fb603c01dc98503cd3c76b083d905bdd0a305af743f55ca1cd319809112dee45

Resubmissions

10/07/2026, 23:14

260710-28fcqsew5k5

10/07/2026, 23:11

10/07/2026, 22:54

10/07/2026, 22:45

10/07/2026, 22:41

Analysis

user interaction
yes
max time kernel
485s
max time network
483s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.protected.exe
Size 10.7MB
Sample260710-2pt2saf16w
SHA256 fb603c01dc98503cd3c76b083d905bdd0a305af743f55ca1cd319809112dee45
MD5 260f0b43652dacba1d2e8012f025f9bf
SHA1 306801d8880cb7c2b5cbfdd233254093d508cdd6
SHA512 f8d44463f3aafed40ea630499135c7b3b40101d9a5f980ea8ef6a3edb7828083118170cf96f04b9482b6c7d650097b995744c1dbfdb3d3df6f433625feb81fd5
SSDEEP 196608:Dk9iQqmwPlFBXbQfqLepURPBm7Fy55e79czik1IEwinANmxlvdC:b9FZUCL6mZnnQcZKJrKdC
TLSH
T15EB623EF4AD9A2F9D44319605A8B02CE60C27D0955FD8D253DCB2D05B124D2F628FFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 1620	2280	x64dbg-unsigned.exe	84
PID 2280 set thread context of 1620	2280	x64dbg-unsigned.exe	84
PID 2280 set thread context of 1620	2280	x64dbg-unsigned.exe	84
PID 2280 set thread context of 1708	2280	x64dbg-unsigned.exe	128
PID 2280 set thread context of 1708	2280	x64dbg-unsigned.exe	128
PID 2280 set thread context of 1708	2280	x64dbg-unsigned.exe	128
PID 2280 set thread context of 1708	2280	x64dbg-unsigned.exe	128
PID 2280 set thread context of 1708	2280	x64dbg-unsigned.exe	128
PID 2280 set thread context of 4776	2280	x64dbg-unsigned.exe	129
PID 2280 set thread context of 4776	2280	x64dbg-unsigned.exe	129
PID 2280 set thread context of 4776	2280	x64dbg-unsigned.exe	129

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281971996315934"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2280	x64dbg-unsigned.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	loader.protected.exe
1620	loader.protected.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
3064	chrome.exe
3064	chrome.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe
2280	x64dbg-unsigned.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1620	loader.protected.exe
2280	x64dbg-unsigned.exe
1708	loader.protected.exe
4776	loader.protected.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe
Token: SeShutdownPrivilege	4560	chrome.exe
Token: SeCreatePagefilePrivilege	4560	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1620	loader.protected.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
2280	x64dbg-unsigned.exe
4776	loader.protected.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe
4560	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1620	loader.protected.exe
2280	x64dbg-unsigned.exe
1708	loader.protected.exe
4776	loader.protected.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1432	4560	chrome.exe	92
PID 4560 wrote to memory of 2736	4560	chrome.exe	93
PID 4560 wrote to memory of 2736	4560	chrome.exe	93
PID 4560 wrote to memory of 5020	4560	chrome.exe	94
PID 4560 wrote to memory of 1240	4560	chrome.exe	96
PID 4560 wrote to memory of 1240	4560	chrome.exe	96
PID 4560 wrote to memory of 3508	4560	chrome.exe	97
PID 4560 wrote to memory of 3508	4560	chrome.exe	97
PID 4560 wrote to memory of 1904	4560	chrome.exe	98
PID 4560 wrote to memory of 1904	4560	chrome.exe	98
PID 4560 wrote to memory of 3260	4560	chrome.exe	99
PID 4560 wrote to memory of 3260	4560	chrome.exe	99
PID 4560 wrote to memory of 1640	4560	chrome.exe	100
PID 4560 wrote to memory of 1640	4560	chrome.exe	100
PID 4560 wrote to memory of 4076	4560	chrome.exe	101
PID 4560 wrote to memory of 4076	4560	chrome.exe	101
PID 4560 wrote to memory of 4164	4560	chrome.exe	102
PID 4560 wrote to memory of 4164	4560	chrome.exe	102
PID 4560 wrote to memory of 1396	4560	chrome.exe	104
PID 4560 wrote to memory of 1396	4560	chrome.exe	104
PID 4560 wrote to memory of 4340	4560	chrome.exe	107
PID 4560 wrote to memory of 4340	4560	chrome.exe	107
PID 4560 wrote to memory of 2016	4560	chrome.exe	108
PID 4560 wrote to memory of 2588	4560	chrome.exe	110
PID 4560 wrote to memory of 2588	4560	chrome.exe	110
PID 4560 wrote to memory of 2096	4560	chrome.exe	112
PID 4560 wrote to memory of 2096	4560	chrome.exe	112
PID 4560 wrote to memory of 3228	4560	chrome.exe	113
PID 4560 wrote to memory of 3228	4560	chrome.exe	113
PID 4560 wrote to memory of 516	4560	chrome.exe	114
PID 4560 wrote to memory of 516	4560	chrome.exe	114
PID 4560 wrote to memory of 2472	4560	chrome.exe	115
PID 4560 wrote to memory of 2472	4560	chrome.exe	115
PID 4560 wrote to memory of 3892	4560	chrome.exe	116
PID 4560 wrote to memory of 3892	4560	chrome.exe	116
PID 4560 wrote to memory of 4172	4560	chrome.exe	117
PID 4560 wrote to memory of 3096	4560	chrome.exe	118
PID 4560 wrote to memory of 3060	4560	chrome.exe	119
PID 4560 wrote to memory of 2464	4560	chrome.exe	120
PID 4560 wrote to memory of 3064	4560	chrome.exe	125
PID 4560 wrote to memory of 924	4560	chrome.exe	126
PID 4560 wrote to memory of 924	4560	chrome.exe	126
PID 2280 wrote to memory of 1708	2280	x64dbg-unsigned.exe	128
PID 2280 wrote to memory of 4776	2280	x64dbg-unsigned.exe	129

