hxxps://share[.]google/?q=xKBegtfU3ambyOMLt

Analysis

user interaction
yes
max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/?q=xKBegtfU3ambyOMLt
Sample260714-e4q74sgv8x

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284770452707039"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
1604	chrome.exe
1604	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4360	4292	chrome.exe	85
PID 4292 wrote to memory of 4512	4292	chrome.exe	86
PID 4292 wrote to memory of 4512	4292	chrome.exe	86
PID 4292 wrote to memory of 3548	4292	chrome.exe	87
PID 4292 wrote to memory of 4728	4292	chrome.exe	89
PID 4292 wrote to memory of 4728	4292	chrome.exe	89
PID 4292 wrote to memory of 5024	4292	chrome.exe	90
PID 4292 wrote to memory of 5024	4292	chrome.exe	90
PID 4292 wrote to memory of 3052	4292	chrome.exe	91
PID 4292 wrote to memory of 3052	4292	chrome.exe	91
PID 4292 wrote to memory of 4920	4292	chrome.exe	92
PID 4292 wrote to memory of 4920	4292	chrome.exe	92
PID 4292 wrote to memory of 1932	4292	chrome.exe	93
PID 4292 wrote to memory of 1932	4292	chrome.exe	93
PID 4292 wrote to memory of 5048	4292	chrome.exe	94
PID 4292 wrote to memory of 5048	4292	chrome.exe	94
PID 4292 wrote to memory of 3760	4292	chrome.exe	95
PID 4292 wrote to memory of 3760	4292	chrome.exe	95
PID 4292 wrote to memory of 944	4292	chrome.exe	96
PID 4292 wrote to memory of 1900	4292	chrome.exe	101
PID 4292 wrote to memory of 3488	4292	chrome.exe	102
PID 4292 wrote to memory of 1308	4292	chrome.exe	103
PID 4292 wrote to memory of 3532	4292	chrome.exe	109
PID 4292 wrote to memory of 3532	4292	chrome.exe	109
PID 4292 wrote to memory of 2452	4292	chrome.exe	112
PID 4292 wrote to memory of 2452	4292	chrome.exe	112
PID 4292 wrote to memory of 2368	4292	chrome.exe	113
PID 4292 wrote to memory of 2368	4292	chrome.exe	113
PID 4292 wrote to memory of 3404	4292	chrome.exe	114
PID 4292 wrote to memory of 3404	4292	chrome.exe	114
PID 4292 wrote to memory of 3724	4292	chrome.exe	115
PID 4292 wrote to memory of 3724	4292	chrome.exe	115
PID 4292 wrote to memory of 4472	4292	chrome.exe	116
PID 4292 wrote to memory of 4472	4292	chrome.exe	116
PID 4292 wrote to memory of 1920	4292	chrome.exe	117
PID 4292 wrote to memory of 1920	4292	chrome.exe	117
PID 4292 wrote to memory of 4340	4292	chrome.exe	118
PID 4292 wrote to memory of 4340	4292	chrome.exe	118
PID 4292 wrote to memory of 1604	4292	chrome.exe	119
PID 4292 wrote to memory of 1168	4292	chrome.exe	120
PID 4292 wrote to memory of 1168	4292	chrome.exe	120
PID 4292 wrote to memory of 2420	4292	chrome.exe	121
PID 4292 wrote to memory of 2420	4292	chrome.exe	121
PID 4292 wrote to memory of 4552	4292	chrome.exe	122
PID 4292 wrote to memory of 4552	4292	chrome.exe	122
PID 4292 wrote to memory of 3892	4292	chrome.exe	123
PID 4292 wrote to memory of 3892	4292	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/?q=xKBegtfU3ambyOMLt
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4490c728,0x7ffa4490c734,0x7ffa4490c740
