dda1582fcdf7355bb64d7029f6c8c92f7768d93fa5f8921af38d63a1bebf5e3f

Analysis

user interaction
yes
max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Process Lasso/Activator.exe
Size 684KB
Sample260727-tvmkwshr61
SHA256 dda1582fcdf7355bb64d7029f6c8c92f7768d93fa5f8921af38d63a1bebf5e3f
MD5 063e6d3b5c4c8a35d0a12bd6d25176f9
SHA1 203df188a8922cb75ad6bbb5232c40b9dceb8bff
SHA512 980be04ec1ec95bbf9568c93d0c48334d32acd48b365ca96f708b27df273005bdf861f245153cddaadbb4450e7f0e5ba6732aad82c87724f548bd9f11dedcd1e
SSDEEP 12288:l+Qz1ml4GzNM2zcUs0wdaE8UrJac8dqVH6sA5fUrvvD8GaWdeA7X2zSrmm1eMNom:lmlZMuxs1f538sA5crYGaWcmX5feHq
TLSH
T160E423A971B0E1C6CC8A13790F87C2B98B917C39D42196567B7E3B0F2E33245C6B6D61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activator.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2664	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296429992793900"	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Activator.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Activator.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4492	NOTEPAD.EXE
2292	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
4860	chrome.exe
4860	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	Activator.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe
4896	Activator.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4896	Activator.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
1500	OpenWith.exe
1500	OpenWith.exe
1500	OpenWith.exe
1500	OpenWith.exe
1500	OpenWith.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3708	3444	chrome.exe	89
PID 3444 wrote to memory of 2664	3444	chrome.exe	91
PID 3444 wrote to memory of 3464	3444	chrome.exe	92
PID 3444 wrote to memory of 3464	3444	chrome.exe	92
PID 3444 wrote to memory of 1028	3444	chrome.exe	93
PID 3444 wrote to memory of 1028	3444	chrome.exe	93
PID 3444 wrote to memory of 1080	3444	chrome.exe	94
PID 3444 wrote to memory of 1864	3444	chrome.exe	95
PID 3444 wrote to memory of 1080	3444	chrome.exe	94
PID 3444 wrote to memory of 1864	3444	chrome.exe	95
PID 3444 wrote to memory of 4284	3444	chrome.exe	96
PID 3444 wrote to memory of 4284	3444	chrome.exe	96
PID 3444 wrote to memory of 1992	3444	chrome.exe	97
PID 3444 wrote to memory of 1992	3444	chrome.exe	97
PID 3444 wrote to memory of 1868	3444	chrome.exe	98
PID 3444 wrote to memory of 4232	3444	chrome.exe	104
PID 3444 wrote to memory of 4232	3444	chrome.exe	104
PID 3444 wrote to memory of 2496	3444	chrome.exe	107
PID 3444 wrote to memory of 1848	3444	chrome.exe	108
PID 3444 wrote to memory of 2388	3444	chrome.exe	109
PID 3444 wrote to memory of 5008	3444	chrome.exe	112
PID 3444 wrote to memory of 5008	3444	chrome.exe	112
PID 2884 wrote to memory of 4492	2884	OpenWith.exe	115
PID 1500 wrote to memory of 2292	1500	OpenWith.exe	117
PID 3444 wrote to memory of 4860	3444	chrome.exe	118
PID 3444 wrote to memory of 4372	3444	chrome.exe	119
PID 3444 wrote to memory of 4372	3444	chrome.exe	119
PID 3444 wrote to memory of 4128	3444	chrome.exe	120
PID 3444 wrote to memory of 4128	3444	chrome.exe	120
PID 3444 wrote to memory of 556	3444	chrome.exe	121
PID 3444 wrote to memory of 556	3444	chrome.exe	121
PID 3444 wrote to memory of 4984	3444	chrome.exe	122
PID 3444 wrote to memory of 4984	3444	chrome.exe	122
PID 3444 wrote to memory of 4644	3444	chrome.exe	123
PID 3444 wrote to memory of 4644	3444	chrome.exe	123
PID 3444 wrote to memory of 3544	3444	chrome.exe	125
PID 3444 wrote to memory of 3544	3444	chrome.exe	125

