b5b5f16b0de466644457670be44a4ce7a788a00450da79c44579e89b2fbec72a

Analysis

user interaction
yes
max time kernel
899s
max time network
888s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kian-Color-ShadowGarden.exe
Size 10.0MB
Sample260802-yc2djsfk2w
SHA256 b5b5f16b0de466644457670be44a4ce7a788a00450da79c44579e89b2fbec72a
MD5 469125f20ca9e3094266012bed5564cd
SHA1 ab9209320a84b526bd132dc3edeacf0d3b5fae67
SHA512 de3bd6026feda299bbb4ba265bca0c02805231be1cafc54513927e1aab05510655f3d5cb3e0032c73dfdacde185569db6ff63449e060179b7afb1dd39ae7379a
SSDEEP 98304:kOMh/yK/q63mEJhkQPmT+Woxui/xvxYx3:kOI/yD63mEJGjFU5pM
TLSH
T19EB6BFA9A2B900E9DF668278C6865223E372BCD507B057CB1A5856F50F63FE01F7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3492	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301731713717267"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2484	1044	chrome.exe	88
PID 1044 wrote to memory of 3492	1044	chrome.exe	90
PID 1044 wrote to memory of 2608	1044	chrome.exe	91
PID 1044 wrote to memory of 2608	1044	chrome.exe	91
PID 1044 wrote to memory of 2040	1044	chrome.exe	92
PID 1044 wrote to memory of 2040	1044	chrome.exe	92
PID 1044 wrote to memory of 3496	1044	chrome.exe	93
PID 1044 wrote to memory of 1408	1044	chrome.exe	94
PID 1044 wrote to memory of 1408	1044	chrome.exe	94
PID 1044 wrote to memory of 3496	1044	chrome.exe	93
PID 1044 wrote to memory of 3816	1044	chrome.exe	95
PID 1044 wrote to memory of 3816	1044	chrome.exe	95
PID 1044 wrote to memory of 932	1044	chrome.exe	97
PID 1044 wrote to memory of 932	1044	chrome.exe	97
PID 1044 wrote to memory of 2300	1044	chrome.exe	98
PID 1044 wrote to memory of 3224	1044	chrome.exe	101
PID 1044 wrote to memory of 3224	1044	chrome.exe	101
PID 1044 wrote to memory of 2408	1044	chrome.exe	102
PID 1044 wrote to memory of 2408	1044	chrome.exe	102
PID 1044 wrote to memory of 4552	1044	chrome.exe	103
PID 1044 wrote to memory of 4552	1044	chrome.exe	103
PID 1044 wrote to memory of 2112	1044	chrome.exe	104
PID 1044 wrote to memory of 2112	1044	chrome.exe	104
PID 1044 wrote to memory of 2336	1044	chrome.exe	107
PID 1044 wrote to memory of 2336	1044	chrome.exe	107
PID 1044 wrote to memory of 3760	1044	chrome.exe	111
PID 1044 wrote to memory of 1932	1044	chrome.exe	112
PID 1044 wrote to memory of 2916	1044	chrome.exe	113
PID 1044 wrote to memory of 3600	1044	chrome.exe	114
PID 1044 wrote to memory of 3600	1044	chrome.exe	114
PID 1044 wrote to memory of 2092	1044	chrome.exe	119
PID 1044 wrote to memory of 2092	1044	chrome.exe	119
PID 1044 wrote to memory of 808	1044	chrome.exe	121
PID 1044 wrote to memory of 808	1044	chrome.exe	121
PID 1044 wrote to memory of 4192	1044	chrome.exe	122
PID 1044 wrote to memory of 4192	1044	chrome.exe	122
PID 1044 wrote to memory of 2880	1044	chrome.exe	123
PID 1044 wrote to memory of 2880	1044	chrome.exe	123
PID 1044 wrote to memory of 1828	1044	chrome.exe	124
PID 1044 wrote to memory of 1828	1044	chrome.exe	124
PID 1044 wrote to memory of 4304	1044	chrome.exe	125
PID 1044 wrote to memory of 1260	1044	chrome.exe	126
PID 1044 wrote to memory of 1260	1044	chrome.exe	126
PID 1044 wrote to memory of 4400	1044	chrome.exe	127
PID 1044 wrote to memory of 4400	1044	chrome.exe	127
PID 1044 wrote to memory of 1808	1044	chrome.exe	128
PID 1044 wrote to memory of 1808	1044	chrome.exe	128
PID 1044 wrote to memory of 4252	1044	chrome.exe	131