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,17247750528773496235,1994559003285740311,262144 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,6501827467055558815,6319291683688292770,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,13350530644917018922,13321337790050575277,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,3000884993348722410,4685201583183834980,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,1154709063679079921,14831387105023078731,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,7032085181005783472,3462997729582958563,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,3937422944245975416,7467888181657246200,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3296,i,12910251689350291542,9449500412931779065,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4884,i,4651603438565787909,15531131710616200097,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,15235940899226059722,942722714562041986,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,17239994451023506390,2051224231280370325,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,11955891565149319332,5598749354059990196,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,16405495404976647283,17177656587013554503,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6036,i,8605686482117705727,4158459357538667869,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6196,i,1620103403351339177,9653094570389371726,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4920,i,2896414868436205654,2593370996170827509,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6296,i,262125704533164755,14546514428046084090,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4932,i,16113902230586505986,8599185366130940301,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6240,i,13436734094984721273,4191026899551508130,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6504,i,10099405144900794881,8528813891988231377,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6500,i,8950176607245867841,6469305957102943911,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6464,i,2528411669205602371,11031096159176339364,262144 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5636,i,17181022751447683141,12084054410174462942,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3292,i,17283867952059745154,2607910237855622037,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4976,i,15302345315770054095,2969080627508705385,2097152 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,132123337059597102,8397520978627956169,524288 --field-trial-handle=2004,i,11160354729296069110,4274637860073904376,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

25aa7e63-3349-443d-ae9f-91353dda9aa8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\25aa7e63-3349-443d-ae9f-91353dda9aa8.tmp
Size 414B
SHA256 e10fc75d320a48b9479770cba35ebc64fa50acf540c74c7384c2c9ab0ddf082f
MD5 972e8a56f12f1f32a79cab9c0a74e492
SHA1 13f492e7269462c692730209feadd5b27e83321d
SHA512 42edfe5f12ed1b9ab11d25e1793b1b4761926273720d6f38276d563667025d2d1904322ef9109cfb8e4a6117ee703fa27688c9fed07352bfae37ec5f514dd861
TLSH