C:\Users\Admin\AppData\Local\Temp\Process Lasso\Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Process Lasso\Activator.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe5b61c728,0x7ffe5b61c734,0x7ffe5b61c740
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,9102359208813829145,7796314853400916430,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,14910882714781588649,2220332476927720009,262144 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,2678321653486346037,18260882225238074551,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=580 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,15106360553940202487,1795252037160933450,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,11744413910122981665,3640933978009021154,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3980,i,9924263493980341620,15185846852338678664,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,3164417380523357652,15031763533824271241,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,2159789351576191327,7848755488962869761,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5792,i,7310154253592214424,12137198048788721676,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,12006764557022612457,7594545826158705462,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,17175827240495553947,872812437571245402,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,17109269708715259063,14717228139513800256,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4584,i,14818121187823685504,6453291674153542806,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4728,i,720994481876463653,4767784746425981435,262144 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4832,i,5040211320765009437,6253216223220320397,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3668,i,3073453737156585757,153289114372121622,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3656,i,15465423083688762860,7881070861678877943,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4604,i,9158312839259859609,2047665351032887904,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5972,i,8975210018758739890,17929511602545277419,2097152 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3288,i,6930533149246428231,9656337293070809009,524288 --field-trial-handle=2148,i,13507649701765040521,5315642085329772515,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:3544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\prolasso.key
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\prolasso.key
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d19886b8ced2dca6dd33bdc3d9523a2273c147a03b1e48543eb89643e4d3a761
MD5 fa50f46c404d7681f773788c423ae187
SHA1 76a1f7a351922cb080a125b02f376ef06ac87947
SHA512 b3a15dcce1b2b7e072038e66f41da3bd4c006fc5249edeb587a660433e00dee2517b40037ebff9e4349eacf2337ccd9eb6bdcda30e63e20101cf98a20e8c7372
TLSH
T1C3E02BA9C821AC372CFD071854150649E750135B2A81590F763E5108CFB062652CBC6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 dd5270cd546860d8d7f5b2d986dac071f8749a485e4551e9d3d0640fdbafba86
MD5 c8f2bcf1b04183b82eca19f680bd16db
SHA1 42a627c599ef8a997a85158c67057871ee8478c9
SHA512 c58fcb6746d93b9165e595ee06fdef745889d9e0916cd3e62bd665beb2605cb3e14ff590a512093636c433cbe2a4d3cac3a4cba5974c8bf0a2beb6a53fb86e24
TLSH
T140E086149EE00308DF5ACBF49567BD6D5960DE5E1100D39394B4A1C91D7F0E3E417794
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ec7fa35508212ab93f8764ff0df4bf753a12d77d3427421ea1d426e563307b3c
