6629566f5caa7f7fcd4b2bb7ec0b6727a8216d939ad8cb4372b6bef2b5b8194b

Analysis

user interaction
yes
max time kernel
899s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
output.log
Size 7KB
Sample260716-qfvfeah18x
SHA256 6629566f5caa7f7fcd4b2bb7ec0b6727a8216d939ad8cb4372b6bef2b5b8194b
MD5 c166afec9f0ee2a761a61da8803d41d2
SHA1 9bf8e12ec7827a4efda1abc5959379ef3975283d
SHA512 b060f41dc17cadc5d9a7c54f4ef10211c67eab74ce217a3b2f4a065d14402b8a1337d879e13b082d960b6e7c84f6762b06d9ea4cec86d3c87297cf50e46905a6
SSDEEP 96:XLF1ISVMbhhhUkZ4eBvR5WNcOLF1ISVMp5y/FamdchhcuBkRfd5Jkwktuc:XR1ISVMzhUktuR1ISVMzytZ87Kfo
TLSH
T104E13316D8E47424B229D00D3EBEDEF7A2092D05267704BE748D5EFD2B4142E67B9E82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
74	discord.com
80	discord.com
81	discord.com
239	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286811852101563"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D5A4E0A9-4C61-4720-8753-887951FB2166}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4372	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
5556	chrome.exe
5556	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe
Token: SeShutdownPrivilege	1376	chrome.exe
Token: SeCreatePagefilePrivilege	1376	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2380	1376	chrome.exe	87
PID 1376 wrote to memory of 4060	1376	chrome.exe	88
PID 1376 wrote to memory of 4060	1376	chrome.exe	88
PID 1376 wrote to memory of 2976	1376	chrome.exe	89
PID 1376 wrote to memory of 3720	1376	chrome.exe	90
PID 1376 wrote to memory of 3720	1376	chrome.exe	90
PID 1376 wrote to memory of 2236	1376	chrome.exe	93
PID 1376 wrote to memory of 2236	1376	chrome.exe	93
PID 1376 wrote to memory of 3304	1376	chrome.exe	92
PID 1376 wrote to memory of 3304	1376	chrome.exe	92
PID 1376 wrote to memory of 1812	1376	chrome.exe	94
PID 1376 wrote to memory of 1812	1376	chrome.exe	94
PID 1376 wrote to memory of 4220	1376	chrome.exe	95
PID 1376 wrote to memory of 4220	1376	chrome.exe	95
PID 1376 wrote to memory of 3388	1376	chrome.exe	97
PID 1376 wrote to memory of 4132	1376	chrome.exe	100
PID 1376 wrote to memory of 4132	1376	chrome.exe	100
PID 1376 wrote to memory of 2632	1376	chrome.exe	101
PID 1376 wrote to memory of 2632	1376	chrome.exe	101
PID 1376 wrote to memory of 2012	1376	chrome.exe	102
PID 1376 wrote to memory of 2012	1376	chrome.exe	102
PID 1376 wrote to memory of 2236	1376	chrome.exe	103
PID 1376 wrote to memory of 2236	1376	chrome.exe	103
PID 1376 wrote to memory of 1064	1376	chrome.exe	104
PID 1376 wrote to memory of 5316	1376	chrome.exe	113
PID 1376 wrote to memory of 5324	1376	chrome.exe	114
PID 1376 wrote to memory of 5332	1376	chrome.exe	115
PID 1376 wrote to memory of 5944	1376	chrome.exe	116
PID 1376 wrote to memory of 5944	1376	chrome.exe	116
PID 1376 wrote to memory of 6000	1376	chrome.exe	117
PID 1376 wrote to memory of 6000	1376	chrome.exe	117
PID 1376 wrote to memory of 5556	1376	chrome.exe	118
PID 1376 wrote to memory of 536	1376	chrome.exe	119
PID 1376 wrote to memory of 536	1376	chrome.exe	119

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\output.log