T134E02BAAD9319D2B28FD071824590646E65433172B41856F3A3C870D8FB87360996C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 20KB
SHA256 d6b61e8c88e8cc9f68ac4a914301687bfe6459a306fbc068c4b86d502829a43a
MD5 35f6e927b743e5c51edc69e69172b68c
SHA1 55ca6147aebdd8e6736337bc55b4ec4a7eaabd99
SHA512 b37ecdab691c2934c3597231a61bf6f87cc7c017a156c6bc1031200c6400e2d79054fc337d2dd71b38aece7f8edb717580452d61115482e63a862e65ac287b37
SSDEEP 384:ykoehdcUKo7v+IBUWQYWwITdl7oyT1nwWAriBenbt/eTK7jl4:ykBOU1DZqYRGdeW+Jicbt/I4R4
TLSH
T1A092E147933F53EEAADE24B0474D7FCCA522BB574F8A154C0A19E30912807896C7A3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 59KB
SHA256 0beb2b49eb3c530408ab26d852f699cfb133f7c45e5ddfab26be9f506c30d552
MD5 e6f9c2d5a74a3e5d1f4ec8a81c969438
SHA1 a7e668dd69f695c84901bc7f326b5b3fcc7dfad6
SHA512 38903301cfd9a77d72f621b5a9ec8c4756d5f670376f08fc601288e295e2cc161e14e08a30cdc7c8c97fbbd4ac996cbae95748bb7e11429e06df7c6b03b27985
SSDEEP 1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzQ:fq1HoUBIpU5TG7JSmwuTe+8
TLSH
T1B45302AF9BC5FDA5590C0AAAC197003156297BF251FCF0C880C372D598E127F70AAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 82KB
SHA256 61f5a897bfa66e23a2a80345ab07617716a85b88b9a3b80f119e5f84b6d82b40
MD5 4cbd77c85e7f0a023790280fb7e769f2
SHA1 9f261774c3279308335e980fcd7158ed00e1741c
SHA512 da272aa64a058deca5ecb681e0ba3817dbd16f2a7a27240b62c0b63e4e7e44b8bc5a012e47be8b9e5115c3522a284ab993e35998ffd845e89445fa6a224a0802
SSDEEP 1536:pydFPz4wWT+obEE885ITl6CHSwFiw4sHuInuCJLsOCgQnI6v:iFPz4ZT+uoTTnBFiBK75fGI6v
TLSH
T1F383022B8A95B0C95E234E48FF03518EFE6C81646A6B76545E2EFC3738C0A2BC40A156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 16KB
SHA256 4d946e6303fa61078dbcda5d3483a403c0c6b8e28fd38d32ed95433bd8eff99f
MD5 f330799ae796586130220fce2cd0a1d6
SHA1 ae69eb5192a5cd90170d9b66553b011a5553ea3e
SHA512 2cdf2a4070fb7572227b47adb24f2ae1adbb9e24bc1b0e1b376af05e77115efeba7c4711aab8c274202327147547ceff54bba8f2afe1c16136b936f776a1d6bb
SSDEEP 384:SMCy4fH07w90WJUQeM4wh88Xp3LOPV9eMk8LVBDnaAah7/0ookM:SMCy4s091URM4wBAPfe8DnNY87kM
TLSH
T15972F27C848E48879872B340847D03CC8BACB490E1D7757595892D2A524F93DB46ED5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 d5d433e4b4ef03c3ec670fbd22ee2035970d1c8afad64ef8872f172f0cbed29c
MD5 9e802237f172470c40c10ee100c86d47
SHA1 cc03c6103853dce4daab9b2d186c681fdebb5453
SHA512 54015554c1058f4106c1a8aea288f1ad00781a95b9bb64310a8266d0238f6efa659bc3eebf20971f2d4fb36c6536ded13535c6dc8b4d84c31b5a144375b3f343
TLSH
T15CC09B14D380613BDB7562B558671C577DA35FFD4E04F667C39510D87815291405505A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 95a9ce6d5335f32d17989a5c8b737d24a380234ff4b67051e3ef13bbcf4da0bd
MD5 f07f0c67a05d2b6624ae28fe0113bff5
SHA1 12d7983f4890343fbd369285539671f4729e5bab
SHA512 c0db6089e1dd78df9350a194b5168fb99cb1347a57b404bfff22fea2f0952f7bda1786aff85203525bc75021bb761ad8021d8daa264704ee630bc4a96c562172
TLSH
T1D6E02652E1CA5027EB6419B05D4F78577D5309B68904BA77477CA0E478361C010C7019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 728a3df428775725954ed9101c805384395e660ff55310f31e75e6019d36cb0e