C:\Users\Admin\AppData\Local\Temp\loader.protected.exe
"C:\Users\Admin\AppData\Local\Temp\loader.protected.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa5326c728,0x7ffa5326c734,0x7ffa5326c740
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,900346852485152252,15907599982665396322,262144 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,9337460805528632767,15653615488122046962,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,5634498399094618883,6086065777213172773,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,15781415046465143255,1454820388364164421,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,2366051221882361029,5855693272471048023,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,5320806802731666189,9277429262291811344,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,10643841476262355750,11584763970789892221,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4536,i,12439468381257304199,10432243368722812943,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,2548357935169305048,6164099328317262826,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5212,i,3911162347266713841,8404401249170274453,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3292,i,1113452638252133645,15771493959385310216,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,11664299463194950312,4005132925453171773,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6080,i,8546695975903195871,12363392149250858665,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3360,i,12699718617157561899,8085267778521970481,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6140,i,6162097530344385134,8450180464469284608,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6116,i,10322762704422335670,5586026388450436534,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3204,i,12950692770890118410,2887491400191987903,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6444,i,11098298151044857387,12093400072118321687,2097152 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,5709565334403106504,10896944708911802292,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,13603720430274061210,17400067212731002740,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,5588996782139503559,17151039961520682932,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,3200350712868494431,7627574946445499195,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1204,i,8073259043251546506,16545543179064229276,262144 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1148,i,11907248875787442425,7140323249158320078,524288 --field-trial-handle=1956,i,10599309670016108070,3600691492635991642,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1256 /prefetch:8
  2⤵
  PID:924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3484

