b1a6ccd4b0366bca7c255aa0307d02456d60d8b009c2ee7aa860c55c53da3db8

Resubmissions

07/08/2026, 04:43

260807-fcdy5sxeme8

07/08/2026, 04:30

260807-e4w4csdh958

Analysis

user interaction
yes
max time kernel
592s
max time network
593s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vape v4.21 Binary.zip
Size 19.4MB
Sample260807-e4w4csdh95
SHA256 b1a6ccd4b0366bca7c255aa0307d02456d60d8b009c2ee7aa860c55c53da3db8
MD5 145e437dcbe0a4576774976fa0f78513
SHA1 1df6ca068a2c4d32270b474ac068af8638e69775
SHA512 422a3b9f150ecfd62c0a4dd87cf972fc9a554407125684844fabc697fb668942086e98c633bdf222c60111b2075958e6e37a88d27c5b76274aed9e5fabf7416c
SSDEEP 393216:Y6qe1uPl8i9TkrBGQ1bIR2/lJFW+IwdGWv7g+WWi1Sky/+UIRd8uc:Y6l1uN8i94suIj+RVGdQx/Rid8n
TLSH
T13A2733A54522272D9549618C264B1530287BF37FF4937B22A22AB1F8F2D47C6B97DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
56	5724	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
108	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5724	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305506601754396"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4808	chrome.exe
4808	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe
Token: SeShutdownPrivilege	4964	chrome.exe
Token: SeCreatePagefilePrivilege	4964	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe
4964	chrome.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4460	4964	chrome.exe	80
PID 4964 wrote to memory of 3816	4964	chrome.exe	81
PID 4964 wrote to memory of 3816	4964	chrome.exe	81
PID 4964 wrote to memory of 5724	4964	chrome.exe	82
PID 4964 wrote to memory of 6092	4964	chrome.exe	83
PID 4964 wrote to memory of 6092	4964	chrome.exe	83
PID 4964 wrote to memory of 2852	4964	chrome.exe	85
PID 4964 wrote to memory of 2852	4964	chrome.exe	85
PID 4964 wrote to memory of 5968	4964	chrome.exe	86
PID 4964 wrote to memory of 5968	4964	chrome.exe	86
PID 4964 wrote to memory of 4260	4964	chrome.exe	88
PID 4964 wrote to memory of 4260	4964	chrome.exe	88
PID 4964 wrote to memory of 5492	4964	chrome.exe	89
PID 4964 wrote to memory of 5492	4964	chrome.exe	89
PID 4964 wrote to memory of 4500	4964	chrome.exe	90
PID 4964 wrote to memory of 2360	4964	chrome.exe	92
PID 4964 wrote to memory of 2360	4964	chrome.exe	92
PID 4964 wrote to memory of 1804	4964	chrome.exe	93
PID 4964 wrote to memory of 1912	4964	chrome.exe	94
PID 4964 wrote to memory of 3660	4964	chrome.exe	95
PID 4964 wrote to memory of 5976	4964	chrome.exe	96
PID 4964 wrote to memory of 5976	4964	chrome.exe	96
PID 4964 wrote to memory of 2496	4964	chrome.exe	97
PID 4964 wrote to memory of 2496	4964	chrome.exe	97
PID 4964 wrote to memory of 2440	4964	chrome.exe	98
PID 4964 wrote to memory of 2440	4964	chrome.exe	98
PID 4964 wrote to memory of 4808	4964	chrome.exe	99
PID 4964 wrote to memory of 956	4964	chrome.exe	100
PID 4964 wrote to memory of 956	4964	chrome.exe	100
PID 4964 wrote to memory of 5792	4964	chrome.exe	101
PID 4964 wrote to memory of 5792	4964	chrome.exe	101
PID 4964 wrote to memory of 3392	4964	chrome.exe	102
PID 4964 wrote to memory of 1660	4964	chrome.exe	103
PID 4964 wrote to memory of 1660	4964	chrome.exe	103
PID 4964 wrote to memory of 4984	4964	chrome.exe	104
PID 4964 wrote to memory of 4984	4964	chrome.exe	104
PID 4964 wrote to memory of 6040	4964	chrome.exe	105
PID 4964 wrote to memory of 6040	4964	chrome.exe	105