1⤵
- Opens file in notepad (likely ransom note)
PID:4372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb674dc728,0x7ffb674dc734,0x7ffb674dc740
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,10730216590230697973,15847651554853681537,262144 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,5416134151686810860,3648966766156649836,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,3826453118231169426,6651703480568145779,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,4937513272957175479,16260279132265784987,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15031293163840123491,14721190362082092607,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,15148647122618880030,14929772056951885402,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,2452961256804335420,2023852781655095008,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,838328014461542050,17970907520037716708,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5528,i,124003003507212915,60003339017910248,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3232,i,4357787755424044403,15689621811744562310,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3632,i,15791257113921827945,1401606772034460851,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3204,i,9877564215906358273,11171799396867713939,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,18272280536278830980,14806103086598924427,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,17736319041190545684,231672973198089307,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,2849046814335877815,1478983082664662248,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,17360553479983477943,12636215492185972310,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4560,i,12506025484600474273,13316725048527976837,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4516,i,13257843773270684394,16491917148198898374,2097152 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6624,i,12396768589375735639,15478362513276827617,262144 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,6937247752955395103,1862255941375270747,524288 --field-trial-handle=1820,i,3150501954827875000,1098857566016116685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7ed28297d157c4c912f15cc6a63271591a0b8328f2f3adc5089df10aa06d3d31
MD5 b92a87b421eb52bcccdadabd44b11d1c
SHA1 99fb621bf463149502d02a9f132c7cd353de6d5c
SHA512 5b6925f9945066e01934b95aa3679a6f0d2de04680b9bf662ed14f883f6aa1bbf5adaecd7c3481eb5f77f0375335040dc60624ac15a8441259b94a17cd6ade36
TLSH
T180E02B69CCA1DC6714F90B1DA0545782E755139B2A40894F7B3DC10D8FB56364685D6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007d
Size 1024KB
SHA256 6050f7d9d287a22edc07e571c0f4b5935eb96a29e97fc6f9279cdc147de9900a
MD5 835fc9158b5b5b2c182da97d51a8128f
SHA1 9dc258b51935b5873425d00451d0b52c60b05982
SHA512 2d27a99d8a0ca8851ca3807ef4d53982618c09fa00971306e0ece884dc2a89b18c7279882c9456de3433c3dc50031bd285a8f32bfca41e9cfe0097ffa007c3cd
SSDEEP 24576:d4ejWFrkra7SRCdsi3ikpdN6yQWj3X3Kl:KzBsni3ikpZQWjX3e
TLSH