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg-unsigned.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg-unsigned.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\loader.protected.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.protected.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\loader.protected.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.protected.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9491af06fb847ccdb2e1f0e92855401715ba05634d58d7d0f5949a5eec1db6bf
MD5 ea7823350c2e0d0d2e375bdc9caf81f4
SHA1 85dd7e39d2d1db5ad413f9948383d6e446fa04dc
SHA512 96495462d5e09adff91b768d45e6c0d3061efecda76cce636be6c7bbb6d792240e4fbfa5bafa274c50f20ddfdef4865fee47f95ffc0c7fe2276b106cfa66b842
TLSH
T12BE0ABBAC9209C2B08FC0B6874080346F25023472B40455B3A3CC3098FB963A1886C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 76KB
SHA256 2103b7bd4c56e51cd2c307c7bd5dbb0d831aa6274607643008e3d9a92984920c
MD5 c35dce0b363800bca6a20346e6920b9c
SHA1 2ea06d2e4286d81b3a20f3bf1534b75cf542b063
SHA512 089a92fa2bd0f49c7a2b76f53f55ee2cc114a3d1c5c255b287838b2d84be0c31f8e89a4425410b198417fe1caec441610bcf23e126153739b8f1e4818a2e4dec
SSDEEP 1536:1udlBhiPEuFQDSwvteYsVDc+xQfBMbd+cRK/YhXnP2LiMs3y33D1K9r9YQXqV:1uBhiSDXjpMB+cnXeL3sC33D1KB9YQe
TLSH
T1AE73023C9744A8625A3223B86FFA3092B30E927B637F1BD57075E25188AB534F0BD553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 41KB
SHA256 75fb7769ac4a592cc3d9d83bbaceb0cac3867ecb247c385609a2b934e949c448
MD5 1c538adf76b82e8dbc907c376b2edb86
SHA1 044271aa82a53bbec84fe1df58506d5468262ab5
SHA512 8f1dd76149d10058b5b81b49739db9927a18cc2f56c00cff8806e4f4b6882b3456da81ada92a8c7533230c481a53dcf29abd72dcbd361f38e183dc4fa5686ce3
SSDEEP 768:uiPeGCTU2LKdTjK1rl0Ync9I3PHw1ALw+wBAPYqaia1PsbtUZE5JCaUvZGJatEGc:XUQS1rl0YncC3PHGA8PXRiMPmoKkHZGN
TLSH
T11313F1CCEFACD50A0CBFF1C9707960525D565F928829EA7744C2BBDA01748633837B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 96ffe01ff4eb8c9d0fb28de29230297844d0c3c5cce1d15cc2d58446b23abe8c
MD5 2f6d0beb9805ac688fa73d6622d367a4
SHA1 62061a9af1567fb8339de715ac87330f7a88c5c3
SHA512 10655d9809126c9f850c02e95a7729d00063e2fc6ebe51fd87abd00b98786ee666cca71d59494da1f2bb74eccde27ccd148b2326d72955d2d1ac9eee7d12e7ec
SSDEEP 384:DbueiMbch1zc0aZAlpQDaIBkVCusHj09y4tkN3i3koViPsF4l6DspXCVaMXrBpib:YuChaJl
TLSH
T19A62BBF7C3E8C66D896256F5AB252E1BCE5D0A14432C3C66C8E5BF4F63E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 e468e46f7048436585e5cc2d709a2a977276a60c985a6ad6dd0321f8042cd8dc
MD5 62c8eac8cb911d5db4987bdc3ba2fc1b
SHA1 90a802aff6348c5213378b3ea0d07000b88b2770
SHA512 5c41cf8013a53b985bd46794521931a208faedaa8f1085c2b2518d7130c3f84942ade5a52de534cf4dc8fe7831ac46c39af594364be4c401288a90f6a10eca5b
SSDEEP 384:DbueiMbch1zc0aZAlpQfraIBkVCusHj09y4tkN3i3koViPsF4l6DspXCVaMXrBpK:IuChaJV
TLSH
T1A662BBF7C3E8C66D896256F5AB252E1BCE5D0A14432C3C6688E5BE4F63E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 f82be330935c52e74fb8b184241da9f5d1b7b081a9ec169a949f2a64c4d3acb4
MD5 00542177b851dcc074fe84ef784e5ecb
SHA1 a8a3da57a16b1f2f38b6362f0acd3091ce60b93d
SHA512 c113c45939ae145318d9251f03b4152da145fc35173478c19323f2cec402b4681a486e2ec0b3d0d48d178606c3dc925f5c6c9896883c285cc68898698fdc7138
SSDEEP 384:DbueiMbch1zc0aZAlpMaIBkVCusHj09y4tkN3i3koViPsF4l6DspXCVMzYmXrBpQ:QuChBJH
TLSH
T19C62BBF7C3E8C66D896256F5AB252E1BCE5D0A14432C3C6688E5BF4F63E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b769a1bedd751423e333448b613adbc2d7bacad39a15915810bee3da04129001
MD5 5244049e4aa5f0c40d00e54cc4ab3e81
SHA1 9350d16bd006de6c3bed7dbcf7a6dfc83dae5df6
SHA512 6484aab3c6e0bf2a602312b09f05a3d0bebb6a91f8d8bf0fe746396ea4137c5c5a77200e894b0588f9fc633bb263e3748672c4054541b04b993cef68d0dbd17e
SSDEEP 192:PRDcBz00pux/ubfsKJjv72ympgPRpywXK3ip95Hsb+WNgQ5f4Nj2LbF+hfVyIsnB:PRDmz0YCMf1bQgXn7wHy2nye
TLSH
T13952A42BA910597BADD7D229F9127B67E7F4502225901EC4EBFC8B1C08F79CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 75ef250500c4d1f47ea89b23cb0acabd194a3730d2b694abe668a97bc21b80cf
MD5 10f45ad7b3d0ae24c494ec224008cfcd
SHA1 c41d062ef6a7b102d12e82ef1619ab072e08c2c0
SHA512 bed480c73282bf8d9a2de0334978bf2062273ff7b36a41ab972ca9fa259e18abf3beb6f067c018915a9fe5777278f91bd70714ed092e07d700b7e28dfbc7b61a
SSDEEP 192:PRDcBz0ppux/ubfsKJjv72ympAPRp2MKup95Hsb+WNgQ5f4Nj2BbF+hXVyIsnAUp:PRDmz0HCMf1bQUXH7wHy2N8e
TLSH
