Overview
overview
7Static
static
3waif_v4.5....]_.zip
windows10-2004-x64
6waif_v4.5....]_.zip
windows11-ltsc_2024-x64
1waif_v4.5....XX.dll
windows10-2004-x64
1waif_v4.5....XX.dll
windows11-ltsc_2024-x64
1waif_v4.5....WU.dll
windows10-2004-x64
1waif_v4.5....WU.dll
windows11-ltsc_2024-x64
1waif_v4.5....up.txt
windows10-2004-x64
1waif_v4.5....up.txt
windows11-ltsc_2024-x64
1waif_v4.5....s.json
windows10-2004-x64
3waif_v4.5....s.json
windows11-ltsc_2024-x64
3waif_v4.5....re.dll
windows10-2004-x64
1waif_v4.5....re.dll
windows11-ltsc_2024-x64
1waif_v4.5....re.lib
windows10-2004-x64
3waif_v4.5....re.lib
windows11-ltsc_2024-x64
3waif_v4.5....indata
windows10-2004-x64
6waif_v4.5....indata
windows11-ltsc_2024-x64
6waif_v4.5....indata
windows10-2004-x64
6waif_v4.5....indata
windows11-ltsc_2024-x64
6waif_v4.5....me.txt
windows10-2004-x64
1waif_v4.5....me.txt
windows11-ltsc_2024-x64
1waif_v4.5....mm.dll
windows10-2004-x64
1waif_v4.5....mm.dll
windows11-ltsc_2024-x64
1waif_v4.5....mm.lib
windows10-2004-x64
3waif_v4.5....mm.lib
windows11-ltsc_2024-x64
3waif_v4.5....if.exe
windows10-2004-x64
1waif_v4.5....if.exe
windows11-ltsc_2024-x64
1waif_v4.5....if.otf
windows10-2004-x64
7waif_v4.5....if.otf
windows11-ltsc_2024-x64
3waif_v4.5....ly.bat
windows10-2004-x64
3waif_v4.5....ly.bat
windows11-ltsc_2024-x64
3waif_v4.5....a.json
windows10-2004-x64
3waif_v4.5....a.json
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
260s - max time network
259s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
waif_v4.5.4_[unknowncheats.me]_.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
waif_v4.5.4_[unknowncheats.me]_.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
waif_v4.5.4/Release/FTD3XX.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
waif_v4.5.4/Release/FTD3XX.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
waif_v4.5.4/Release/FTD3XXWU.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
waif_v4.5.4/Release/FTD3XXWU.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
waif_v4.5.4/Release/discordoverlay_setup.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
waif_v4.5.4/Release/discordoverlay_setup.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral9
Sample
waif_v4.5.4/Release/grenades.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
waif_v4.5.4/Release/grenades.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral11
Sample
waif_v4.5.4/Release/leechcore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
waif_v4.5.4/Release/leechcore.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
waif_v4.5.4/Release/leechcore.lib
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral14
Sample
waif_v4.5.4/Release/leechcore.lib
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral15
Sample
waif_v4.5.4/Release/player models/player_ct.skindata
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral16
Sample
waif_v4.5.4/Release/player models/player_ct.skindata
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral17
Sample
waif_v4.5.4/Release/player models/player_t.skindata
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral18
Sample
waif_v4.5.4/Release/player models/player_t.skindata
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral19
Sample
waif_v4.5.4/Release/readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral20
Sample
waif_v4.5.4/Release/readme.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral21
Sample
waif_v4.5.4/Release/vmm.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
waif_v4.5.4/Release/vmm.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
waif_v4.5.4/Release/vmm.lib
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral24