MD5 b872ee6dcf7e024de95b42c5cb19d5e4
SHA1 3818b56a3121738bf7897901009e6b51d5318ed1
SHA512 9e7439cc5722260978a293238105d5898a26142a49ae68c54f8efaabc66fa23b77bba0e94a3cd82b36d855824b554058d4b5fd12af7cfe6e680282db46ea6ce4
TLSH
T1EB2187104FADDF05DB7542B846CF1F2BB674D9494B43CBD720B0D1B529672B254D502E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b217b8f0ebfcbaf23819bcf064748b788cdaf2fb774d1f31f8fe5401585a325e
MD5 e80cbc506328d940f3c36c1b3cdd0775
SHA1 504d332997926ae161c1034bdf67f96723ab8074
SHA512 65d7d4f0eabfb4d2473f48859c93eecec43124cd8dcb01201ffcb25b6c24f0d664265dd8e7df5290bd466a09444b647e7d900ebed1d20fff45b1f8ca8ada5370
TLSH
T1DF61ADF7C3E4897E891162F4DB15AE2FCE7A0914032C3D66C9E4AE1B53E2872D21574E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0457fe6bacb32802f3b5b9d16e0b5ffb250638e03d404d70d350e1c1c9291f55
MD5 f2c63291426fedfc895b4d27c2364e19
SHA1 45ef48bda1a29bd104a372286e409a36856f6c7a
SHA512 1ca9a1c9d9b49b96b6fa1774e396a3d55424dbd62f5f9c3f3d42d55906076f0d0921fa0859481f85672f63b13f2aef0095a70cf860b4b9b02016b1945ab7487b
SSDEEP 96:DwkMdm2aaJWHYiNWbkcngAfDki0ivz0fdfCby6rE:DwkMdlaaJWHYiNWbkcnffQi0ivz0fdfv
TLSH
T1D3C179F7C3E8893D891152F4DB15AF2FCE290954432C3D66C9E4AE1B93E2872D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 03ea54a5785bee366ebb54c876b81e6ce1ef2921bec28922031454fc5021a7bd
MD5 0b551d0a87b0f66d2084cfb495e83ee1
SHA1 b7386b923fa6222fc6274df8c00540b68837ee65
SHA512 011637862cace31cc76e583f2cef41180c758e293a8f78a342f94fec82660e09dc03f2056e5740eaa65db046098e2d362520aa9baf3e8b8f8c792f61b48c73a3
SSDEEP 192:DwkMdd933E1JMJwaaJWHYiNikcnffQi0ivz0fdfCbNk9JVIzIUWaPbvCfPoNPBjo:DwkMdd933E1JMJwaaJWHlojnff9BL0fP
TLSH
T1A622CFF7C3E88A2DC91156F4EB15AF2FCE2A0914432C3D66C9D8AE1B93E2471D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 774889e85c52e414c29a6c27f8b6391bf4946ccd91019b067ad12dfed76e8882
MD5 fdcb6befd4db219ca4c57e8c4230bdba
SHA1 6b6535c619222317da8ac868b793590283e2a414
SHA512 06fdcd474544158016d97157edf3076ed3ffe400b719bf4bbc2ffbb87360a5c311e840394a518292b2600897f49a6312e8fb5660174e22bf6f766cc8cbd7328a
SSDEEP 192:aR4YcBz6yBwW0z2E7yv7sV+PRpx2mnjF9wHsb+WNni5BJd+jI2nQ2ne243aGdVyr:aR4Ymz6yCBeYyXsaKwEJR2Q2waGre
TLSH
T19B52D83EB910697B5CDAD219FA22BB67D7F5202265D02E94E6FC8A1C14E7ACC3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8b87bb00fd8526669e9bbb21f416070ec832bb2ded5e50a17ee7244c2ea34dd1
MD5 3efefd951ccf85f4dfc6f7ed05f449ca
SHA1 37107492d7e0fae2e6c69170f9d500fcb70b5071
SHA512 27966c7d23a4d5624600763b3b8923f1cc1c42863766c1f6ae90fb59c33a881aca0a8d7b14317114ef465c6575f363541c5f3d960fe0d5e14a5f877b6ee3d325
SSDEEP 192:aR4xcBz6y+wW0z2E7dv7sV+PRpx2m0BjF9wHsb+WNXxi5BJd+PseTQ2ne243aGdM:aR4xmz6y5BdYyXsvKw+JJeU2waGre
TLSH
T1A362B73EB910697B5CEAD219FA22BB67D7F4202165D02E94E6FC8A1C14E7ACC3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d64c4c87f6339c56c0574c05f3fbffbb1ab48c42f3721f3c007e1cb0a0077cc
MD5 a34024f5a59bf42456eee85ae7b7ab4f
SHA1 edf0eb87865d291ea18cf166fb0f6b06d7188799
SHA512 10769695d5c55048ab8f4904a32f6031dc33d1bef9b8c7800625f890abd7a63ab6a2347bf4f69603ac608944013815496f08fad4aeedc41512626b11c0bc18d2
SSDEEP 192:7R4w6yBwW0z2ESyv7shAPRp22F9wHsb+WNn7D0FQ2ne243aGUVyIsnAUgtaJ:7R4w6yCQeY8X/FKwH0W2waGQ8
TLSH
T18D42D93EB914697B5CDBD22AFA227763D7F5102161C42E50E6FC8A1C14E75CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 413904d9595c2a61b3d49b97390499017961b8798a26a4ef32d2ad0a3e338288
MD5 39dc4955bd97fa205c0549b85c2f4dbd
SHA1 11e081be51b1e2b37f070d3723ea81deb9e6e9e7