PID 1044 wrote to memory of 4252	1044	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\Kian-Color-ShadowGarden.exe
"C:\Users\Admin\AppData\Local\Temp\Kian-Color-ShadowGarden.exe"
1⤵
PID:2112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9aedc728,0x7ffa9aedc734,0x7ffa9aedc740
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2420572556710879131,1211478640744010222,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,4075175548611490305,1646082736423409522,262144 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,16683585278284115257,14070079860845752679,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,14738737168170505773,17465382321684058774,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,7193952674432464305,3228901035249749268,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4148,i,12347518643365213297,17211708946496741157,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4160 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,9929403730748905442,6606713885096651089,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,14017892709257946097,11597542163603047401,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5660,i,23325102849377784,15767596930609710064,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5956,i,7915918168976200784,14868678181936371487,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4856,i,103327290887285728,6131656167442764162,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3336,i,10988636610504652032,7352875853208052153,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3528,i,8329819926745061993,14378196176335011738,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,13644066666159136740,10501437879771831184,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,14881177817427760294,4709794988948240171,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4068 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,2803787186777084225,7370679502659994876,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4840,i,17243163588318229089,11569413325820858547,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5952,i,17279716842897711876,12114479799524963609,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3524,i,13312838854723578919,15975009228547777845,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5008,i,9169380763256646053,9303976058239548194,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6092,i,16176546776377445801,18337930873062585520,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3472,i,4396955299320057432,4307169910991009496,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3480,i,12663405360842168012,11214674838382977196,262144 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3428,i,12420673871830600357,15098211029938053798,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=868 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,12978189083564131659,17989226210600689941,524288 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1168 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4000,i,4797508507536459606,2223401014515522421,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3144,i,10587957839261275307,13251328037825230174,2097152 --field-trial-handle=1968,i,5629005314953406540,3709525512709768759,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ef605e8e16ed3dedb3b94c85dd839868ff2249eb098545f1d5c8d77917bed8db