Sample
waif_v4.5.4/Release/vmm.lib
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral25
Sample
waif_v4.5.4/Release/waif.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
waif_v4.5.4/Release/waif.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
waif_v4.5.4/Release/waif.otf
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral28
Sample
waif_v4.5.4/Release/waif.otf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral29
Sample
waif_v4.5.4/Release/webradar-only.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral30
Sample
waif_v4.5.4/Release/webradar-only.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral31
Sample
waif_v4.5.4/Release/webradar/data/cs_agency/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral32
Sample
waif_v4.5.4/Release/webradar/data/cs_agency/data.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target waif_v4.5.4_[unknowncheats.me]_.zip
- Size 6.5MB
- Sample260730-xt72zsec43
- SHA256 ec389764533c951abb21da3476a2f5cd1102398e7e6d833f62955890bc004c82
- MD5 b3025595e800df7438260c502e1990dc
- SHA1 2f7520d288fec0a7afb7056a763bc23ded76b24b
- SHA512 15b58ae3227a867c8c385a3d566450c591bdae6b384bc01c7054831ba8ccaeefe5dd138af29b3c0ec4381d0664482152d027ac4176aacd9196bf896842b1dccd
- SSDEEP 196608:XMOlJ0DHplpX4XiCD64XurDgiUdcREQTR8TWeHRyXSZ8sT:X30llpWFXurDFUdcSQTR8aOZxT
- TLSH T1B36633592A20FD27ED4E343FCB5B1907345B33A96324BDA85A745E03A85B23A1CD2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 121 discord.com 122 discord.com - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 400 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299125292668628" chrome.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{464A6465-5DFA-445D-9BF9-65970D86F22B} chrome.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 5984 chrome.exe 5984 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe Token: SeShutdownPrivilege 4716 chrome.exe Token: SeCreatePagefilePrivilege 4716 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe 4716 chrome.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4624 4716 chrome.exe 105 PID 4716 wrote to memory of 400 4716 chrome.exe 106 PID 4716 wrote to memory of 1692 4716 chrome.exe 107 PID 4716 wrote to memory of 1692 4716 chrome.exe 107 PID 4716 wrote to memory of 4652 4716 chrome.exe 108 PID 4716 wrote to memory of 4652 4716 chrome.exe 108 PID 4716 wrote to memory of 4116 4716 chrome.exe 110 PID 4716 wrote to memory of 4116 4716 chrome.exe 110 PID 4716 wrote to memory of 2252 4716 chrome.exe 111 PID 4716 wrote to memory of 2252 4716 chrome.exe 111 PID 4716 wrote to memory of 2336 4716 chrome.exe 112 PID 4716 wrote to memory of 2336 4716 chrome.exe 112 PID 4716 wrote to memory of 4724 4716 chrome.exe 113 PID 4716 wrote to memory of 4724 4716 chrome.exe 113 PID 4716 wrote to memory of 1280 4716 chrome.exe 114 PID 4716 wrote to memory of 1280 4716 chrome.exe 114 PID 4716 wrote to memory of 2148 4716 chrome.exe 115 PID 4716 wrote to memory of 2148 4716 chrome.exe 115 PID 4716 wrote to memory of 2168 4716 chrome.exe 116 PID 4716 wrote to memory of 2168 4716 chrome.exe 116 PID 4716 wrote to memory of 3908 4716 chrome.exe 117 PID 4716 wrote to memory of 3908 4716 chrome.exe 117 PID 4716 wrote to memory of 4996 4716 chrome.exe 118 PID 4716 wrote to memory of 5384 4716 chrome.exe 122 PID 4716 wrote to memory of 5688 4716 chrome.exe 123 PID 4716 wrote to memory of 5696 4716 chrome.exe 124 PID 4716 wrote to memory of 3892 4716 chrome.exe 125 PID 4716 wrote to memory of 5984 4716 chrome.exe 126
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\waif_v4.5.4_[unknowncheats.me]_.zip1⤵PID:4836
