hxxps://pixeldrain[.]com/u/VGDCtfTA

Analysis

user interaction
yes
max time kernel
170s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pixeldrain.com/u/VGDCtfTA
Sample260731-cv1dbabc48

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5808	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299382923604355"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
480	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	OpenWith.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1840	4956	chrome.exe	88
PID 4956 wrote to memory of 5808	4956	chrome.exe	90
PID 4956 wrote to memory of 1952	4956	chrome.exe	92
PID 4956 wrote to memory of 1952	4956	chrome.exe	92
PID 4956 wrote to memory of 4976	4956	chrome.exe	94
PID 4956 wrote to memory of 4976	4956	chrome.exe	94
PID 4956 wrote to memory of 4132	4956	chrome.exe	95
PID 4956 wrote to memory of 4132	4956	chrome.exe	95
PID 4956 wrote to memory of 4304	4956	chrome.exe	91
PID 4956 wrote to memory of 4304	4956	chrome.exe	91
PID 4956 wrote to memory of 4424	4956	chrome.exe	96
PID 4956 wrote to memory of 4572	4956	chrome.exe	98
PID 4956 wrote to memory of 4572	4956	chrome.exe	98
PID 4956 wrote to memory of 5680	4956	chrome.exe	99
PID 4956 wrote to memory of 5680	4956	chrome.exe	99
PID 4956 wrote to memory of 5920	4956	chrome.exe	102
PID 4956 wrote to memory of 5920	4956	chrome.exe	102
PID 4956 wrote to memory of 3772	4956	chrome.exe	103
PID 4956 wrote to memory of 3772	4956	chrome.exe	103
PID 4956 wrote to memory of 3724	4956	chrome.exe	105
PID 4956 wrote to memory of 5068	4956	chrome.exe	104
PID 4956 wrote to memory of 3724	4956	chrome.exe	105
PID 4956 wrote to memory of 5396	4956	chrome.exe	106
PID 4956 wrote to memory of 5396	4956	chrome.exe	106
PID 4956 wrote to memory of 1372	4956	chrome.exe	107
PID 4956 wrote to memory of 1640	4956	chrome.exe	108
PID 4956 wrote to memory of 1372	4956	chrome.exe	107
PID 4956 wrote to memory of 1640	4956	chrome.exe	108
PID 4956 wrote to memory of 2640	4956	chrome.exe	109
PID 4956 wrote to memory of 2640	4956	chrome.exe	109
PID 4956 wrote to memory of 4504	4956	chrome.exe	110
PID 4956 wrote to memory of 4504	4956	chrome.exe	110
PID 4956 wrote to memory of 800	4956	chrome.exe	111
PID 4956 wrote to memory of 800	4956	chrome.exe	111
PID 4956 wrote to memory of 4800	4956	chrome.exe	112
PID 4956 wrote to memory of 4800	4956	chrome.exe	112
PID 4956 wrote to memory of 5548	4956	chrome.exe	113
PID 4956 wrote to memory of 5548	4956	chrome.exe	113
PID 4956 wrote to memory of 3572	4956	chrome.exe	114
PID 4956 wrote to memory of 3572	4956	chrome.exe	114
PID 4956 wrote to memory of 5336	4956	chrome.exe	116
PID 4956 wrote to memory of 1088	4956	chrome.exe	117
PID 4956 wrote to memory of 3388	4956	chrome.exe	118
PID 2816 wrote to memory of 480	2816	OpenWith.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pixeldrain.com/u/VGDCtfTA
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffec7e3c728,0x7ffec7e3c734,0x7ffec7e3c740
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,8854062002759523180,7480061686986100977,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17976197473719643054,14227604299150193518,262144 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,9659353813524201864,10558183064155934351,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,16227671574130948489,13517285410584764792,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,1968786909627452590,4731107366000265031,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,12379680260008159466,15140328356090440885,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5288,i,11689398899159413928,9551203362048439891,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5332,i,8758179650920806286,15231804998608070111,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5308,i,1506824498084481367,11577470549908621997,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5848,i,14729271212804272280,7419199741092262814,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