PID 4964 wrote to memory of 1548	4964	chrome.exe	106
PID 4964 wrote to memory of 1548	4964	chrome.exe	106
PID 4964 wrote to memory of 4288	4964	chrome.exe	107
PID 4964 wrote to memory of 4288	4964	chrome.exe	107
PID 4964 wrote to memory of 3360	4964	chrome.exe	108
PID 4964 wrote to memory of 3360	4964	chrome.exe	108
PID 4964 wrote to memory of 2532	4964	chrome.exe	109
PID 4964 wrote to memory of 2532	4964	chrome.exe	109
PID 4964 wrote to memory of 1036	4964	chrome.exe	110
PID 4964 wrote to memory of 1036	4964	chrome.exe	110

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Vape v4.21 Binary.zip"
1⤵
PID:6120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9b2bc728,0x7ffd9b2bc734,0x7ffd9b2bc740
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,5128689326814649174,17259405138228073080,262144 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,12926908512250481824,9919699412109733256,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,3047433648144855169,15510326806397360812,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,9804005558230383264,3491271584062578883,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,7330927406405422770,10541791340548093446,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,503501089488170488,16384354835749330480,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,2364413279631280330,9582224543910048408,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,7602512075518539481,395204984731733796,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5672,i,2523323560803182746,14925856228535868865,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3532,i,11647634409552565912,5703385084790938805,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3192,i,15804082999179387209,10484143144518289207,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3548 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,6545025965245792910,17520915209674369466,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=876,i,16517621636290120352,2568929521967615932,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4424,i,8777906394531727826,15706901026506125121,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4744,i,9162866145185739693,3528149892422705359,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3356,i,8560761862115771394,10608189268315194040,262144 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3684 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,10694984157113217348,1616580586219595076,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3108 /prefetch:14
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6044,i,11242894789745502186,12042794361049162419,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,11245002538263063130,1423487024486035838,524288 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6028,i,10917916378722454839,1889704972217695981,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6016,i,17888211112122458434,1771695202656905522,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5680,i,6040341008309975874,11224943515920496089,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6124,i,11727806828790320480,3872134889732019619,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6180,i,12557332796436765907,11958607972612947741,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6028,i,12588131021843276890,9041740312135701665,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5888,i,12116555895387685782,1684614732284083185,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6236,i,10371835191722333499,13724447762747959790,2097152 --field-trial-handle=1948,i,5117846874594860411,1648918825669658225,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b46ac3f1e7d246063739afbb240b5830e27aaa3291c62c8d543d1fd9691dcf46