SHA512 e951d48c7a34cce1016ff38070d057e9cd3c08ba9a91c0dd47457d19ddb70fd5139e106a5a34b4f704e7a9b210eda1690fb721a4210637d8de51634a980c978d
SSDEEP 192:7R4w6yBwW0z2EZyv7sIAPRp22F9wHsb+WNn7ztBQ2ne243aGUVyIsnAUgtaJ:7R4w6yCLeYJX/FKw3tK2waGQ8
TLSH
T12642D83EB914697B6CDBD22AFA227B63D7F5102261D42E50EAFC8A1C15D79CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f18bf29222cda3b2474f8284752ecf0b14e0c96e41a73bd7fb74a7350369b5fe
MD5 93a027dff3814defcd2a7d67a69aa4da
SHA1 6312f0269fc9d7058c8f37ed2d3f3e9be742887d
SHA512 2ff96e73d038923c38a17d35c947d3e412561ee5545042abb46646ab53994aeaf5b909f0d572ee3cdd45fd93bd5c40ad94f98aaf3e367a4834688061df89fbbc
SSDEEP 192:aR4YcBz6y+wW0z2E7dv7sV+PRpx2mnjF9wHsb+WNni5BJd+PseTQ2ne243aGdVyr:aR4Ymz6y5BdYyXsaKwEJJeU2waGre
TLSH
T13252C83EB910697B5CDAD219FA22BB67D7F4202161D02E94E6FC8A1C14E7ACC3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 118a8ea2d1bd62f8cdf03b6254b24a906e5589741fe98ca453c783a238b5abdc
MD5 2a4b9fd80ca75265862cc1f2d4b31e44
SHA1 1847bf40fd904bb4084bada4fc57d47a69cc1572
SHA512 19d3a46967424e87d95b6fda8aba15df4b60e9245573f3f818f2ef8855d3550fd8a5f06db919c8d8121a5983ed625b81c7f5d0cfd181530819e0d29196dd86ea
SSDEEP 192:7R4/6yBwW0z2EZyv7sIAPRp22F9wHUBb+WNn7ztdQ2ne243aG3VyIsnAUgraJ:7R4/6yCLeYJX/FKs3t+2waGRe
TLSH
T16252C83EB914697B6CDAD229FA227B63D7F5202261C42E54E6FCCA1C15E76CC231701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2dc9e99a301c58e8633169fa3015c3d72dd640ea4ce9139b8c3847bcf901c049
MD5 7bdb279542568b46639de554f41682f4
SHA1 f4a35ffbcec498878b6ff1e68f8a559aabd7a63c
SHA512 d828dce9d0ddc4f9125fbb3d118da61e2187ff07d859af25a9e69579934cad1cdb4e1414383d4ec83fbf887eb7b3561c71a7e434213cbd7aeb9b9360b0ab9e5e
TLSH
T1A5B0220AC20AE232C00203B2288083C8B020CF22C203022282F02AAACC28A20022C0B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b5a3a41a04045d5f3d0c7f60ea6147547c50b7954f11bf14afeff8cd9136833f
MD5 e35b8c8e9f3db41380530cfdd1442032
SHA1 94569de3125e0bca56c71ffb7ee4e298c978741f
SHA512 f853e3177a1bcf6025bc41c0fe466c8cc43a99b8da830bc12287559555098c8386c2dbe10e6ac366646b7db68e0ba4254736fe90a42bc4f32fb178f30c48f88f
TLSH
T15AB01244C0015701C01606F81152148872149F129B0A1B0363F079238C2959081140B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 65a02aa766013882d32a619e0045ddcbd7d3d63d3fd8a6be45c2a5dabdf71853
MD5 2b06b5e367ba0ec8e08fe6293e455fee
SHA1 74e9b22cf504a96382b345bbfdfc5f70060f1b0c
SHA512 b872e330d792feecab15d072b2b1b7d1b662ea0951f0a5406586cd260d8d9882776c19d1661d18fa8b5c912463ef4854dc11debd58c0b193e85c10e29935f5b7
TLSH
T102B022082200020ACA8303B0B3CA80C033380C2003C2E30300F0A8A8CEC0202C380308
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 653f51480b937b4f073aa169188645f551ca6c411083c41ac6ecb1e6cae4cee5
MD5 765d23020c3002b930fa89b6c380dec0
SHA1 4758d3f248f094c3df269c02b4f96cf9633be603
SHA512 b57078bf2c5b4f6c80a102479c08d5892427c1ea82e8fe40b6e0b04f9c8a1ccdce682e42fba27639ad45ad0af2a4cdd889d90459d2adb3c027519d5417f1a0a3
SSDEEP 6144:B9GBUb9VgUEcb4/MsIT+CvZBzm7Rkm1tYpBeh2BAoh:Bpb9VgJ/OTZBC9oBGcAoh
TLSH
T1803412325C217C7718FD962FF08E292F2EF1DFB6C9D0998A88D99B0063ED6D15A05970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c230effb5dbc104ccecc87e3f2026ab07f21ac64b08488d95298ce61f846d690
MD5 917e6ff6bb4cae9cc5036cbe74b42fcb
SHA1 4da91fe31f0ea7ad996e229fcd1fd79360ec7028
SHA512 3b2ab66ec3dafabf8e0ce7757313fe3bdb62ad51bca1e1f3f5cd79eb7394f1d99f845dfe060889694167880e67b806787d70d8520f65ded78c922a1fd087a309
SSDEEP 6144:JIBUb9VgUEcb4/MsIT+CvZBzm7Rkm1tYpBeh2BAoh:Jdb9VgJ/OTZBC9oBGcAoh