,4227548919537672997,2874028034877210883,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5628,i,5252855952633220687,16230412576400842731,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5488,i,10256329945235512769,4546980666038516536,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6332,i,417359658951908859,14684526820756024269,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5996,i,9808372636291160185,13406472279011609189,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6188,i,15143040938577966039,14240745046713872609,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6528,i,1671077468655923481,942936385583078046,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5964,i,2921725685621335671,5753373005346914220,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6824,i,1099698269318222593,14113429661041842885,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7048,i,13788686183115513520,2818526701750056201,2097152 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,1103216019614038680,4885056035597666033,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6920,i,3568749463737842095,1798086403434942262,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,11180195705806592813,9400229844847844395,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,18048430295704097196,16507527716708673710,524288 --field-trial-handle=1928,i,11389255193993122485,12879211263403234667,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:3388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Glory\Glory.sln
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1f7606af8b484b6dd9648fb59de55d06fa409581b4ea192380603211ea1f3343
MD5 8c30ceacab9135f6a8a30077d9f03851
SHA1 f0921473bfce4265b4805f5c65ffb38b69c3d6d9
SHA512 1dfb73f1acc6725cbb7c0542f91c45612ebd19e2c6ccd45632e75ab48c9c62854e15db8fc17331befabaf3ee488ef984bbec44ce9196e9fff18068a38dcaf87b
TLSH
T113414F1263948AC0FFF50439C4E21DD72A3E865621531FC3C187A6705E4B3EB60C6486
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a09d0bf33569e35551811faa20bb8a57b205a27b0f5f1dfb9a53c3066d773028
MD5 44a1ebc1f6c15ac99ae119792055d439
SHA1 367e82fd12eefdda2ad42ec2c82e328697d8cc61
SHA512 8dd3c2977948663d2db6043719231adfa3947dbe0d6c9ac3d919a56cf19002acbafee9f1dbb68304fd16a24b35ddc6af1293f067701e05b49b61f73d45aa4dd9
SSDEEP 192:DRpCTmTsnW+k+2+7+yvgvzpvi+jn1D0gymCLVZpefXNPKq4EEDF3VOA0ugfRDfK:DRU6IW/TEro7kI90gymCLVZpefXNyq4h
TLSH
T12E129EF3C3D4C62DCC5166F59B257E2BCD290928522C3D26C9E8EE4B53E24B2E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b7e77e9b2ea22c5cdc19fed5ca64cd4fc7a901056c55df83289c330b1f10150a
MD5 b971745e5995d4c995d2be77c06ede97
SHA1 89d5ffd843746c052f0a5b58dda683eeb70d541e
SHA512 d9d6aea5cc6d7c876dd5216cd5ea47b1ff9cf1000086120fea844683d3c136d55ff9820dd91145718322d34400f2235df5b9e55102022f890727aadb7d44b870
TLSH
T1ED2125EB91BEF4976128C8AF09487C066DBEB43293506CF4CF6EC16CA0829F35A02457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a6c5868d1bc1b82dd77ba8ea346f9363719d3d1dc897b14a6c009a2d4cdc9d72
MD5 98a21f04af2065bc1075bb7f059f40d4
SHA1 4b6fd44969ae95885a94a0a7cd9d516eb201d37e
SHA512 8a22555bb80d28636aa5931cfdb192d24f725343b7d63318df6f421933027ad08ac788ab118deb96542ce135313546a6187341b1794a0574837c526c63c7311b
SSDEEP 192:dRhrb4CMv7DvAPRp2uhme964Hsb+WNnoxDm0CZ2Cxue72waPVyIsnAUge:dRhPBYH6XNFbw202e2fpe
TLSH
T1B732B63EAA64697B6CCBC21AF9217B57E7F5102661902D84E6FC892C10E76CC7227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7bd39629577ef99815348f89033a24484b151c603e1390783a3c4342bc792ff0
MD5 c43831b5395f99f99633c09fa62b86b6
SHA1 94080e2a5b5cfa6d8fa595ea3474288d2e448baa
SHA512 cca8a35bf86687c6b5a25a428310490612b578d61a6a2cb3a508cc4147da0dd4bb5e90a5cafdfaa9634a550f7b727e0ef369608635ca680ad9a5a23986747dcc
SSDEEP 192:pRdcBzrb4QMv7sAPRp2Enmhme4964Hsb+WN+F+I46m0CZ+9a2Gue72waPVyIsnAC:pRdmzPZYBX8EbwM4DX2c2fpe
TLSH
T10642A42EAA64697B6CCBC31BF9217B5BE7F5102261902D84F6FC892C11E76CC7213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e52a2db5cbb4a530f9ba7c7bf901241456500cf92877614d93cf4f3a2651aacc