MD5 8b4ac478d38b3aee6b562d2646449c2a
SHA1 dd51a9a1ec471983a95bb9d69854860212a9b10d
SHA512 c96394effff11647eb3992dcf33bcb5e81e2e134ca57709ccd0fef2c0dbd1237af6e34bd743c793a8f95b4a47d92a0d98d50358cf5f363411128f9b142a68d56
TLSH
T101E061BACD21AC370DFD4B1860105745F781135B36914A1F3A3C911D8FF463B4655C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e8c0d5df19e9e2d8c133b0401fc14cc2b992f774983e30a6ad05ad4d9d8aaa03
MD5 e90a22d10f7e50d88de5a1d16091e189
SHA1 c3c96688b43524547d469c5fdc7402a5dd32e2c6
SHA512 b531504a87c8031de9b7695a8924a5725cdd3fa7875a01b1d8d9901904d74f22707ee0b7000fa2243f21bf50aaadb51fa939ace57c5bac8f6f748824b097341a
TLSH
T152C09B2C40440945D32CC1B56592180C35503D6475D1459543C1F99E457BA555A13504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 30bbd41d9a4bdb25b93a29c70d9a8f5afd136ea93bace76d9a11a5ba432afafb
MD5 81825315e4c1db3f1df4f0626bb26379
SHA1 3b620eb479e163eee1dd3c32d8c780ed981c3408
SHA512 d4422dd8653d805f860b97363c7a7d88f23752fbeb5254777a9d2f7599a6e4a60909b4e53272c2dd6f88df0c83897d7d0fc401ff6acc7ae0d6cd01b2b6dba72a
TLSH
T138C02B0D80805804D339C2BDBCF32C0C17403D8876F1215E02D4ED4A40BF4E14432088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2171ab00d8fb77c8c9b32b42c624e39126159990e7d1efeb27b549442cfadef0
MD5 3e23097a7d1955cfb1071915a23556ce
SHA1 a50694f53cf4bb30a51bbcef1a4e8aed0a1ec230
SHA512 9c77a0d98991f75f0e108e7e4e75e422cad6f45794e55b70ec89bf9937e45b4e0527da6b1468c7e19450c33d86f58d6fb519c8f9f3d458c946c189fbfedb5ea5
TLSH
T1F231111421598474FF40F675CCC61438B7600A72C4C7FAAA29D14E66A9FFB7007030C7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ef2da2641e48cd39c33d058d8bf33f915cce9380a28ef7aace4f37f7beef9b7f
MD5 58413ca906a7b3eb22c5e05c35f37d21
SHA1 441f8da39a80add8ffd68e179e457e0cf7e835fc
SHA512 9199bceb4d3ec92caf4fe99d0fd50529156df6efe5801743294015ff86c5c4632419d200e457497bab39aa217b65a7e19a94c22ce2deb87261f0c83445220950
TLSH
T16C310C1421599574FF40F634CCC61438A7201AB5C8C7FAAA25E24E62A8FFBA007130CB
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1f791deff889f3b413062c3582a60db778ff917c1994819b0c9adcc90894ab86
MD5 4a2f7dd89fd7cb149d842bab84fb6ba5
SHA1 2dca5f56d0274b2a676d816ac75b9a7d7f252878
SHA512 ba2340cd968766eb24b537f5e70ffc64836e8b4a33cd05061f12671211ad23815824c2faa97b0686f957342428b0d35f5ab61b053ef391e2165cb18c3f0c2630
TLSH
T111716CF7C3E8857D891156F4A7256F1FCE290A28431D3C66C8D8AE5B53E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 77704b49e83272e45e797b6d6d09d6bba5ac2d3267fb03368cf9783557e75eb6
MD5 0312a4801fddeadf38eca05d53fab51a
SHA1 1427e03bb1700bad167e41fff022ce5c3d5cc4ed
SHA512 9575b723067a203c1944db6b393a385853792a4e39a00c22709b0c0d330fa63841f8f31daf4b244d5bdaadae63bdbc45e54629935f4bd22615d8c282a4362e09
TLSH
T1EF819CF7C3E8853D891156F4AB256F1FCE290A28432C3C66C8D4AE5B93E2872D21175E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 8d2557cc4c55aa494bf617c04ec21eee447f8755949317b1d1c5a66662ec38b1
MD5 4800f30764e3c64d932222d4133656e8
SHA1 505a24ba0e7dc2c79c035869b74fdbafa10d3618