T15552B62BA910297B9DD7C229F9227B67E7F5102225941EC4EBFC8B1C18F75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fe4a1f5140cd9c67cd0e61b5d41fd16c6204c0e8bcb5a54c2fd592fea85b3909
MD5 37acb58f88d2aa3ae2394521d98c25e8
SHA1 236666606071b703ba8f952e3e245f220829a61b
SHA512 e89cdb1a2f59ca4f1600835f1a5d943f9990f19d12d73199ed536a3cd76b13348e2f8e3af13e1f0e7e38fd3cbc29940ab810da0015899996970d2fddda0ddab7
TLSH
T127B01240C0015101C00217F41696288872A4EF15D60A27024BE06D27CC391918215050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c81d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c81d.TMP
Size 96B
SHA256 bb5d657bb7f79d7374ac7bf4e96eeaa94cdb4d6225e2fa6ccb1b5fea2b2d2e8e
MD5 d363be83f8c5e18549f653f3eee57e2b
SHA1 7c6464c603b7ac02bfddbc78111a5894f22138ec
SHA512 534bda99e20785782c11ede3d1060e6f34e026ecba9189af008415499738adb3a84463b9c833196bf6d419b51fb7e580558039d0a16840cb2a3dde50aa271fa2
TLSH
T14BB0228BC0022203C00203B02E80A8CC3230CF32CA830202CAF00A2ACC2AFA0003A030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3e68ad96cd52179c6e70e3587be429eb7b52532f4673a134ac000070872f1024
MD5 220f84c15c2a31f5da9832958b0b5404
SHA1 1d4843ad74efeb5b722461b6dd3f1ae875d913b9
SHA512 3b67a603c9b518bbd061414c1e4e6b3fa7538b7d228488f7fd5bfc96e594b5dd6c02c6c41912f9138994dac64d66e0e1c5c26258127dea8fb285e1e2f9430067
TLSH
T1C3A002581A8D2AD7DD435A7612D103C827144851B347030E9A93464CC854D824553309
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 6936d4c10e83f479f505fd71fdf824a6419af14abca63b602b9a36a852630a4e
MD5 7c5f124ab38f39b8c2592da7abdc3514
SHA1 7eb1316e103e3d3472ad0ec0c51839f812f1df6e
SHA512 cff47ae1b635675494eb804983bd87808b37a0f74daadd66296d8ea587d27b5c0054a5ee084f143d3c32281d1e72e3c85d82c5f96f460ed701801b71a40ba429
SSDEEP 6144:YBl52bI0SkmXv8PhN2DvDJGqZ/ZLW3Exq:cf28BXvM0jDJGqZ/piQq
TLSH
T17E3413336BD30F36B9A3AB3437535DAA2EF14ADEE820830579593B57B9974006D03DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 293963821577419e79e661d0cb7194939684cbd8f30955a827b5d7bfb2980d31
MD5 992845d3808557289205566003f548d9
SHA1 109ff5ce876aefeebf296edc3f0bf4f52b1710d3
SHA512 7a5bea51f8f2968224734dace3a6db2a9ee6b55c1406c6c2b99e0256bf96e2f012b9e424909a7bc4ad9780d6f3a7984aac1bf905aacdea2277b98f0275061d70
SSDEEP 6144:47al52bI0SkmXv8PhN2DvDJGqZ/ZLW3Exq:4ef28BXvM0jDJGqZ/piQq
TLSH
T13F34233367D71F36B993A73037A35EAA3AF10DDEA82043016A593B97BD934006D03DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 00abac94d50b2b0b0272f6d426646ee1de37d547299a1c2108fa1f6d4fa6a3bf
MD5 499230be54f32d02597b8c9864845a52
SHA1 01e984d521de75c22dbcf07336bf1dd9019d402b
SHA512 e6ce016ff8c67ce86d283c3edc59770d21cc3afc3ccbc7f74ef80d37105068a8751076bd03e228086d3d69cc42dd6a5fd95a7933f3dce66b4fa853a046f7ce82
SSDEEP 1536:TAQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Bqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15CC30237DBC21F339E96CF60B9530FD697B644A59034D301AAAD77BF6C83491644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4b525d2c2f6b55c6351b3900e67b7cd3de06955a87164903438472f3d2cada3a
MD5 07341d50abcae22ce647f6bece889e5b
SHA1 94ebc3bf632a77ac00b6bbc3b1e5b18f237736f4
SHA512 d70272fb6e4dcd285f9983cd6bcaaa619a0ea7d0e17d9fcd162defa447878b9b44a17481397c5ea1fbfc958a48d8ed487b10219f5851884e1d8e3db2f5a0026e
SSDEEP 1536:QF2x7vyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bIJ:aI7Rqfd7NtZL8cHQRZEQ6SpsJ
TLSH
T1B9C30237ABC61E339ED2CB70B9130ED797B544A59034D305ABAD3BEF6C83495684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 fd4b2c2af754fe596ba5689d835348b48ad3d922619459939f57af44cb946e66
MD5 0ffdfc98e9eda71b081edca849c8db27
SHA1 b857504cb6c0c409c1f68131e8b22e4ab773e041
SHA512 844ef8dccf82aadebf64321a05865263ffee5b8768dba1f66d26c0455144c9a8d0f0644621050cd6bbfe9e453f58dc36390e7c590e6ff6ff4d6d6201aa59ed95
SSDEEP 6144:D7al52bI0SkmXv8PhN2DvDJGqZ/ZLW3Exq:Def28BXvM0jDJGqZ/piQq
TLSH
T13F34133367D71F36B993A73037A35EAA3AF10DDEA82043016A593B97BD934046D03DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 fb074522d2ada18e9a25dbf9b35b15fa355b217dc779d3f07af281a228ab43c6
MD5 5a0bfbf34c6fcfba4d7522361e5fc534
SHA1 9aa0b39b212baaa9aae0d891d665387f643dc8d3
SHA512 1b3e1ba5562a9a24fc8f77effd76bba37652edd2ecbd1b97b069e9e842741634a27d1a3f3dcd80470d8451afafab9012cf37bcdb333d4be4aef65d22ce37befc
SSDEEP 6144:EBl52bI0SkmXv8PhN2DvDJGqZ/ZLW3Exq:4f28BXvM0jDJGqZ/piQq
TLSH
T1EB3413336BD30F36B9A3AB3437535DAA2EF14ADEE820830579593B57B9974006D03DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.json