T11A2533CECFC6CCB25587DB678F6D24C7A4288012665BB3D15A305F8C6B7B091942B4AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 9bbf0d5f3970cac77d8d0e5ae8524ccd513eafb7f6477e53bcb688a085e539b9
MD5 6959914f2d74f7d073e3208c39c70fce
SHA1 158d4b64e60809952e2fbbd50fa9daf15cdd916f
SHA512 a88c70726fc4bd9e7460b6f7d863b5c98a00d0c6767abfeda6126bfa6d6574c1dbd54b56fe0d03fe03b57f3b0e8af930120f7ba66e591d72194247a192c8f505
SSDEEP 96:gctHj6TKWiYTvM38OXGY7xo6r1snEAZ0pKR5:gcnqzMMOpxo6rqEAZ0QR5
TLSH
T1EEC15DF158FB9823CB2785BB23D998547476A475FC4B1F19B4F4C874562A7BCEC01810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 477f7bc7a57c4bdfbcdbac4f7a3d4126597b964aacabf7f04b888d53478fb36d
MD5 224bfe325156971561834ce22ba769b5
SHA1 b32fadf3bab47ac6741d4e9650c3e4982fa7e741
SHA512 5a959a3c1277afe235441cbe74ed1a1d6847d81d5ae638a694b1349463c1d2af4a1d51052b74abb933dc8a3bac70d93d81d1d06b7aef06ec345ad4f597f5309e
SSDEEP 192:4wcfqkOyDLxWuk/332wAXXeR26rVvL0kCRnbvc3oRk:QBO8hM2X+WJb03gk
TLSH
T18742D5B258AA9F6EC71631BA22D794D47077B47EECCB2F31F0A88B3457503A8D803454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 120cfde8ca9b889f0f6bd96024539834eddaec710dd9a8d034b700f6dd3de81e
MD5 fe15b58e3e7c455e93ba6a4cbb2a81da
SHA1 2fba84d2e324377a860f7fed19ea4f715a3e98f2
SHA512 9a1d63ce602a251257a2445116b0442f4cacaa7f442bbf23db9ea30228469a98df013d2e457f5c09e02d90cfa4c0cd50105f82b21f4db3d4d0e79b11e1124e6e
SSDEEP 96:7cbHjqTKWYYT0M38OXGY7xo6r1snEAZ0pKRD:7c1AIMMOpxo6rqEAZ0QRD
TLSH
T188B14CF658FB9823CB2B86BB23D498547476A475FC4B6F1A74F4C878562A3BCEC41810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 320cdcf56c5d6cd41486ed19cf1aa58429e3da5faedbba558c3cd884577079f0
MD5 8216e69a39a347e1df62aafcd6372437
SHA1 8b552e45c9876e59485d9de23f307e7b74a9988a
SHA512 2811c9cc006ffeae0d96e7558c156e83ab1ebd76e44e21a1b3ec6e422ec5bc97ccd87d240384f9a436e9f43a6b5f0cfc5fd0a096ed338c2ced0f4bb6dcfca188
SSDEEP 192:WwclEkqymBLfWukZ332HABXeRe6rVvLUkCRnbgc3oRA:4bqlhO2ggGJbP3gA
TLSH
T1B942D5B258AA9F5EC72A31BA22D794D47077B07EECCB2F31F0A88B3457543A8D813454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 91edd4b28b0e1119a62530dd785e9621c97c5fe917d8614c6f9f5f3682887311
MD5 08bd05e2b9ecbd855fee49be80369b00
SHA1 58998da75b01039bd02fd140d7a40f0b0a152f34
SHA512 2739dd224792d5ca5ca095d8d9786c3c28aa2cd31999b3716074703a02fcd276eb3dc875f3100e4b11d05b4d6d19d5102e457f726ee3b8583159d5f548d804c4
TLSH
T1C8B011B00A820033EA220BF2ABC2B28030300CAB8B23082B82C000B88080B302A02080
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 bf8d9374e5943c7809d9a213702d19a2930a2e1ed1851f41625d9faac4738c6f
MD5 2aeacb95bafe3fc389bb2ed77e151262
SHA1 dc1f164f1a020d3a8ff79c6c6c69eb4d783fc0af
SHA512 652ed3ce28a11414dca19eeb03b89420d3305a717c0728e595459bffd1e3ad42709641a96d41cd0a74c343dd6a6503ce042ead53b2a7737bea374214fb402912
SSDEEP 192:D0uErHnwuzN18yEAPaIBEdM7wm+NPi9aPIfPinvqPXryr3rarmi813fraGRwjhq:D0uErHnwuzN18yEAPaIBEdM7wm+Nq9a/
TLSH
T1BF02AEF7C3E8C62DC91156F4AB156E2FCE290924431C3C7AC9D4AE1B93E2971E18175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 def071db478f4a133458ab97811f4c437c10fc772e8a97af3afd8be447fa77d9
MD5 741edd393e6937b6f8b9d81ffefb05e8