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff90c97c728,0x7ff90c97c734,0x7ff90c97c7402⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,5730782757367804203,3661509843629136562,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:32⤵
- System Time Discovery
PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,8188896523578917152,16837549836790514388,262144 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2484,i,10429526867995179531,11795441807473862936,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:82⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,16732732138781032634,5350975776754196761,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,18338743139596531093,16537618985387621282,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,11727796035548851220,12051259032646466900,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:22⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,9654501844734527424,9910761127982699611,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5488,i,15904339565474305292,15967307905006584565,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3556,i,2873346103223137798,12294994982827817553,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5624,i,9720393633409180754,9802823922852804568,2097152 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3540,i,10068203361750787992,2555557623555583697,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,8407556921579960770,7341052346560629710,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6592 /prefetch:82⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6800,i,14354652547083592606,7137601069731100145,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6812 /prefetch:82⤵
- Modifies registry class
PID:5384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,17256330287381089172,5420592124488749118,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6636 /prefetch:82⤵PID:5688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,16835709502156159778,18191883485587645881,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:82⤵PID:5696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,11781126908475896037,6813929678091856111,524288 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6824 /prefetch:82⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1204,i,14451463389733936581,3448969677601977487,262144 --field-trial-handle=2100,i,17815132894011631720,543884532235862894,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5984
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4024
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 5a0894914f228221cd26c42adb78450d3bc694290d955c4b40e9ee5dbdc7f0d6
- MD5 b09362602fed9feff4a9929c0f45e595
- SHA1 63390c656cca54f1f60f525903a4ab03f98b3bb6
- SHA512 4386bd9eae0b37644797cc56c25254ac5c0abb18e266809a3bd3f460c07d15f0fd8b9dd5a373999feb8d69ec6d9e73d0dc1142be517ce7ff19be6a9bd20cc7c6
- TLSH T1C9E02BA9CD21AC2708FD47186054468AE751135B2E80965F7B3EE119CFB0A2A41C7C6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 5KB
- SHA256 edf5819a222ba0054da31b8d4c1462d381275b7d99fc9e8f410ebda65b0eb3cd
- MD5 205c23d2f18439a2e323b9470fac4035
- SHA1 b2054d467b149151a2442178d1b4e69dfece03ff
- SHA512 e447ad4bb57c2d83cacc194a35cedd0099877c65997aa061717da68bf668cd53bd58a27bbac16842275c0954cefd4bb81ae370eb12dc2c47ebdbbc5f33becdb6
- SSDEEP 96:C04UuuESyl7oHmtaMwLvaaasvjI5sZMDLmLTydfZ8wE8cBM:C0rpdhHYLoaaz7t6dfiwiy
- TLSH T12AC15D9246E01605FBF14DBF2FFAB896B9B786885B435FE604B141BA1E4B791683310C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 e57ee251e05a27c727531c3212b9c4ce51ecc4821f1dc9f97a81fdd5d17343f7
- MD5 029c01ddb2aae5ae88498cf9c3f46895