MD5 c5dd40132df373ffbfa6c192adba45b4
SHA1 7c45d510da285af988f5d1a9fd50e97651219919
SHA512 d954c19321f34477480789d5ea7a7543caf8538b7609bf8013dadf15ca88424033fbdada83768b7e2dc9b5d0ffdf2ffbf0b4c54e72a780de3e1b592f95484ad3
TLSH
T1BFF0DF12E1CEA02BEFA419B01D1F7C573E6309B58905A6B7467CA0E8B83B6C110EB01B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 3c36cfb18815f5fae663d03a9ab4eb2a44473cd6763e7341ce18e60affdc40c4
MD5 68898d19809d9db40de106d817fb7d73
SHA1 5e0ca1107e4b6f54a64623db57fbcd8ea77248a2
SHA512 8c26c70ffd3e17cf192979ffb9ac7de71329ff6a8d5e79987a8f2fdeaa56d1e9e75639e197696f31225269d9272b09d8f80659193ce651b3bcd77d1ccaa9277a
TLSH
T15701AC04E9D6501BDF4004F95A2E3C823D93532B0A446777122DE8943D2B7C15067003
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 4dbf901d0d5bc6b4ed4fe09adb9a85c6fddfabe46bce0ae5d03bd674c792ce77
MD5 65c0188899fd34c65f2aab7f75f48dbf
SHA1 f66f7f5674747896d925f01ee1cdd986f6458bd9
SHA512 1d336b64ae6bd4445826c93d7e8880209bcc3c1300292b34e7a9129b1550ad44c46dbbbe5098c3e03ceea8bb92d3e71a8d357542f0de69a7ea949d5c5323c4a4
TLSH
T177B0223080808C02E3A0833008C0082B3FB28E20BB02FF0283E030C8B828FB200030AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 eac644fb55f79dfb9021ca77425e1cc3a5d10170e134c0d86a847c7813f2c585
MD5 430238d4e4fd8198724036a90ba77486
SHA1 1ce8132701cfff14640407d9618b814637617151
SHA512 f6d5ea0e645853e13a74b3023183f8d9dd60676781f5258b964b68470cab231d9b50cd3813bdbd8c574cb5be7f04812e8447dc4cfcb1c8dde6d3820b0a6691e3
SSDEEP 96:DGiG5iGZRfiaIaEdo5lvxGNGkGXBGfNzjhnCZoeHtBMyGB5BI1Tl:DPFSRfiaIaEdo5lvxK9qe9jhnYoeHrH7
TLSH
T1A7C1CFF787F4856DD922A6F4A615AE2BCF2D0514032C386AC5D4AE1BA3F2871D20139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e92e7a0af1b4523c94fb2ba6faa74bf211eb4243fed3cf2840323dd09439b0c3
MD5 1ae28411eb3c225d4d4753b560bc208f
SHA1 49a2ab704ddb4f4ad5080b758f4fbd0b2d123b36
SHA512 17a7e96e290796881b7aa387d23291877656ccc474ab2749f2b32e0f792715cd0d7f7364261f8123d9a855fe7bb5e53854f91b09723381631a918e5a1339a35f
SSDEEP 96:DGiG5iGZpaIaEdo5lvxGNGfbGXBGfNcHtBMzjhA/GBCZSTIzi5Q:DPFSpaIaEdo5lvxKqbqeuHrujhuSYSTw
TLSH
T191C1C0F797F4856DD922A6F4EA15AE1BCF2D0514032C3C5AC5D4AE1BA3F2871D20129F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a274f304e1f30ea9d3a6aa73640ab39b25d7854d0ee07afd2560a11b7cd0ecd4
MD5 f5aad6f021b48f4abad566f10072df9f
SHA1 d95d8b1afe3e64c15771e8ffc00fc13541af1271
SHA512 1053a16e579e1cbdc9b8a0399d6bf485f734836efbc0172af9a020e7dbe722f4e3e284d830c6fd4680b9b88d6bb896a7529047302bbe00866182d10f712eef8b
SSDEEP 192:DPFSRf6taIaEdo5vxK9qe9jhnQbr4MXH/2iiGV:DPFSRf6taIaEdodxK9qe95Qbr4MXH/24
TLSH
T10CD1CFF787F4866DD922A6F4A614AE2BCF2D0514032C3869C5D4AE1BA3F2871D20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c7c756e92bfdff8a1fa0defde1b5692acdabfa9f8d02d9ccd9ed29ea78d7ee3f
MD5 6fbee3139b6e90b503bd605bc7580ac4
SHA1 6627ab38b0504adf48f193ddb9f58f82381d8274
SHA512 f0e06398a303ada4b1ecf15a49fb31ac3df981348eb6257883b088d0a684b0914d1eb8ff2ec7041d1343ebb64a81f91f17e03e59e39f2e9db977b41a63b61d33
TLSH