SHA1 1dee02d0fb961d162e94bea3dde54d4506b49e75
SHA512 84502635998b39f11c705f948553d76f887047af6c718dbc3a9c75f34c5adb934884e71ee0a22f70bf7d058513cfae6e90b71755350a96a726f56e4aeeb4cada
SSDEEP 192:D0uErHnuzN18yEArDaIBEdM7wm+NPi9aPIfPinvqPXryr3rarmi813zG8jhnrEK:D0uErHnuzN18yEArDaIBEdM7wm+Nq9aP
TLSH
T1AA02ADF7C3E8C62DC91156F4AB156E2FCE290924431C3C7AC9D4AE5B93E2971E28075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f06af38cc56f6735d8e7114b27efe23e0a86852c80e8534c2e3c0c8c5500ac0e
MD5 ecf6819255b69ebfc4bfb8cda86228e5
SHA1 5d0282e06000dd5df8a6f1a1255719f074a9fb46
SHA512 40622f0f8cc2243621de74888325f3240560acb28b19e09141204fe4e30ffabdd2e773c64031afacb5c682d8f7a32623620d2c8546fd08db3438a75499264f3b
SSDEEP 192:Do72pSbxUzdaIoZycM7wm+NPd9aPIfPnnvEPXrgrHr0qDyLGx:Do72pSbxUzdaIoZycM7wm+N19aQfvncC
TLSH
T1F502ADB3C7D8C66DC81156F4AB257E1ECE290E24432C3C2AC9D5AF0B93E1971E29165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d93a61d635ace88cd2855581f861b40e40e46f3d83d48135055b2117424b3b28
MD5 625e608d82c2403b2caeee0b153faa3d
SHA1 b63ac75b5355b9683a58f787528f915992468d3e
SHA512 e9165f1e8d9bef54d48c604069d1e7e6bca35729638a37eb5092397868456f873a71f1691afdfa9771d95851bd17e9453635d549eaea6f3c051ac94330e8b8bd
SSDEEP 192:Do72pSbxUzF34zd/aIBycM7wm+NPd9aPIfPnnvEPXrgrTyarppy8prFIW:Do72pSbxUzF34zd/aIBycM7wm+N19aQF
TLSH
T10C228CF7C7D8C62DC91156F4AB257E1ECE290E24432C3C2AC8D5AF4B93E2971E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 65f14acc33541f60771ca0d358a84e43ed029b2f04ff15d756f3e5d36183b633
MD5 b1646316bf1fe250e567bed665b00960
SHA1 39a3706bfcfc8d93f023fbf1a141e39c253158d6
SHA512 08a8629f4830029838be381d552bde0533aa67092066d155d2c6f77fcf6cb09adb22dd5a428b466984b5f330b95d1615538b2022d5fbce4c8715d73ff4e77b01
TLSH
T171313B6396EEB467103918BB1D097C055DBDEC3906D298E8DE9BC06DB0958BB4B06453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 10a04361f556ce97582ddc133c017136531cada57cebdca2bdad71be98c9c84a
MD5 6d3a9487cd55fef898bcbf90823a2d89
SHA1 28bdb86fd9657e939608d7b83872707d18cf022c
SHA512 633bf4ef156934aa6afb2ad79ba3624526886459ff6427098ac703e2442631c69b8c0b1f8e527ecbc1f09ab673165b20a4cbf1059227a813a0ded9ba54377099
SSDEEP 192:3RIcBzNbod1Vrv7spPPRprdAsfp9+Hsb+WNxPyOOTYoui2UOkMfndUMi8yIsnAUp:3RImzNgTgRXH8wFJg2oMfndle
TLSH
T16D62A62BAA505D7BACDBD229F861BB67D3F2102125A52E84A7FCCA1C15E75CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0e60b52f37f1b344f507cf18d93aebec9bd821c7bb47713c7f3db1f90a43bfb7
MD5 61c9986df5d58ce3881cf61ef9e1cec7
SHA1 c58d7df57b34f4f3c6ad84e38f581a5e7b29c067
SHA512 4f62f560abd008016f5e130046e28eba70cc0dd7097e18e118c1972e3f4199ee4a4205ff8df94155bab398de16670f73d8e292377f66ecf7fe3823d5a60f5b9e
SSDEEP 192:3RIcBzNbod1Vav7spPPRprdAsfp9+Hsb+WNxPyOOCp4ui2nOkMfndUMi8yIsnAUp:3RImzNg2gRXH8wFtw2nMfndle
TLSH
T19D62B62BAA505D7BADDFD229F861BB6BD3F2102126E51E80A7FCCA1C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6a8a457d160aad57af39cdf45c841b62860d1d941b23c268ad031f0de46dffba
MD5 48fc20761418b8c76986ddfcb87fac5f
SHA1 1e5bb6ba62189358a04ccfe1a9fa8d2fe62f0bbd
SHA512 04596c862c3507f53a5fbca56a675d6b4d4bea0a438409b0138c10493e4df59bcc0c077a95f96baa52eb63e0159b0cd8b7a43f9d94504f56ccded8df88ee6928