MD5 4bd49928c8446bcec27f6ab4c93df484
SHA1 ee79652e67c35fa4a69690b123e0ba4f196d46e1
SHA512 5709ca392acad199da6931c77bde2d7ac508f661bc41d358a436cc50eeb173bce0c622c88c6da6d9891572ca4428d397c9896d3c21b43db055e4e8774fea7701
TLSH
T117E022A9CE22AC3B18F91758A869470AEA42635B2641985F373D900C8FB473A8186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 21b8a0cd6b97717c65b4d07d1bcc925b48828f83f6a7e1ea97df561cf32e20e9
MD5 b4f04824a43f11412615ed03bd9feaad
SHA1 e861e60f42a42744c23b0752f4a2b1bcb76e323b
SHA512 447d308e8790f5288afc917e28259b30e3c49d5c58b3f7efd468e456712b6becca8a3657dc509e83959e2750d26903ebbd45f3722f5c799c7a73ecd1f2fe2117
TLSH
T1A151ABF3D3E8857D851162F4EB216E1FCE3A0A14431C3CA6C8D4AE5B53E2872E21538E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 06875f0fd6babe4a824ff8a4b7bbfe41dc1687eae329bcf4c50944aa69f5e6e1
MD5 37ff1da1a58e4f557f45d651c4b423f7
SHA1 79b38add7692810c5d475ccbd7d16e1955307763
SHA512 d4736be046c9ea1f8491c5dabbfb731c5104056681758acd59e50d16f645d2771732e03d333a0a339de43051a5a273900cedc6089fb8721d7cd669f44ec6bd6d
TLSH
T12D519CF3D3E4857D851162F4DB256E2FCE6A0A25421C3C66C8D4AE5B53F2872E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 72a294e64685099e652227a905babd39f91ce1d43cb302cc881d1ffe77fd6a11
MD5 13081445b3d16da56099e2e1c7523f60
SHA1 3050e20f70ab1484ed0ed7fbf11f8ef4f52199cd
SHA512 7a7f192aeef7bd2dca49c12e6824c8584093fdfabdf639cdf5b6fcf2724e5e358b6985df7f66b69aaf9eca26aaa583aed148827d05d29e942560e8695019d281
TLSH
T12A618BB3D3E48A7DC41166F4DB246E1FCE290A29521C3C66C8D4AE4B53F2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3f963f374e8a31dc6b895b58b6ce68500900d7de11435112c8143ba5b5c9cd9f
MD5 5b9b1a72a3bc06975845d87304a15f09
SHA1 6f488d7dc408ee903070205295ec1270c957500e
SHA512 ff483d51cdb58a183722952a92a1924e10b334da9a5efdfa4d6b5bcd659ac72bad9da6781231cc96939acd84a37eb94cdecc4166712f9258357360553dc31379
TLSH
T197518DB793E48A7EC511A6F4DB256E1FCE7D0A25121C3C6289D4AE5B43F2873D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4b93757a22ba95da83bdfe4490f2c4766539c04614d53993436be049f4a46fd6
MD5 bcd41a22b51fb400c06b2ea5fbfd1040
SHA1 59bebbf00c30b259b0d815f89547bdd101d91f38
SHA512 4addf1bfe391f425be46171735a7939127bffbc9dca15c7e0b7bcd496f187b832af64e794dcad1fdfec9744ee6a53274a5f55fe8ade5ffce2914d566a7b1cfb6
TLSH
T180617DF793E48A7DC511A6F4DA256E1FDE7D0A25122C3C6188D4AE5B43F2973D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 666424c31ced272e02674946520decabcaadb1e6a6868d53dc19bae78bcaa924
MD5 de5cd6bed6ae0f6afcf34fdd260a9442
SHA1 a7141770c622a3b668a06a5714a0c8c9d089bd93
SHA512 723f0eb18ace67898e64918d616c25ae9e910aa53f41ec1ed548779b40b690728052403e8360dfbe5c0bfc11a16b300522a0da3c7199c5431e4e75a867ba6af7
TLSH
T186519EF793E48A7DC511A6F4DA256E1FDE790A24032C3C6189D4AE1B43F2573D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 c546570be33570f5bde47ee93db33597bc27826c665fa5ebb453fa8a5816dea9
MD5 9a0d99655c31a63d054402520cd9c7a1
SHA1 fb00fb20e782ff20c8c4c29de75b23fb484346b5
SHA512 7f369cee7abb1ab916a26caeee59cfe1c2024ab604a9efcc2d666d7ae33f66fae609a46cac3cd70940d24cb482ef3f722aa5d7387fbac697ed21cc7d110a0685
TLSH
T1BAF059A7A63A706300B904BB1D00B849267AB87505816CE8DF9AC22CD0905E31B12057
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd1d788a12ed9511d856f7b812bccb0dac055e4de69902225e7d3c9000263b37