T1BB71DFF797E8867DD55252F4D7156E2BCE2D0518031C3C6A89E4EF1F63E2972D20029E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 91bce9eeb5afa876aa9fa2b4b807334de1817196710781ca7a22ebd542c35e8b
MD5 1f0d253cb5020d650ba142b36457b102
SHA1 b26963da9cbf312c2f3858978c4157ea39a40824
SHA512 870b9c75a9d612050939cfc1053809cf54e6754c7fefd102f363639dd9194e4367563b6cbc2785357395423ae73bb8b84030efe19066d2fec9f767d208f79db4
SSDEEP 192:wRxM+IqnIqRiv72ympYPRpGI+dl995Hsb+WNhtW+NoHcSnlIZ126DaDOYVyIsnAI:wRxM4FuQcXY7wHWFIn2ua7E
TLSH
T1CB62B51BA920287BECD6D219F9127753E7E5203526D42E88EBFC8B2C15E76CC3217527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 acbd9acb430576a8437a924899e07354de6677e38e8627a94c0ea296ab410d68
MD5 6535037f7b41bd9b6e39fc621444ce67
SHA1 beb8f0cc4f1bee3ca53650da6e9ca6dde62f2290
SHA512 476df2c4cc3a180b8a87b87b24926d2a82da4d318c71260946e07d46d7e24f7e11786589932d9bae1b788b1ecd68ebaa0fea1e9de1adb7df1999ebcdd52d32e6
SSDEEP 192:wRxM+IqnIqRnv72ympYPRpGI+5l995Hsb+WNhtW+NrIpnlIO126DaDOYVyIsnAU3:wRxM4FvQcXI7wH6nIq2ua7E
TLSH
T18062C71BA920297BACD6D219F912B763E7F5103526942E88EBFC8B1C15F76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 171f2e82e584709e66373c23390cc03e979428a4024ce6d9bda29cecc4494163
MD5 3acf84df8cd8a1626fd45b010a6fa71c
SHA1 c6ff248feeebf7c5718fe2b0018e731952faef45
SHA512 cfadce71e523aa02ad902391872fe032fbe93efd649556cfcc9b49e1fbbffbb28939860c0fc4a6789bf072b6c1edd550e6c6528be5c52504d2bf423e0bfe6b7f
SSDEEP 192:wRxMUIqnIqMAv72ympYPRpG3U0Flt95Hsb+WNnW+NfMJ5mYM126DaDOYVyIsnAU3:wRxMCocQcXc7wXq6YI2ua7E
TLSH
T15E52D61BA920287BACD6D219F9127763E7F9103525942E88EBFC8B2C15F76CC2217127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 75dd1dfdbc530bd0d324339937a501b6dc569460737e94557a905b15ca4e01d2
MD5 201f375727c45046a6dd739ec7b98bc4
SHA1 ac4c56d96650d43206c96126be208d130eea36e2
SHA512 5a018ad8018c0f2038ff8d87a56ba2094a60cc91509ed5275a744d8f6f1fe68c6319898f251da2df494978fa9f91491e829b10b09c35d7cc8cd1bced5acee90b
SSDEEP 192:wRxM+IqnIqRMv72ympYPRpGYy9lt95Hsb+WNtUW+NfMJovEx126DaDOYVyIsnAU3:wRxM4FYQcXk7wGqSEv2ua7E
TLSH
T1DA52D71BA920257BACDBD219F912B753E7F9103225942E88EBFC8B1C15F76CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 35def811f5552aa1ba70b84f14d913361d38982c08c01690021a0398e20732d0
MD5 45aa09ebccd7c1207450fcc6aaa53556
SHA1 9abf644736a373d4d65f5004ffa554b9bd23ad28
SHA512 d1054b4539b569412a9f7e09f3237a72559b57776740aaa2b2c7b166fbe2b1bb8f497277d37f4e98b2b68937ea04e2dd7cc55a00bc8a10c18df6ae49162a4f8b
SSDEEP 192:wRNMUIqnIqMRv72ympAPRp2tl095Hsb+WNnW+ANq2R126DaDOyVyIsnAUge:wRNMCoBQUXH7wXz2P2uaze
TLSH
T15742B51AA920643BACD7D319F9127753E7F5107525842E88EAFC8B2C15F76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 23ecf8da6024788b21dd449acd60144432410f3ff3d4b84ae79d1240c14990b7
MD5 0b62b789a0e913a01446cf61102ae839
SHA1 2196bd7f1ae432674cf2eeb1026416710de056a6
SHA512 bd7a768d92245e58358033f483a376c8fac5a0d3a9205d744c42e60ade8c5c24af723336c99671291becfeb4eaabc44facc20d2141fb75d7b57a6699986095bd
SSDEEP 192:wRxM+IqnIqR6v72ympYPRpGYyLl995Hsb+WNhtW+NCYLdD+s126DaDOYVyIsnAU3:wRxM4FWQcXi7wHbx+o2ua7E
TLSH