SHA512 e5b21e3ca742bdd61e3ccc8363f0a05679ad416a67c73b2050a8ecf01cd0174c9ba0c04c52dbaa967d7d95ee9c7da4d66b3c63b954bae1098d23602019c57520
SSDEEP 48:YALlqlqshbxhyhGhdeh0GaXYfoKsAgmzsHfscosWKsIqzs2qsx+sWjsxtsVJzsPB:DOZRxI8LeaGaIP8hGiWfEE+0mTkNPl
TLSH
T1BCB17DF7C3E8C63D891156F49B256F1ECE2D0A28432D3C66C9D4AE5B93E2872D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 f3d2403e6bd4f409dc41e70a2323f48d5c0076cf24fa7a3716c7ad411c8c237f
MD5 8a18063cbaa281d845f65ca7c332c383
SHA1 c3a1a2dcef25b09881b893b1f2f218c5bddc32ac
SHA512 23333642280b77614cda9c335d8b9dbd34de5bd6327d80e1c9a86db97870e1a68a97d60453be2cffd493b9f58a720c4505ebdab36426f8da166362bf3e1ea14f
SSDEEP 384:DOZ3I8aTcZxONpcWJuJoDlJaIP8hG/EfR+b6Yv40AUIlJE2SjaN8fkIeIEIz+Nbo:JYnjqfh/OM
TLSH
T128528EF7C3E8C62D891156F4AB256F1FCE1D0928432C3C67C9D5AE4BA3E2871E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 bfa3fc7e2ea3b293e8819bfe37f12890317fc02fdef06bdfca703a4d9dab3104
MD5 6275fed08be788138561961f195d1b62
SHA1 6e57b3bb42e8af335294e41b241016c0ed3e4679
SHA512 ab177a9c11e158ad2b2ed403b2e7a9af255cf6f4c09a16d5416b7aa3c9cbd33eaa29b7dd98b76b208fc9c3177699a14affb0f6519ec3debf225246dc094691fc
SSDEEP 384:D0ucu8aTcZxONpcWJuJoDlxYaIP8Ed/QRI6Yv40AUIlJE2SjaN8fkIeIEIz+NbOA:NYqjqfh/OjV
TLSH
T110528EF7C3E8C62D891156F4AB256F1FCE1D0928432C3C67C9D5AE4BA3E2871E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 e1817273f722361785a835a2328967cc773805dec742e5b1e5fd5e796ac23907
MD5 165a732ca5c762baa710fdf07699b7d6
SHA1 51cd9bfbc316fe65ac3377da8d38072a2cc035e5
SHA512 71f07872a5a88cb75f2bcb6a45bba20095a7cdc114ef2fb4aae264def9223c120fd30f036b61fe818e9ddb807186b8863f21853b830dfc3073cb77c9f92800ee
SSDEEP 384:D0ucuwETcZxONpcWJuJoDlxcgaIP8EdMRI6Yv40AUIlJE2SjaN8fkIeIEIz+NbO/:zYxjqfh/Oje
TLSH
T1C3529DF7C3E8C62D891156F4AB256F1FCE1D0928432C3C66C9D5AE4BA3E2871E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eeadde52aced0a2a4d4c29005521acf1fdf16cd55380ec9329cc224dcc12df0e
MD5 84fef664873fceb7a8f51e229857bf54
SHA1 e6f740de3d91cfdc4c92a705a71d8c05a38e0eb4
SHA512 1f29c8c805f2c0e4a8c52f7397365e96504549a566366d6e737861d0cf2e75f73d526bb71900714f3957fc8a4de705bc9337e6dca17f37042e166b36624d7572
SSDEEP 192:+REsiHoiasAv7lpupAPRp2Z3f9fHsb+WNnli4n82herMkw3raJVyIsnAUgtaJ:+REswcZgUXURwU72hbbav8
TLSH
T15C52C56EFE24653B4CCBC32AFA617706D3F5112625D82E84EBF89A2C24D75CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9e86cef4d0740e40d9bd9875acaff576093ee7f712249477ca7f0bc607b6ad13
MD5 d9bd57ee3f9d3daf1cf21c79c4b4d85c
SHA1 bce19c52111e7dd2f7395cd16e9a3f164795cc88
SHA512 18eb1d6c26489cce6774b20e825eae0cfbf7c4ee6b427adf6e693d0d975d6cd7dc160e81819e988b947e7c6b7274e764caee8cfdd127f7d7a2ff8426c19a6b9a
SSDEEP 192:+REsiHoiasGv7lpupAPRp2Z3f9fHsb+WNnli4onY/erMkw3raBVyIsnAUgraJ:+REswyZgUXURwUnY/bbane
TLSH
T1B752C56AFE24353B5CCBD31AFA217706D3F5112625D42E84EBF88A2C24E76CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 87b623adc5e0d7c713c06ce024d51b1176684da843915a9fb5ce6ae7e7127aca
MD5 4f35b187cd4c99f01d7930f901234d68
SHA1 30f48ff5145960be268a593132d833b116454d08
SHA512 4fa10f35346ab272c93163171ea63322a622d90c3187bb4f47055f789daf27e6d95705b17e334965a4eaf1560d4e3edb988da2e54b167c563a331c7a0a501a10
SSDEEP 192:gREsiHoia0fv7lpupzPRpzZZw9fHsb+WNg1Vcp/B7oqUerMkw3ra7VyIsnAUgraJ:gREs43ZgpX4RwcU/mqUbba9e
TLSH
T1C352C66BEA2029375CCBC32EFA11B756D3F9112625D42E84EBFC9A2C24D76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e845c0db019b836322341ca4cb6be116ec1e72a013611a385aaf290b45071b22