SSDEEP 192:3RIcBzNCod1V2v7spPPRprdAsfp9+Hsb+WNxPyOOCp4ui2nOkMfndUMi8yIsnAUp:3RImzNhCgRXH8wFtw2nMfndle
TLSH
T1EF62B62BAA505D7BADDFD229F861BB6BD3F2102126A51E80A7FCCA1C15E75CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 94a3c87556e2677e8c94802fc5dc438041701e475cf4e00c91a2ab38dfce4d37
MD5 75991c3307fe74cb6e4d18aa41ed5101
SHA1 020ff14028b097cb8f76db0bc9fa23c8b6b58d41
SHA512 df1b3ad07cb382068fb641ffc1aa3c1b11f118f0e665eb42dd0507d27abbde50addf0cb9feb8c4cb5f4bc2442cb6f4ae4144f345d9bd55dcf8153e89d58bf6d3
SSDEEP 192:3RIcBzNbod1VOv7spPPRprdAsfp9+Hsb+WNxPyOOt6c/ui2uOkMfndUMiVyIsnAq:3RImzNgqgRXH8wFxo2uMfndie
TLSH
T10B52A62BAA505D7BACDAD229F861BB67D3F2202125E52E84E7FCCA1C15E75CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cd34a3eaa0ab4171cfc9c86f69d771092ba14514aaf80f54abe84a0f781ac7e7
MD5 923a9a244b3c6d38a43fd91afa544940
SHA1 612dcadbc53be5d22f9d6436d5b602c0a7f7f3da
SHA512 ec65e34efbefc9e227d67cbd1f3e5830058a6ce1cbf55a1c6fdb4a77ae010ab5b59ce000726c014dfe7bb22d6793a26c7cc5c9928fed578f9c0ba2ba9536cd4b
SSDEEP 192:3RIcBzNbod1Vzv7spAPRp2dAsfp9+Hsb+WNxPyO4ui2+kMfndUMgVyIsnAUgtaJ:3RImzNgLgUXk8wFw2XMfndk8
TLSH
T1B252A42AAA505D7BACDFD229FC61BB6BD3F2102125A51E80A7FCCA1C15E75CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fa727edb87ae413a9295947478dcff7376aaf54f3a3aa4c3efdbe8183074be5e
MD5 9714b06608cf76710723adc62f7afa1c
SHA1 f0dc564dff06d68f4d155e31577044936ab185f9
SHA512 c56aa5edcd0a18971ee6e3cfa0c303c2e5d2836e0df9ee5e7b3bcb45c2eb497f4d6ce899f720090115aba02586f591002b602d6376b648f83c89d8189385238f
SSDEEP 192:3RIcBzNbod1Vzv70pAPRp2dAjp9+Hsb+WNnyO4ui2wkMfndUMgVyIsnAUgtaJ:3RImzNgLgUXx8wLw2JMfndk8
TLSH
T1B552A52AAE506D7B6CDBC229FC617B67D3F2102125A52E84E7FCCA1C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\57d0d0e1-1c4c-4828-b7be-755b7cf50b9f\index-dir\the-real-index
Size 72B
SHA256 a3fc15cd0e889df942b28563a63a5134e6588ab07eb71971ace066ac33c20eaa
MD5 864ca31275287746d00d3b04d4127b03
SHA1 f0d8c2e5cf503998605147967be02c92673b4a58
SHA512 7a26c7a86978b8c5750f9b290af0e1922dca4933842916b2601d1e803befee0c14e313c25cb74c91c45090539ac25ef03722646cbc646e231653399ab0094565
TLSH
T11FA0021481452246D2546A7164B7415076104C114145476AD2A00099EC612C84D47141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5987f3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\57d0d0e1-1c4c-4828-b7be-755b7cf50b9f\index-dir\the-real-index~RFe5987f3.TMP
Size 48B
SHA256 f6919747062cb6a184f4450c4f97c0384a36c6ac7c08294a0ad33b9b4926f81d
MD5 69459b7cc4881642b8f03198274397eb
SHA1 3480f20e06aff74b9198e7141684fc21aa7b0b32
SHA512 04318423fbe9d5574f9382e9b323739d3c6a7194a33ef5a6df2acef43915406d6cb98bb959076733b97133832e0f6e80171c0963bc631fc8c3e9d5887a1d2717
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\fab7f6e8-8a59-4a68-b947-916125571aa8\index-dir\the-real-index
Size 72B
SHA256 8719d5c9dd5ac9b4b2f1dea27cdcad53dfd4d328e6de5ee055d5bade24e4a4f9
MD5 df1c6c3faa93733a210ce9b8dbf7b35a
SHA1 692245f3d8786c8e9ad9f1cd2577fd0cfcd32bb4
SHA512 a2da55dd4958511e2a4bb8ac729ab7b91335beefecf510fd339026c4c91e2ad61a85b80fdc656cdb9b2749d6ce8f349b0d3bc8a2700b21f15df9618dddaaafa9