MD5 48c9c05acc59acfb408c8bc29649bc93
SHA1 ab7b25b1f88c21687265907a20b1e41f7ac31b5c
SHA512 d439bb34084a69ac2433120ab2e73adf6173e480ad087c184b1dd5c4c2bcaa8643e9b949903647596581cd6f297d21438e2f832d915748107be32d185f248c1e
SSDEEP 192:mR2ER/I5Rj5HTv7MF+pAPRp2S9HHIMb+WNnUz06S2d1HmraGwAVyIsnAUgtaJ:mR1RERtrgoUX91jg0l2d1HiaGz8
TLSH
T19442C72EAD1079BB6CCBC269FD127B57E7F5102221C42E94EAFD892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bec7fe04823a26511e1cc39e9f99851bf027396484805540cd0d41493dde489a
MD5 083a99809659491e2f88607d2c27376d
SHA1 7ef8e8a21f5b500ed71016cafac91e4971c0b900
SHA512 1ae87a1fce7fe3401def5556928d7ca0de1fc83b043bf6478290ab6ca51279c4b7ccb11549fc1de4c9a87aaf8f56e3d95e05223f07a0752e47a6078370a02bff
SSDEEP 192:4R2ERGs5dhv7MF+pRPRplV79HHIob+WNnHUx5O2RS2d1HmraGwJVyIsnAUgraJ:4R1RdxgovXP1f062o2d1HiaG+e
TLSH
T17852C62EAD10797B6CCBC229FD12BB57E3F5103621942E94EAFD892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c57f2a7c78ceed49da55ec109318d49d9a817effebbcc9b52dc1c5e2fba72783
MD5 3ec8e7a4795f00f562d0dee9feb984eb
SHA1 86a8e68f544769d2746c81ee95e040dfb657a207
SHA512 39c27dbdd1f6a2c220fa99c7e460063d713819ee25fa1283857159e6a5a1a5d55c1d435588f2cd74e488adf135bffeaa14ed09c91fafcc3bdc1d0d108e65ce21
SSDEEP 192:4R2ERGs5Mhv7MF+pAPRp2VS9HHIsb+WNnHUx5O2PS2d1HmraGwHVyIsnAUgraJ:4R1RMxgoUXb1r062K2d1HiaGCe
TLSH
T1C852A62EED1079BB6CCBC229FD127B57E3F5102621942E94EAFD892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e56fa8b98ca74a844beea764907831207638dae2ad2b310ba723c83d3f9c2635
MD5 d2c0ed21ea130a5a22bb875012894989
SHA1 7d9019f53f33f5dcdeda6aeb981469e0ffad6c6c
SHA512 d417a2bf251a29647986b717b9cbd06fd820490c9567fa2685a89be1ba7048415d7e5e710c10678d42d19e2d1098471ed330bcb8af3f7d2955ecab363cf5139c
SSDEEP 192:4R2ERGs5MTv7MF+pAPRp2S9HHIcb+WNnHUerS2d1HmraGwAVyIsnAUgtaJ:4R1RMrgoUX9170em2d1HiaGz8
TLSH
T12042C62EAE10797B6CCBC229FD127B57E3F5103621942E94EAFD892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ec315d86701679467c83ad0a3036e22e4fbc56482f9a317fb830e5321acb1c7
MD5 66db3d979b658c0d7e55a1e4cf4dc5f3
SHA1 1304328f04e91d65f09278cb3d922735381abb20
SHA512 625bd276f280eeedf95c23f24f9a44428c48ab2988c123923dcb4bcd8220940bffef670c71f1f4b1d626a0e7efba20be4f2912b3eae79b0e885309a6277418d7
SSDEEP 192:4R2ERfs5dhv7MF+pRPRplV79HHI4b+WNnHUx5O2RS2d1HmraGwJVyIsnAUgraJ:4R1R6xgovXP1P062o2d1HiaG+e
TLSH
T1EB52D72EAD10797B6CCBC229FD12BB57E3F4103621942E84EAFD892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9f51aa2b6f3eea10ed875f9da798076e493d4294ac05cd9a99556b4dfdcbe345
MD5 a9582a661c4d73919a66ab372d2bb36e
SHA1 7a5cfd95425f65eba8f2eafdfbb67ef75737b4d8
SHA512 03cf9d248e18ed8c0e39bd9c221c1cfd149990c4423a72efd7b790518123fe4d74830510f961f42bee7318a349173ab5f5358152549d08185388ce4c1d634856
SSDEEP 192:4R2ERGs5M9v7MF+pAPRp2S9HHIAb+WNnHUx5O2PS2d1HmraGwHVyIsnAUgraJ:4R1RM9goUX91n062K2d1HiaGCe
TLSH
T1E652C72EAD10797B6CCBC229FD227B57E3F5102621D42E94EAFD892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1e9bc368466dc37876ee725c236228ff299eb92bd72ec9de946616b346822c9a
MD5 c2acf7245d11060624b8e536d69a3ddd
SHA1 d9b2896cc776f93de2627056768fe845763b1a5d
SHA512 215b8625baa40a1e8b12978abee284884ee440d18ed8e8873acf8e5f6cc5083f08d35e5b4db4cae9726c2b735f3968bacbf79dc91a7ff0c20f26a1b9db6598c9
TLSH
T11AB01251A0815182C44202F01283148C711C5F11961E270143F0FA62CC2D2618014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58879a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58879a.TMP