T12A62B61BA920247BECD6D219F912B753E7F9206625D42E88EBFC8B1C15E76CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7e7d93db158c5f5a3c53f9ed72b9d4f4d94ee4d9645c7e56eb2e07c9114825fb
MD5 74dc2f6647ae579b3c521b2006482353
SHA1 b24e729e8912e0769d0273bf2d6a687e2ad1093d
SHA512 cb99a8dd53e8cf9640d35ffc9c579d339f92392310ab729d844178f046275b8a055d1cf600b605b1047ceab496ee150e3f4bc4180c3f0c064fd0e0714876f179
SSDEEP 192:wRNMUIqnIqMQv72ympYPRpGtlt95Hsb+WNnW+Avsei126DaDOYVyIsnAUgE:wRNMCoMQcXO7wXLe22ua7E
TLSH
T19B52C41BA920683BACD7D219F9127763E7F5103525942E88EBFC8B2C15F76CC221712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ff89c7d48590b859d07923e89085131ca05e20bb3d2f721a489ff1e930a01cfd
MD5 49f3c35d32698600f6a29fde2c0ac530
SHA1 9f8a8c7f4114d46da0f12d6bf683394f3d09d959
SHA512 031d0627c7ad5464e79efbd9bf91e60d4319120e4b9d6e54c5d12212e6bbd5c053e63b1556ef969ee0d3a213d3c4b37ef1aa48486458b06c28e38d6f50cc06a1
SSDEEP 192:wRxM+IqnIqR4v72ympYPRpGI+Zl995Hsb+WNhtW+NCYLnlIS126DaDOYVyIsnAU3:wRxM4FkQcXs7wHbxIG2ua7E
TLSH
T19A62B61BA920287BECD6D219F912B753E7F5207526D42E88EBFC8B1C15E76CC2217127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 676d686c92a1e4d9e155c2520a81f8ec60aeaa4afdf34cc1c890ed2e1f120ffb
MD5 5a6a732d7febb911a6920bf3cc52cac0
SHA1 b66e858f312ead8a6e5bfe472f1660c839fea44d
SHA512 8faa528fba2472b60e190989f9a5d93c7ae51132a580cbbdb6cc99b38adec4f8b65576f964fad069ca8ce4cdaef52e5dff6d81e9d76fee5b01e0ae95b0807608
SSDEEP 192:wRxM+IqnIqRYv72ympYPRpGI+dl995Hsb+WNhtW+NrIpnlIO126DaDOYVyIsnAU3:wRxM4FEQcXY7wH6nIq2ua7E
TLSH
T18962D71BA920297BACD6D219F912B753E7F5103526942E88EBFC8B2C15F76CC3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7efe883ad88e81c847bdec2d5212c4b535759a60b51ccd53ee78d9a2d2a4cf2d
MD5 11c2a59dc39677680abc9939388ef970
SHA1 3c219ff7d970522db0215231ecd58093aa8fc44a
SHA512 584da629933903e8137039d518d507d5fe8e7258b1a23d5d83ebf76299e8a3802eff48804e971fa73b236d28973bd0b90961132ada12a958e115f9eb7a871ef4
TLSH
T162B01200C0119201C04A82B01582189C71145F11960E170243E46923D8252B1C024455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585464.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585464.TMP
Size 96B
SHA256 9768984fce751c4ff40f713bf77f151a7a3929655355f7f6e3ec5c9e63a5d989
MD5 7ce2d6e8bb44edb85a621d1a1901773d
SHA1 d1d37f2063ab7e08a69e4fc22fb489e6ea810f1f
SHA512 e7e32ee058192179cad4d4c239903d9a6fff601d1bcd846ca2f106fca80cc258539b24589b7d34dc91dbf9f8900f37c90a0104c4587f1da222501e85b0310050
TLSH
T110B02208C803A202C00303B02A8080C83020EF32CA030232E2E00EAAEC223328230220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5a3e8fb9d89815536c14a2fe4dc60c95441cd29f872b1253d9ef2ab5077272cf
MD5 dcec31d0eb55eb824988703230a2d508
SHA1 a64eac59d91b38849733f354f7a61d89000846f4
SHA512 602c1f8c23d7955925998c3b8213f7da5d3ceb130b69bfd4b20c4bdbcb1e296cddf6dd75ac5731b3e1c54327a0d45be131b4fcd75c66399fa397cbe88347633d
SSDEEP 1536:97yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:vqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B3C302379F861E339DD2DB60B9130EDB93F604A9D034D305EA6D67AB6C93491A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2ed648776da81cffa140f86fd9d9cc034095de7cb1772621f0e1ca915329695c