- SHA1 e9d531161372aa2ebe08d0b04b39590ed71c379a
- SHA512 bc2d2ea86bd002aa9232a364a799bdbcb72f2f3e1516250719e8df62348d97ac11ca46c60c76e89cf40b6a15c37eeb8ac5b8fd52396e70ffb53005d5bc78da0a
- SSDEEP 192:DtB5Ipet2IaaqT1XNdSSqwryU5YIpr1Tsr7blK:DtB5Ipet2IaaqT1XNdSSqwry8YIpr1TV
- TLSH T159E17AB3C3E8862DC95157F8AB147E1FCE291924431C3C6AC8D9EE5BA3E2571F24064E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 68a246459622a83f112dee09af146d1a0d05f48afb5122e7a75f0d70bab062aa
- MD5 db3f1a68c29099a25fff95cab1ba7bbc
- SHA1 230f16fd205c3c30b0bf192e26c0b4a717a02af9
- SHA512 63ae533fddd43b97ade40d755d9f44ccd4c6e2a1e6acec4fe67da6b434a16f8c29e5dec9c2a3b0392d42eadde8d3ed56740d1f337aec99d83172dea943598a4e
- TLSH T13C416AB3C7D8857D891052F4BB156E1FCD2D0E24535C3D5AC8D8AE0F63E68B5E20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 168972e837e8c86c90f7200dd32190ca1d7da1533f3989403537ae6654b73afc
- MD5 5080c543966a79e1fc2f3b17d79b7e6e
- SHA1 ea32aad3221b309cc6ba81ba4e356bdbfecb587c
- SHA512 bd3e07c9f33135f772902cea023b3c74078fac81c693517d58e277dea64f2325018214012076ab2c2cfe784b52d30a1114738f228cf27e747037763d95d7fc96
- SSDEEP 192:DtB5Ipet2MyaaqT1XNdSSqwryU5YIr1Tsr7bZydW:DtB5Ipet2MyaaqT1XNdSSqwry8YIr1T4
- TLSH T166E17BF7C3E8862DC95157F8AB146E1FCE291924431C3C6AC8D9EE5BA3E2571F24064E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 71d3ad0745968329e59da8cf3bdc8b9401bcf77192253c8ea1b5dbbb1d79439f
- MD5 e9a9dccbb2d5b71efc8ebcd68470f6dd
- SHA1 4273bc21fae57a67288f196dfd4188c072f08fe8
- SHA512 8c91e4ec9b16adfefe01b9da53563a02f0a86c5ad80eedf8900687384eaac81725eeb000e5391961c93b7a3976cbce6534f1187c1f06e88c2d0c0f16584e33a0
- SSDEEP 192:uRfTcBzfnP+ayZr0wNv7shAPRp22mHS9wHsb+WNnRy4Lc2//ikwqV5VyIsnAUge:uRbmzvm7tY8X/LKwop2niefe
- TLSH T19652E82FB914693B5DDBD22AF9627B57E7F6102172841E84E6FC8A2C04D79CC3217817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 ba6c3dbc16a49bac95370a2f3fe96474f2ca59eeccfaaa603d3e8305f889a92a
- MD5 5ca08ab9a7ce5ca74fe3611200d371e4
- SHA1 7719f81f18335103fc5f8fc2cb2c96ff21b89f15
- SHA512 33a532f83cafa5e31780d8d9e44a51ae7cdb0e40ad4152f78224adf41f511c611677e869f62d822d1688eb1319f8d18c6e351b27610201fe4c89dc20761b1a98
- SSDEEP 192:uRfTcBzfnP+ayZr0wUv7shAPRp22mQ8S9wHsb+WNdiRyO8p+Lc2M/ikwqVaVyIsB:uRbmzvm7QQ8X/RKw5rH2Wieae
- TLSH T1D052F96FF914197B5DDBD22AF9917B57E7F1102162841E80A6FC8A2C04E7ACC3317817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
- MD5 d066f854d368cbebca026e5da297c2c3
- SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
- SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
- SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
- TLSH T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
- Size 226B
- SHA256 86b7badacc613b572eb7679e6d3604929d4c5e10a1d5b9c843257f3b5d7a73c9
- MD5 d8f1f1dd7115239cf197c9dd1c819044
- SHA1 ed92f51af8aa5ad60057ee3ef5159e537c994fc7
- SHA512 f19f4f6067727e430e8366fee824ef1315651dfedfc39797c55cb6dd1249364994e1f20d31a9e26d664cbb9ad015342a02d6dd332530f30c7fe8a7b0eb6ea33b
- TLSH T1D3D0A79BE0144690DEA74E529926197B4A647DD85896D048E902021D9880B53D122F63
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
- Size 233B
- SHA256 85324537deabd731e32120589c75daedca7c25444b88a81b6a758369826d3ec6
- MD5 a801315dcd3b2c6ef4fe151a404de9e5
- SHA1 2597a6a17383d83c112aa55c6c1b6601c320e60b
- SHA512 78e6c91859738313b1a15956536fa422844ea14cb4a26bb1952ff7d6afe4fdb94ff760c2ffe91489da76633676d98d859a6d2814e0cef84957379265750e10da
- TLSH T13FD0978BE0100590DB670A4399320C7B0A602DC80882D048D902321C98B0B43D122F63
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a449c.TMP
- Size 138B
- SHA256 8b5661a41de30fbe18e667b23d17744151b123cfe28a17ee645c92c46cfd7498
- MD5 6d3204da211921ac0651b6a845efddbd