Size 96B
SHA256 7b8160be8877979ad4b341d4a43ba74d3f4c8eb5fa993d7bbc109c007e985df4
MD5 8628c51e92b18a749f111f171aade59b
SHA1 36cb8ab2d12ad5bd05890389b87e5978726713e5
SHA512 db92217309280401744e9caabff53cbac8bac6cfe5fbd251aa02f79748bda7c162fcbaf7b36a7c1953d0dce161d3d1d975a1ff6f3672f326984522da6549c2b6
TLSH
T155B0025AC1836213D08203B025E69AD87161DF25C617121392F45A77FD296795925161
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 87692e8961e00331de997598ac632eec31593caee3cfa29c22c02677c8405b6b
MD5 30dc4ea83be5c23863beff4647b55e06
SHA1 82a6f5d7b702004d85324d01e2d4fbf0e49b49d3
SHA512 bce1d9044ee81e73349ed0c53aa418fe9db81bb0aa6284662e14b3b47a1f94b45522179c9b72c25c117590646f3ae11d95f8e1ff87df04fcb892c524ca00ddb0
SSDEEP 6144:tT8i0Aw9NDv+qw5ZtAem7Rkm1tYpBeh2BAoC:tTeNO5Zty9oBGcAoC
TLSH
T1D43412375F22DC779AD8666A600F4B0F1EF0AC2AD914DEE798C47B0853A9ADD140E534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 974b0c5e5d5f2a84ba47454e0d00354a4277017955f320fa9987337ce53a9839
MD5 8ccf8abdadfee1f5da37368f3cc71aaa
SHA1 89841c987e7f5f4c99d895e13f770ecfb1b49796
SHA512 bfad96376b4624bff67243b961fe42e05af9c59291db542a1eacf60a7417464a6c33fa8c2a7affc7111a15b9ff74d89e17b8fb8b4e684cba8b2f9b376b81c460
SSDEEP 6144:IKm8i0Aw9NDv+qw5ZtAem7Rkm1tYpBeh2BAoC:IneNO5Zty9oBGcAoC
TLSH
T1AD3412375E22DC778ED96A5E600F5B0F1EF0AD2BC914DED698C87B0853AE69D180B530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 449084ad264485a3d0e70ef98b3fb3ae27e10e5d37904d61bc9657df34d28b8d
MD5 e75c39fa8676dbbb2b74f1cd35c33deb
SHA1 1cbc1985087d63eaf1956be5167e68ed92d2f659
SHA512 e97b460f53af3cba5fe8ba3e2ad2659030d27bd6b532fc46b2298920109ca19382fc22c57b4608c55692d1904697eba9bd34484f8eab0404ed0973788d80911c
SSDEEP 6144:cKm8i0Aw9NDv+qw5ZtAem7Rkm1tYpBeh2BAoC:cneNO5Zty9oBGcAoC
TLSH
T1D43412375E22DC774ED96A5E600F5B0F1EF0AD2BC914DED698C87B0853AE6DD180A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 201ca7f77e3d2a432d7f1266dc0abf7bf051c256e8d9bba3dc0410296d25a8c5
MD5 85f406632c541aaaf81b867eb843acdd
SHA1 a15a6b914f07921f53e51e4e01ba358fd3adfdc2
SHA512 1fd5d994ef4b95fc2408e1c566e8b3e76ddec9f287d265880ff7fb55f680a3ef48db7f63c5f280eccb35021e990a85f1740ab3f284f67b7edaadff2b197cda04
SSDEEP 3072:/qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/tm7Rkm1tYpBeh2BAoM
TLSH
T15EC312275E75E8375878BB4EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c2a5e05108b441c8b6667c5904845c0881252fc606e3780d19ee7c36d07cc901
MD5 553d54050a21cc485be094ea441e1dc8
SHA1 f17e25fa4a58562cff7ff2fe5ab8cc38094b940a
SHA512 91ae2540f149a1493c8fd2e2a78506e15076fcf7e73c3a38763fb350d18cfc73056f982dcef0c4a6852553121ef3f7574e3661c78ec4f9c06c817fc93bdd8f15
SSDEEP 6144:tH8i0Aw9NDv+qw5ZtAem7Rkm1tYpBeh2BAoC:tHeNO5Zty9oBGcAoC
TLSH
T1523412375F22DC779AD8766A600F4B0F1EF0AC2AD914DEE798C47B0853A9ADD140E530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 e9de340ecf9de407abd29cf8b343508a9d40644368b99706fcb195d6dccaa8f4
MD5 c7bf06d55e381c20f73aafd7e56a72c5
SHA1 31bcb2d62c69693848e484fdcfe7ffb4cd2fdebd
SHA512 13c2d429dc78af1765979325436fc35269c331bcf23fdfb29eb99acc77dd2bf663757508e1ebc442d5be8648139726f20f93cef6194a8e472be291e30f4f76d7
SSDEEP 6144:cH8i0Aw9NDv+qw5ZtAem7Rkm1tYpBeh2BAoC:cHeNO5Zty9oBGcAoC
TLSH
T1EF3412375F22DC779AD8766A640F4B0F1EF0AC2AD914DEE798C47B0853A9ADD140E530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download