpAPRp2jVgH99Hsb+WNnnxFcVLezv2CQkwIalKVyIsnAUgE:ERpQVL3UXDjwx8eD2roaYE
TLSH
T15452E62EAD15793B6CDAD22AFA627797D3F5102125C06E88EBFCCA2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 035dd8b77c3d3a2061aa4ecc1dfceac96f7fc6e6e3dfbe6ca2f44aec12f55d49
MD5 0c8143e89b50db10107a39686ba91d88
SHA1 426b742a7aa4c285f9f070ffcda28dd9aa9859b9
SHA512 6a8739b843da802c65042b1fe1170498eb4a94b4b8a15c45f7e171476d4020f87869258b2d57c9727ccec1458ce1ce750b33b870724a7b1a589ff7b5d1c7ece4
SSDEEP 192:ERpQCS0NeMqUv7TpNPRpFjjVgH99Hsb+WNnnxFcVLeUv2CQkwIaleVyIsnAUgE:ERpQVQ3bXCjwx8eO2roakE
TLSH
T1A752F82EAD15793B6CDAC22AF9627797D3F5102126906E88EBFCCA2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e202139983cc063db3f56fcb5129ebce243b81a8265eb4772819f4dcd2e460bb
MD5 bc2ec072b52a6a75ce905877496a808e
SHA1 ecc3e3094fd415e1bf69ccaee2197de8c912ce1a
SHA512 edc82e6e39a686c96dfca9ea024bde30ab74458452f2597407cc18581156212725e6bcdb7042e55847b1a710e3342ab183bd5f73a907771fa3cebd770743ad11
SSDEEP 192:ERpACS0NeMqBv7TpAPRp2hH99Hsb+WNnnxFcZH2Dv2CQkwIal0VyIsnAUge:ERpAVR3UXMjwxo2z2roaWe
TLSH
T16542D52EAD15793B5CDAC22AFA627793D3F5102126946E88EBFCCA2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af7d820d5c59433b26f79199316d56239daed282126744d2be33edadd455a0af
MD5 3e29b61ebbd88af9e998868f5451ffd6
SHA1 0a0c427260c70842a55f6b9c5337b38503ec1e0f
SHA512 8be154a3cfafba8f14b64eb835f2d03dad991ad0fcab532e52b87217fa8dfd564a3df7397ed255a3aae5fc01ccc40d50a968d0ad3d3a06b57e5c7fc8e7733210
SSDEEP 192:ERpQCS0NeMqQv7TpAPRp2jhH99Hsb+WNnnxFcVLe3v2CQkwIal0VyIsnAUge:ERpQVM3UXKjwx8ef2roaWe
TLSH
T1ED42E52EAD15793B6CDAC22AFA627797D3F5102125D46E88EBFCCA2C15E35CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 62KB
SHA256 4f7f68bbacf9b088be674f0ce6f68f072a9a41482eaa8c4c2b77c9fcf8742e69
MD5 d53675c10dbc982e5b74cfb0271e749e
SHA1 405d2d810b0107a4b283edbbd2f9209cf1927a7e
SHA512 1c409e3239fd71ac0a1d7a2f58065410771ae0068a5be26b16b04121d54f50821de4b6a23c2f9143e1ed68837c5322289ceb567ac7476f62a8314fec854cd484
SSDEEP 1536:/waGJUKEXr6EYQ85iwMiJXH91gb5MV2Vhuq/gkU0nIjNjHWlvkCNT9:HsXH91gF2NjWn
TLSH
T1285319E3341B00A21FE776BFE856E9E5BC33615D6CCC8954FB30892D0384A7C166B998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 54dcfb63271b664291df365615487a69516480805c4a908f124c9d51fcf89203
MD5 8c0b1259283362e6dc40dbd67f31875c
SHA1 d00f764ed82584c70f0af1062525d647c5212b19
SHA512 15f5a51bc641f4347cedb1ba96c9cbaca8270e5d116ea088d6b253d287f8d63e938dde9e24301aa98cc40b18ae1a416c3fe041b897754114e749f3a32c7276b6
TLSH
T123C09B01CA057152D0570FB4555555D871A89EE4D70E278561B4252FD83537141541D2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586656.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586656.TMP
Size 96B
SHA256 c97345db1d7a6eecfee955b4ef2d99c2f2e50eec7903345b6c77883db915c8f3