- SHA1 44972c2648c977d350a532c40a46af40bd3d3329
- SHA512 33a56fcb2c2e11bbcea0c73e3434cc957de5ca2b44b4a12920d68b133b1ae50db43ee38b6447c094967489aed138581f704b6cc0f71e2c57493ba5e5c1d6f933
- TLSH T1EEC02BD7F0010660CB2102518632066E4B052FCC8CC2C44CF403315C6430F136106FF2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 75dba1d95e14a5e8c4c7e5f69494a97968e5b63560ffa536ece05118582cbb6c
- MD5 67524623b9405d5213476c8796f606b4
- SHA1 5bd10af05c9403207ad224e21a7f968e730f8c31
- SHA512 12efdcca27cfb6137194c00551e7812312c7316e642d9cc5376294b1f3bc393f2adb42bd98c166f753f6b5aa79ba47f8ef51953f05bf8498370d4c9de35b73fb
- TLSH T16FB0125284425101C00207F4114254C8B224EF10AB0E170153E07F23882D150C418060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3c4f.TMP
- Size 96B
- SHA256 63778a86b718b9fc198655a7e207232c24a99e433a1cb1fa97156243fbcedf0f
- MD5 64f7d91d70898d04033a01b6b8fe6f2c
- SHA1 b8263df7c45f2543e825c58ec53a2b427a67a04d
- SHA512 3e63d39fe53ae36e68272dbd854385154d5fc6ba3833a8699970993ddb8878c893aa6a4d766208217402e569b1bea0ce148bcfcf54d81120dc368b9fac524a91
- TLSH T1A2B0025FC202E312C14217B02A99D9FA72F4FF65C603171692E01E76DC257A05625560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 96B
- SHA256 9d89a0d23646d249f1945b18803d3c105a3bd8be3d3f1884670efd632cb7d949
- MD5 26dd72cd97eacc522756ae678b6b9a8e
- SHA1 2164d5d18e276cf7c030cbf7bdd34f9d1aa794eb
- SHA512 d43a570b73482831eca4358b36b9eadc78b9703c987ff5a9cdf7acf331ed1e68bdff51ca3dd6038d121e620288e50bb560bbb66ec56513f50dc3e5a32f8e1b2c
- TLSH T17EB0223000082322C80803F023E2008333202E0003A38A3F82F880308C00303038CA00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b4e06b7129383dc348f9111b0ed690a3df8b6d41b661e13d1eaf8f64e8fa9bc9
- MD5 801c78b194bc04d594035f700eafd764
- SHA1 8a3b2b50bc6cc89eda2a213b4e51cb69986b45a7
- SHA512 0dfd9da8cf9895e1827c2e90b3779800d5426010f748c7ab5a3a0b75e638964c8e6ac213bbaee750c9500d57692a1507c334c2d474ab62020e06c76afc579a58
- SSDEEP 3072:HGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:mm7Rkm1tYpBeh2BAoj
- TLSH T1ABC3123B5D75A83759B5BB5EB08E0A1F1EF149A6D920DE52C8D85B0823EA7CC0A05E34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 a4248f5d7df9ae1eb829b1b4921f7cbdb80ea604f7a8540b8cddf4f48519bd72
- MD5 dbeb7297c7880c1b141af754d7934501
- SHA1 9d37e358026ab81fea9ba1d9b9886eb404d3a145
- SHA512 f76b45f55e3c1724a0661c402fe6d40ee1d84870815f1bfab21112e378d7186cec0e65831ad14906325f4d81b4141fb563cd43e01ddf6de1c4e43d8fc4151531
- SSDEEP 3072:0i/z0V7bDo6H+KyysA4y0eSgVKRC5XhGm7D5Lk17ox1tIpud63U8BehbCBi9fTr6:0iUbDo6eZ43E7wWm7Rkm1tYpBeh2BAoJ
- TLSH T15E34232BBE153D765A7CB38AA0CF5F0A1EF1C7929505D8510ADA4F403BF9F5A2A04E70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 c3d2ef1d7f1305828f0c5f02adc7f5176aa734e0e432ed0cab7d7d489b9c6067
- MD5 4793985543ebe070ae4c8d045929a61f
- SHA1 644b5fbce6d2341e6dfeb4fe4c80d28002f74e8f
- SHA512 76053342fda99abc45ebd299f8a84a7e8eb04b1df7b1d00770355ff14d8cabc41342394e90d94c8a5d547db3d16402f16bb2ba5efb520d20cb5eae8b5c93420d
- SSDEEP 6144:3GiUbDo6eZ43E7wWm7Rkm1tYpBeh2BAoJ:hK3eXC9oBGcAoJ
- TLSH T1C234123BBE153D765A6DB34AA08B6B0A1EF1C793D904D8444AD95E0037FEB5A2D04D70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 1ae1e40bd334ae5731c84fd99bfe9b0b47c659cf9792682fb8e7990aaf46f89f
- MD5 a7d548e7aa489e29e940c3f19e39bb53
- SHA1 21641076364ab249665ecf5247605d66f1e8a68b
- SHA512 cd29f701514bd4d1ba2bced751d40aadb80b45b0ca0e66ce52f3ab9d16951b8d19ccb99ad7f041b0a9661c9657e862adbe5cb4802b59a07520c2ebfe1b4fb42e
- SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:1m7Rkm1tYpBeh2BAoK
- TLSH T189C3123B5D65E8779979B70EB08E0B1F1EF149A2D920DE92C8D86B0437EA7C90A04D34
- MD5 SHA1 SHA512 SSDEEP TLSH