Path C:\Users\Admin\AppData\Roaming\focus\session.json
Size 672B
SHA256 6d05c60f9d9def88e0b9fde3dfa6614e429bd9bb904ed1f7d3592cae7f85cda2
MD5 b8586aaf876c8c03ec3b4c67f7ee3254
SHA1 ab18428df5ecf19967ce8e7bcdc722c87d160c69
SHA512 eee5292ccc239e39cc09c11d67008843fb551c76d3b2845e9d4018caca0af24aad9c90301aef37268e8ed1ce768ce07733106ab16b0455206090e7e6205762ab
TLSH
T17C01838144D81107E42F9F78480B42D222FA286B5A71AF3E7F92A1188A34DC6E620F86
MD5 SHA1 SHA512 TLSH

Submit Download

loader.protected.exe.dd64

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\db\loader.protected.exe.dd64
Size 758B
SHA256 00a41e284ff818c96e1bc36007e46aaf5b840fb62f323e0cf11a02445dcc7fed
MD5 1a4554f71d4f967f7f53acbc0c8de8f4
SHA1 fc7a93d2a897a0a087e9c75b3a9c15b7aedc155a
SHA512 8da026cc424e50fc30e012a30e64954b82a432dbab914fcc258b6a6fa24ed298ad4a46a78662d561cfb1593c0d6cfb16c9f8441fbd82c453668319060750ae75
TLSH
T19101BC61646D21A3008C832224AF1587356543839E143C25CB51FF28DE8EA3FAAF9B9D
MD5 SHA1 SHA512 TLSH