TLSH
T146A0022BDD589501D10207F5647AA14A3320CEED0E554312459A5549DD9B3515D99044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b0b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\fab7f6e8-8a59-4a68-b947-916125571aa8\index-dir\the-real-index~RFe59b0b8.TMP
Size 48B
SHA256 8eb6abc2d81be353decf58493b52372b8fff115eb993360e5f963bcd12137099
MD5 7cd1bb1d0d601e49006b42ac07e3ae61
SHA1 51755ede33b532e1f74a15a531544c719933be1e
SHA512 c2e691c1c4ea72429b255def4705c80ffd93464bfe75db08f6a60f453c8157c16c2db9cfc6943c335701624c277671f6b046496967ba4d8bcfbdc8540fdc9e07
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 229B
SHA256 bb55436ef34bc282cc51ba6fd1efbf67733c791d7cd9e61605c9485886494c5e
MD5 015047d3b169af5996849321916e595a
SHA1 92326f9d00f1343a15b065e355a6e98e16e4fb60
SHA512 d05d6ab1f41959d4a2a10e08163feb7a58e94f7d86cc4431b0ede062d14dcb9fcc03cc23a53ccc793c06e887ce8a894e6cb929209d4317e56537530e35d966a3
TLSH
T110D0979BE2700930EAAA0B821662002B832229CC04C7919CD631905608586869202FF6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 bebbec9629ba5db20886effaa18ecd8dc18c3bdb332ea4d82dc9fc94f22cf7c6
MD5 96e6256649dc5550e038ea41bcc36352
SHA1 b261a75977a79aaacc82e87dd0632fa179c720ba
SHA512 44612168dbae1f955502c91fde7687de2f7d793ab047df9080bb7cbb1fcfcee9f4d7d54670edcecac08bec46ff63806e34ff436eeb535e4e8b0e6604ba4c53aa
TLSH
T11FD0A79BE1751870EB6A0F831662006B83222D884886D09CE622706948786579622FA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 8bd8d63746b029cd45f6fbc09d89ccd0156ac2c6038d7f0a6bc4ea4e1ec9434e
MD5 6abd783a0ec9c91b018d8ed5f8251d79
SHA1 50c5f400339dd3c5edb7d74b43ab97003dba9b03
SHA512 b43c5808eb49f1c357a14baf147b62ad6ee4aa2f896ea0438276073f7fa520fad27a396d14f7e087726157dfd8732074988f2f4da8ca30ece8a3686bf2918061
TLSH
T1DED0A79BE1B45970EAAA4B821762007B83223DC85496909CA62150664C586579512FA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586a4e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe586a4e.TMP
Size 138B
SHA256 d3dca01ea9a8b3be9ef4d230060043f45c9f3b1bbd9b6bf7523e22c45c96286f
MD5 f60fbf57708111b474b46cd6efaa5d81
SHA1 5b791392cb9e96d4581969c58f3eb7de22723f5b
SHA512 32b05005323d798a05fa8e8d7338e05da4cd3d3e22daf64fa17a18cb59e9244e8aba1519e74237a5e6afba5c81e9c3cc68a7574adcf0180d35f41dcd2d69eced
TLSH
T1CEC08CA3E25008209B1507400232006E83172EC888868088A1223025103CE276202FE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a5bc3cbeea03be75e3b0bc7eff33c2d663f65d687db20f4d7952421d9e3b6bf9
MD5 cac1b0b55ba9cbf664676ec862fb3229
SHA1 1cb2d4721370aa64df9f195825afa398cb7b94d4
SHA512 412cca6f0a1eca0bda113ff335f33a797ada0614bdd13c16d72905ecbe6975e9348d81eb46316ce1d2d2a1ad38eff0ec2fe352acf09d3d1f4443a369716b9825
TLSH
T1DDB0125084815901C00206F4218618A87124DF10960F170243E46D2298255708034054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587e34.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587e34.TMP
Size 96B
SHA256 47c3f4dfb92eca739b5a6e06887f479e4ff595f5a96358528c299ca8273786d5
MD5 86f16bd258276796df9ba1e92f8e5a66
SHA1 e32fd66ce60300f635b1a3bdb672d4a5719e3c84