MD5 e09ba7659dc152385763f8c2b735413b
SHA1 1f068883f3a11cba8842e2baf760a53250177111
SHA512 65f1eb950163a69c3ad639c32057043de4b6498718b7a21fb7c6daa31682cee1541db32bb166d3b4dd452ef8fe80fe3e79733a0e6a72ef5084aee90914949228
TLSH
T189B00299C1136712D0C603B669D5D5D87160EF35D6132222E2E03B67DE2967146291B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 57f1be3b2c06fb377dc4e191366f743b74fc6df7a1bdc90fcf1aaa23b6bc5b64
MD5 ff12518f0ac4d3eae724db1806806866
SHA1 bc5672e250266590cad17c17735b45b2965d5878
SHA512 17966448f9c50221d4bd534a15f438dc37a95e1cbf21c4314cbe9451022116c88c6a3b2adb27ccd45909521915370a123b9baee5a8ce3f64daf3c008a84fd89e
TLSH
T168A0025131850043C01446B1509591482AA16C19124A16097AD25D468DD52485185410
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 e36f264acf1c11122ea39530fb3767d4882b54cd602ac4577f1669881830a79b
MD5 0d1ed26b6a0a8a2eae0038f81a141563
SHA1 fe4c7d077c177c166c16273a935f93429f05dc3f
SHA512 674f5b3cf43f19b05f5746bd0206eaaa322255673f5047ff4775a6602eb2b4a1a36f1a298cc5783acfd3e30184956899200609c3b9dc9bcdd8976a96b282f35b
SSDEEP 3072:oxftvFTeVaLvkcCIb+h6mJG9r5w3LffUnBKU/F8enCW3iyVEXGey0cB12:oxVdYaDIIb+I0G523LfqBZqenbyyVEdd
TLSH
T12CF32231F59AFF2F51F829B77407A7062DD5A47B40A5BB88C07C2A1850CA398FF95C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 047432825e11a9d5c78c54211090a0bf157bec382d9c638479d34285eb91629b
MD5 d68e9e44c5a016262affc64594095c5c
SHA1 e0f34fa8dfc71fae71712a1e0fc692f879d590ab
SHA512 6037de1699a3e03ff58f966c1be7300b02f4734f3f68618e8058882980c0bf03967a15bd3b06d14958426ecff9e6b951794b7a296e1e86e7264b14d2096f7034
SSDEEP 3072:Ixuw3LffUnBKU/F8enCW3iyVEXGey0cB12:Ixd3LfqBZqenbyyVEd1cB12
TLSH
T11CB31221E5A6FF7B9275472AB50B93295CD148FB44E1E788443C2F19E0CA388EF98D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2282013ba682b9c1bf7f96d745dcffa37c351ee6c7a03ebe78992014990233d1
MD5 79ac9848c69354e7cf64135831341a8c
SHA1 5573fc202493c5f623b9f239c733405e23cfe070
SHA512 94dde27852da4548c4ca322bf780015e940aad0ff397ba5c4c97ac0660d3d20206f1ae55e1b5124dcccf520b28bce25f26008e8226e10b43976c24a07eca832a
SSDEEP 3072:oxDw3LffUnBKU/F8enCW3iyVEXGey0cB12:oxc3LfqBZqenbyyVEd1cB12
TLSH
T19EC31231E89AFE7762A55737B50B932A5CD148FF44E1B788443C2F1990CA388EFA8D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6ea5d8b9dbd3ffef35bf8048fbc331323539287cb52d4b1bc50d65f61ca84309
MD5 4f54f756f55f8915ed9745f065eb0cf3
SHA1 67554d863e861cbe55acbe34d655dbea3d4a526e
SHA512 00bf4179aa4488fa64bc1b417f19664630850a1b69057dcd20763ab67fb8d6a867a484e59c8e2c9a4a7e535a1eb65a3a82e0660ac73f961a97e547a2e5600731
SSDEEP 3072:dxiw3LffUnBKU/F8enCW3iyVEXGey0cB12:dxh3LfqBZqenbyyVEd1cB12
TLSH
T1BDC31231E89AFE7762A55737B50B931A5CD148FB54E1B788443C2F1990CA388EF98C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download