Submit Download

temp_E5C7278.lz4

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\temp_E5C7278.lz4
Size 321B
SHA256 a97c87924db16f5384eb339aab1e6b235b680514c732a4b13816556967179f4a
MD5 ab51c159e6da08462c463000286910d9
SHA1 4f690625f74ac461bf54d0466df0c9158b975eb4
SHA512 132e1c0959c2d84953a9927a2a574daa0f4b3bf4e8e369da9428630ec51f6bd773c61288667bcac513cabdec438e887bbb403db615b42f1f294df8d4613c0059
TLSH
T18CE07D54A8B626A30715B2705871744B24140BC618751CA90976383F1F622B25F2A60F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-20-0x00007FFA700A0000-0x00007FFA700A2000-memory.dmp

Download

memory/1620-11-0x00007FFA70010000-0x00007FFA70012000-memory.dmp

Download

memory/1620-31-0x00007FF716EFE000-0x00007FF71751C000-memory.dmp

Download

memory/1620-3-0x00007FFA6FF90000-0x00007FFA6FF92000-memory.dmp

Download

memory/1620-18-0x00007FFA70080000-0x00007FFA70082000-memory.dmp

Download

memory/1620-25-0x000002EF2EF20000-0x000002EF2EF25000-memory.dmp

Download

memory/1620-4-0x00007FFA6FFA0000-0x00007FFA6FFA2000-memory.dmp

Download

memory/1620-5-0x00007FFA6FFB0000-0x00007FFA6FFB2000-memory.dmp

Download

memory/1620-6-0x00007FFA6FFC0000-0x00007FFA6FFC2000-memory.dmp

Download

memory/1620-12-0x00007FFA70020000-0x00007FFA70022000-memory.dmp

Download

memory/1620-21-0x000002EF2EF20000-0x000002EF2EF25000-memory.dmp

Download

memory/1620-27-0x00007FF716E30000-0x00007FF717FC5000-memory.dmp

Download

memory/1620-19-0x00007FFA70090000-0x00007FFA70092000-memory.dmp

Download

memory/1620-13-0x00007FFA70030000-0x00007FFA70032000-memory.dmp

Download

memory/1620-10-0x00007FFA70000000-0x00007FFA70002000-memory.dmp

Download

memory/1620-7-0x00007FFA6FFD0000-0x00007FFA6FFD2000-memory.dmp

Download

memory/1620-8-0x00007FFA6FFE0000-0x00007FFA6FFE2000-memory.dmp

Download

memory/1620-17-0x00007FFA70070000-0x00007FFA70072000-memory.dmp

Download

memory/1620-9-0x00007FFA6FFF0000-0x00007FFA6FFF2000-memory.dmp

Download

memory/1620-0-0x00007FF716EFE000-0x00007FF71751C000-memory.dmp

Download

memory/1620-534-0x00007FF716E30000-0x00007FF717FC5000-memory.dmp

Download

memory/1620-1-0x00007FFA6FF70000-0x00007FFA6FF72000-memory.dmp

Download

memory/1620-14-0x00007FFA70040000-0x00007FFA70042000-memory.dmp

Download

memory/1620-2-0x00007FFA6FF80000-0x00007FFA6FF82000-memory.dmp

Download

memory/1620-15-0x00007FFA70050000-0x00007FFA70052000-memory.dmp

Download

memory/1620-32-0x00007FF716E30000-0x00007FF717FC5000-memory.dmp

Download

memory/1620-16-0x00007FFA70060000-0x00007FFA70062000-memory.dmp

Download

memory/1708-564-0x000001F53A680000-0x000001F53A685000-memory.dmp

Download

memory/1708-568-0x000001F53A680000-0x000001F53A685000-memory.dmp

Download

memory/1708-569-0x00007FF716E30000-0x00007FF717FC5000-memory.dmp

Download

memory/2280-451-0x0000000054EA0000-0x0000000054EB5000-memory.dmp

Download

memory/2280-427-0x00007FFA494C0000-0x00007FFA49A15000-memory.dmp

Download

memory/2280-629-0x0000000054EA0000-0x0000000054EB5000-memory.dmp

Download

memory/4776-603-0x0000017BD8BC0000-0x0000017BD8BC5000-memory.dmp

Download

memory/4776-607-0x0000017BD8BC0000-0x0000017BD8BC5000-memory.dmp

Download

memory/4776-608-0x00007FF716E30000-0x00007FF717FC5000-memory.dmp

Download