SHA512 e4ba3b5e020e92d0c628123937203aee5e500b81462cad684cfb372ba6f3b59e3658a9e45396d46672c35b5ceb4866e64d7662fe13fd65f03c7eb3191acb298d
TLSH
T142B02220C022A302C00203B038B2C2CC3020CF2AC2032223A2E00F23CC28A3080A20A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 0ee8104802c5624854c2d3ef813c54dbf67250365056787f91a0bebb6f3fb65c
MD5 0616a83f7e5ad42f7cb9f5c0418ae243
SHA1 4e19d75001af17940cda2bd94642ea9542939986
SHA512 4455f46e3243a79727c3564c2205d1f941b64a1d6f86d3a4f516512b305112312ac87be21277b165535b8d05650db91041a842e9b9190b73203a016fef6c5570
TLSH
T1F2B0121800F0CEC1DC05857D03C934803B400415138233064083140C86050C10206D58
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 635a111a01d0fd07de845891d89293299c20f289a5bba4bbe6259658abaf94b5
MD5 a527a6c19cb051f1b20a5660158ab62d
SHA1 adf839b710c0724f4680f8d800dd2e75e5251d0a
SHA512 f6d3ea721c64572c9b221c9a95544bf10a988c9e551710daa1634aa35a505ae0bc1f89ff1fbf7bcef41049585e5c02654d9229d09d4482a97702f109f02374b6
SSDEEP 6144:2w7lMM4j5oZ6f0Co3dGgfLWqZ/ZLW3Exs:8MpfLWqZ/piQs
TLSH
T1F63422B29BD13F331DEBE374B8615ED97BF504906430CA028BAC3FABAC87956111156D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 82b65dae6e55dfab6b7cca1049382ee709a1912dd6f6734ed6c7e6731e448ff4
MD5 a993b24678c802c874b30d8d6dea757b
SHA1 0cf3ca8bf4a7d8c6fe6a776c7bc6a38cff846f7e
SHA512 874b737e08cfacf1b29dbbc88bdbf9f2c17efb85aa2ea019427738817f21a91e87b7c4d43b3b3c230cbf514b9a24f934b19fb2733d41be735b515fd0d95681bc
SSDEEP 6144:5Pw7lMM4j5oZ6f0Co3dGgfLWqZ/ZLW3Exs:ZMpfLWqZ/piQs
TLSH
T11F3422B29BD13F331DE7E364B8616E896EF544916930CA028FAC3F677C8B95211025AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4d802b3533e0d01cdf200f55ec50b0dfef8f7ac921f1ae07ffecbe2c871e850d
MD5 5bd8b826e9a25d34da61d75e595c243c
SHA1 4b15a3c7ddf14bf7863b80cececb820533055432
SHA512 40c29d7b1251b3dec0f1e258198d3e2127b779eb5ef901df10e7e7d096513edef2f6a085b4ac471c70d9b020551042dc3dddba2ae91ba2965e3acf365cbc1e01
SSDEEP 1536:bmLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Kqfd7NtZL8cHQRZEQ6Sps3
TLSH
T174C30237EBC21F379D92CF64B9130FDA67B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 83fbbf91212eb245cfa2351fe72d70ce311145946e88f7deedc708617396ee28
MD5 5a7e1332d4aa28e8ba0b6d0fbc16b05d
SHA1 a694587a28bc7464051e86d131497a5f7710cf62
SHA512 dc1209a4c16c271c283ed7a9164fb24d2d8cb9c5f49044411a487c334be4bccc97eb826622065fa3e571ed0a4995f0264360f5d2fb098dd2a6ebd8aece589580
SSDEEP 6144:1w7lMM4j5oZ6f0Co3dGgfLWqZ/ZLW3Exs:pMpfLWqZ/piQs
TLSH
T1D43422B29BD13F331DEBE374B8615ED97BF504906430CA028BAC3FABAC87996111156D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 314KB
SHA256 f483d26d0add95464d7591f8cd3140faedff524776416b519c75b1f95c3832a9
MD5 5aea5ebd2e25cfc1c1608feaedf9395b
SHA1 470902b22d312485134782e792e67b13104f2e2a
SHA512 50c4d9cd7aea95a6169030a7234f5e9a5f72824c130bb2146459c6b1a67109fee55a82c70ac29ab59aea4e2239b76fbf1501997dc5c88322232ac833cae3d222
SSDEEP 6144:mZ4fbybBV/zg0Dw7lMM4j5oZ6f0Co3dGgfLWqZ/ZLW3Exs:mK+bB9MpfLWqZ/piQs
TLSH
T1A664237397953F330EF7E370F9592F86AFF644905420CA02AB887BE3B98B166441156E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download