TLSH
T1A83413325C21BCBB14FD936FF08E1A2F2EF1CAB689D0599789D69B0063E97D11605E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 7357e904d774b06d074c38d3d2b501ea238e1ad82b3a53f358dd30fd14b542a9
MD5 6b9818c859be8f555558e416c8343af6
SHA1 660502e3b71d9782f26b2a675e7e2cb43a4f31f8
SHA512 49b8623f138353664167ee357425916cb7b8fc50c4c0e580be6c6a85286bb091ed744a2ff7c6d58b8ee2e4936e80841051e5eb07bfcaa373d35e8644441018c0
SSDEEP 6144:JsGBUb9VgUEcb4/MsIT+CvZBzm7Rkm1tYpBeh2BAoh:Jcb9VgJ/OTZBC9oBGcAoh
TLSH
T1B33412325C217C7718FD962FF08E292F2EF1DFB6C9D0998A88D99B0063ED6D15A05970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bad3a31ec726a12611b12cd54a8057fec5e173eff080358386771a1333be06d4
MD5 8b18a584670f5ab1f8b14894d1450152
SHA1 926fc11cdb3a9042ce11cf477610b5304f5739df
SHA512 4d1c32e70aabcf5d9887176f8d4584c28488f1b1400de0cd61def571321d35d36b17051aee786249417640f5e46c312943b231bfe48642810ffc3a2f8b31a545
SSDEEP 3072:lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:sm7Rkm1tYpBeh2BAoK
TLSH
T1FDC3123B5D65E97B9979AB0EB08E0B1F1EF149A2D920DE92C8D85B0437E97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e68715c31ce339ffb5efd4d8bf91e103600f5eb8d83e00ca964d993304f2009e
MD5 5f9db6eb2ec14ecd774fad3fad0f392e
SHA1 0ca16d84f18c193a351e06bb4363022be2ad4fcb
SHA512 f1519984bf9fb2bb48526019bc7745c9280db7a2440059fd809f23b2b0f5eb4b36ea04497dd3c127766a3d1be28f3b7672180ebfa656df03453c16f20a2f9868
SSDEEP 6144:J9GBUb9VgUEcb4/MsIT+CvZBzm7Rkm1tYpBeh2BAoh:Jpb9VgJ/OTZBC9oBGcAoh
TLSH
T19A3412325C217C7718FD962FF08E292F2EF1DFB6C9D0998A88D99B0063ED6D15A05970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 469c4d526e1edc296559bbb019cf76eb5432355acdd018b669f4a6e23a46f1ad
MD5 8cb7b839280df65cf490e56e9b548d4e
SHA1 e2f870d43dd9afe7abb0ed2e9b2f7d17eb319430
SHA512 bacddf5a29fec256eb932f64438d971cf5373f38497194b59107e01223e2530078455a36deb7812c1edd41e4bd17fc6ebe2da15b832bdf5e503b0263a8e776df
SSDEEP 192:eexVMpc1ajPAVJeCpySXZ3UHmpoVTl/a6femL3cUNoGc/IN+xs0aCmVF:LxycZIC0zw+l92S/NoPfs0aNF
TLSH
T1B6439366B804D645DE095C369FE7E6EC76317E12CE6B061338C2BB7F89BB0C54E18644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prolasso.key

Path C:\Users\Admin\Downloads\prolasso.key
Size 164B
SHA256 30c83afac26a0750e5639521803cee726d108325b6f6ebce73cf960463ede336
MD5 d572ed4722a1586f4386b02e03737ad8
SHA1 d116bde87dd9cf74f0b61e041cb1aa9e5ae6f9ec
SHA512 20361ae70c0f217544cc469e2addfdfda45c5644d29f62605972826ec5d94cbc92a711602a8064ffe2bcd788f38f0639ac2f31307face2783374647ed43325d9
TLSH
T121C08C03B3CCD02AB3FADB582A704A0A5923BD13AD22817C6921104CC1F262491A1627
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1668-72-0x000001CA72600000-0x000001CA726E9000-memory.dmp

Download

memory/4896-119-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-206-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-214-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-216-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-226-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-188-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-130-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-0-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-39-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-3-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-4-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/4896-2-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4896-1-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download