MD5 7a8ed0f822ade0bb728605af2175affd
SHA1 a7424ea16dd91deca1e3cfe0d99a5f41c66db00e
SHA512 8efe32b3487008049fd8df033032b603b89483694a3c01370b3b29e28eee2ea4e7af8a3ac8f4d3a596a75be816c78b68e06e74f28eaf2a54e650ec4530a44f6a
TLSH
T1BAB012108057A530CC0A80F01206104D31094E21C000424BEBD0F6E688B70E18116100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e34bc28d217dd39c810ca6aefb849e6f50b359d08d721114769f922dffc5676f
MD5 f480163be78aac5bebeab002cb3eda12
SHA1 f914695b33ea454ad594508813a7056b89fa782c
SHA512 15a255a7f6c07800a43a8f09d65fb38e229104f4bd09deb25a6dca87d20413b7bd47e0d697f52822c983c93fa4b75312983b2b295e245d4572947fa8479ef904
TLSH
T18AB022280C8008F2C30E033022C02AF033B28E0033CECA2222BC32AB80022C22320208
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b4efd4873fbacba15d9a885d49b3ed553ba095b47619b4e3f455a848553a96b1
MD5 e4d69b1e73b26117e180da6f3c033ddb
SHA1 1ac08c35e81a7c9e66c41a291a4f8b02f4ae3354
SHA512 bc10716a164426f2f917a7728af02cd1a8b2fea1b2f44ed2fd77bc45b41ab3a422d5b445a0cab6f3aa6b19243cb6bfaae948c6fcabd59eba0e6dc5050ce88209
SSDEEP 96:CC0d+cAOIt5aDVmufj7tcsSSl8h4otop5bwDjB6rGGfv9JtFiO0AuSwPSDozr0jV:CC0LA/TE57TuiU2y9KvjtFGSwPSDozro
TLSH
T118C13A75B8AD6D731DF69652F1427947CDB8A157EA626E908DEC0F0C11C30DC2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a5864f45fcffadd29bca0799a6ed4e686b3fe566942ffb963a223cf4fe6710d3
MD5 8e4c87568cb304fd2e0e0bcd27ab024c
SHA1 b5b3db0fa46088db74cdf5103e16194d9cdba87e
SHA512 303a685433dea20b228deaa61fef50e0205db5d92afe7c90cdfe416fd7fd938f5f2c7231d327f96f1d36a48d77adc8a188e85fccf1c4925046f8dba63fd67274
SSDEEP 96:CC0d+cAOIt5aDVmufj7tcsSSl8h4otop5bpDjB6JGyv9JtFiO0AuSwPSDozr0j9P:CC0LA/TE57TuiU219l+tFGSwPSDozrUP
TLSH
T170C13A74B8AC6D731DF69652F1427947CDB8A157EA626E908DEC0F0C11C70DC2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d9eadd81aa3725758a67884440f8659f4d920407dad91104097ffbe41e8f8715
MD5 8fab229bda8382ef05e9ddfbedfaf70e
SHA1 1037293306d1dcbac1a13a05c5e470a2b0465a13
SHA512 39e3093be19a6959e1eb90bfc804bd7dad7ce2d7ce509ff32e541d8959f61dd516714fe344018330b8b9c2290a2d2e9249ab7e7ea308f574f57146b6d050ffc7
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5bCDjB6/dGyv95Sohbb2Jv4a:gC0LA/TE57cDUDA9UweSohbKl
TLSH
T117A1F971B4A95EB75D75C685F4827E83DF68A117E9216E80D8EC1F0C11E70EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1d619f86672072ca6bab2a909b4a9b6a463389f527540f1cbdff01dd166fbcce
MD5 1473209719a589e29465f4df02ca3d88
SHA1 7c1f5f12412af2af6d0a68ddae8e02083f74fdcc
SHA512 e68a0d0c26164e66c45736d5ed6afb4b8edd9390774f1f586f1bccf85884bcf52ed118c3dee0f5dae6e2eda568ede9b98703e5ce46a7420a02d27e9ffba8daad
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7tcsSSl8h4otok5bdDjB6rGGfv9JtFiO0AuSwPSDUzr0h:Ct0LA/TE57TuiUDp9KvjtFGSwPSDUzro
TLSH
T17EC13A71B8AD2D735DF69652F1427947CDB8A15BEA626E908DEC4F0C11C70DC2343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 a4e59ca2c91590edf85713655b0770bec34f4c2b42c5cdcd0d1aa6ee0536af04
MD5 bd9da78076c573e98765a1343eae9f27
SHA1 f404e0baf34db688db7577ca292095d4dce40e46
SHA512 abb15d59827cf2d4c2f44fa9927f73bf8a82024804473af5c25bb8ea6ab76048cff8fa9b5b7622d3fd24a26ebabeb312de30a6d8c73a7a90f3645e76c237be29
SSDEEP 3:MsEllllkEthXllkl2zEkl/Xy:/M/xT02zn/y
TLSH
T1D24404447FC00445D5103030D013C3510774D51415315F4334D10433DCC57410C10011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glory.rar

Path C:\Users\Admin\Downloads\Glory.rar
Size 5.7MB
SHA256 57a8073e57e0ef129c67c9986e934524a93a19b0fd8af06c9debced47550654a
MD5 9f2a8778f546184074f29b540ab54bf0
SHA1 2541739d93690b457a4b901bc6c2be714cedab22
SHA512 5c8ec1d6e6eda536bdc2401855dc65f7b8645c8ec31dd5bd78851dcc78a5c7d4ee179e03ff001f609b640340d4bd4c5569ddd43d4e0ff23323050837320b315a
SSDEEP 98304:PGLf2sSNdTwCGrNpCMycN+dSFV6a+I5MNSadMEOlPtPFKbhDsmeRRrGmUzNka0:PGLfvUTw9vCMycN+dS/88M0CMDlh4FDo
TLSH
T1DE5633AD46C89535D14A3EB028918404ACAAA8A9E614FEFD7FC6CD70FE181D61DCDF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download