MD5 d41eff814ee5cd142b0189dcb8e9ac20
SHA1 dfd051082ce418406b98c2a09f192624bd41db49
SHA512 e6b824fbb28fe5394c926f59336a9247cd3624f482240d919f17e7ff91a284b95044fc01c4c8e88a1a5c0bfa95db3e9e1350f1043bdf5fe3f79d2c4997721cca
SSDEEP 1536:9ByD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Vqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D7C302379FC61E339DD2DB60B9130EDB93F604A9D034D305EA6D67AB6C93491A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 504450ee7faf028a1591a741b224a5598297e7866f14ed6cf11e55bbf8048974
MD5 32089d0d1e63ae6f575b4fe9ba6a8982
SHA1 b04671f3af945dcac61e3765ecb3fa6ede2920c3
SHA512 5578c7d83156e14ca98c822931f5edf38d65817633a64745b5f5624917078ff3006730a449d01d21513d03380cb74a226397cf3a9a4f7cf0d11a49864bb49563
SSDEEP 1536:17yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:3qfd7NtZL8cHQRZEQ6Spsk
TLSH
T15CC30237DF861E339DD2DB70B9130EDB93F604A9D034D305EA6D67AB6893491A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 89222552c651a405002a299fc105f044d912bde0a5c8b53cb5a86a18d947590c
MD5 2223d48a64eac8acd70d6f6cec0ebdd7
SHA1 6bc41b29622d27a0d38d7a65d7a2944580e9046d
SHA512 876f5d324380b914579820b531c5d1e0c6a7cc136ecb64dd577ddfdbeb3e6999d664e1bb647eeafadf0dcef5a19b205c5c56c29b96a9e08e1b509e65bfc58247
SSDEEP 1536:TsQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:lqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1B9C30237EBC21F339D92CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 30b37b6e2668e4af7c02f6fb7751845d2ef84faefee44bc6ac6b313b4bf0ad6f
MD5 465b89322bf9300c6ef6310dfe3aebe1
SHA1 a3c466ddfe90b7c01a3f9ed9bde92cbbb6da9304
SHA512 29dca9d631972613260ddc0ed4713211b7dace2bb3928641d9c045ac7ccb5bdf2b3133d1ddd30e5ab98820c7ecb30bcdea6fde20b0e592d350d3523bb6a0b525
SSDEEP 1536:9mxwyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:+Sqfd7NtZL8cHQRZEQ6Spsk
TLSH
T155C30237AFC61E339ED2CB70B9130ED797B644A9D034D305AB6D37EB6883891684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e119e2325778d2ae67b6e5236de666935bcf61aee06c29e79e6a499f7c0c91ae
MD5 eadd1641bdb9d3224d6e2ffa7f20fd80
SHA1 0137cc34b15b0eedc01bce4946081a7b6f5fa8a2
SHA512 94b22fbb273c9cdef37a3a7f7c128dd5d1ef218c29a97f90df80cb720ddf5a16d0c45ee7a5701b5f296fa78f600def9bbcb4dace739880254a73456c2df948b9
SSDEEP 1536:9vyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Tqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1EDC302379F861E339DD2DB60B9130EDB93F604A9D034D305EA6D67AB6C93491A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fed9e0af0db8db26d2310b21e052ec755d477fac5156ab1ded8f45443c8700b7
MD5 e5751336c691f2954c576944b402f27c
SHA1 d13c2a3879a863af0dcce76ae363664223e29f01
SHA512 c17ce7a8ed1a248dc7df24c61ab33cbc5ce677c4b140c69c930e05e7604d43e2a0e453ba0bcee8e5a793006c156bbd6642d530d067613b2a4f451abf3858ca94
SSDEEP 1536:cmxwyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:LSqfd7NtZL8cHQRZEQ6Spsk
TLSH
T11EC30237AFC61E339ED2CB70B9130ED797B644A5D034D305AB6D37EB6883891684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-73-0x000001D652000000-0x000001D6520E9000-memory.dmp

Download