MD5 544191dfbed2d12f72864277607809f1
SHA1 1c0b2f4849f1ce2274833ed1a62181038de04c03
SHA512 6673f9c5f22bb2230c06665de4078dd3b01f3e64e57ac0a3da3419ce1b1946a17446341be60f783345c184ced625fcc72788c561f880032949d65dd9e61d148f
SSDEEP 192:gRUcBzsiHoia0fv7lpupzPRpzZtj9fHsb+WNg1Vcp/B6+ZMLerMkw3ra7VyIsnAq:gRUmzs43ZgpXHRwcU/JZMLbba9e
TLSH
T10852C56BE92025375CCBC32EFA11B756D3F9212625D42E84EBFC9A2C24D76CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bd6bf2e36614e34bdac2ec999ae9d1f987aa7aa84005aae8ef4d843dab2d45a7
MD5 277c6685434b44cc72d084cdc5e1a620
SHA1 f22028a6ea2675b54a242b8f35aaccfaab154c66
SHA512 46ab28c44a7b001d1e5cf463f84a92646d793ea85478cc712eba75fa431bde15836356ccb1293fe1c74aeafbd125e94f0c1bcc01f9893df7886da0ce07213b51
SSDEEP 192:gRUcBz4iHoia0Rv7lpupzPRpz9GnKg9fHsb+WN3A+Vcp/B6+ZMLerMkw3ra7VyI6:gRUmz4YBZgpXyRw9U/JZMLbba9e
TLSH
T16662C56BE92029378CDBC32DFA11B756D3F5212625D42E44EBFC9A2C24E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1b3edf6aa26da524815dab154dc35c5e1831808405a24cf641e90909587dd377
MD5 7f0753c70ca04bcfcb2f401de7b8124c
SHA1 cc566365cc44212acd2521d48e1bfbc3fb74dc2a
SHA512 d3b10011a881c3c95ea7924bfd03f5bf12fd54012e9cfd1a02e41d30e51e8463011f9bc9b95b0369afe4b6a12d7925b8297f6db9c1a307dace0194f5f50fdad2
SSDEEP 192:gRUcBz4iHoiakRv7lpupzPRpz9GhZig9fH3Eb+WN3A+Vcp/B6+ZMLerMkw3ra7VK:gRUmz4IBZgpX+Ro9U/JZMLbba9e
TLSH
T11A62B55BA92029778CDAC32DFA11B716D3F5212625D41E44EBFC9A2C24D7ACD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 2d1ecfaea887fd8c9cda203013321852007b9197b25082cb9bd5077541b3f0be
MD5 ef4c6690b907066703f22650124e0bb9
SHA1 0beab79eaf11e0f4ee8cfd15eeeb4ccd9e60ab87
SHA512 8a18b60914557eb319af1ce75ea0f9625dc38521743a307365631621835f7751d44bd6370d66aa6f918fd448c899f8b49554edc9d28eeba0b77c3b9770503b3a
SSDEEP 192:gRUcBz4iHoia1Cv7lpupzPRpz9GhZiYW9fH3Yb+WN34RVcp/i/X+6+ZMoerMkw3d:gRUmz4JOZgpXZR0AU/uCZMobba9e
TLSH
T10362C55BED2029778CDBC32EFA11B716D3F5212665D41E44ABFC9A2C24E76CD221B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 1339e525f78e70abcf5fa9cf9ad9aeda9e26d7d9073a9509a5b5bbfdc21958c9
MD5 1c60a3ee2114ece7c1cea55bcf10547b
SHA1 c0663155060f16927716d5837bd56f936e0475e1
SHA512 e62745f4ec84e576e9b457177242292a2a22b6ddb7f3571900d5e449184cda08959a1cd955c8e5f7cac7d459986c0bc1f780be55981324b20337436b185ddbec
SSDEEP 192:gRUcBz4kHoia1Qv7lpupzPRpz9GhZiYv9fH3Yb+WN34RVcp/i5m06+ZMOerMkw3q:gRUmz4vMZgpXgR0AU/XgZMObbaYe
TLSH
T12D62D55BE92029774CCAC32EFA11B716D3F5212666D41E44EBFC9A2C24E76CD221B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d3515f7d72835dfa0fb9808c96d26343b9da028e9de7b92d089bedd9373bb790
MD5 f727c62367001388aae47f38cc3a511a
SHA1 bef88b504a0d0e924ae917f299cb1fa3007a1a56
SHA512 a3b07a007cf2cbada49f5284fba083bb152cfb98e96b436704bd2642166362bf04beaee5e1c6037cbf02c1011fcb7ca6ed94506434936e4b6cc306bff1debef6
SSDEEP 192:+REsiHoiasfv7lpupzPRpzZ3f9fHsb+WNnli4IHclerMkw3ra7VyIsnAUgraJ:+REsw3ZgpXZRwULclbba9e
TLSH
T1A952C66AFD14253B5CCAC31EFA11B716D3F5112625D42E44EBFC9A2C24E75CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7f5fb5dbd4a3194395492de97e49c7746402accd4305afaf3b0e40fcc4b85188
MD5 03782a56252ae0e10d0c335900db7644
SHA1 f188655a47ebf124db1b320ef92c2722bb91dc93
SHA512 b496ba5f3adb369397c45990f08ec8f567ae55665323337cff33dd2bab1fd877d4e1f770771a2b7de4fa30aca5aef7dba25bec2bbec7cad667886759de4d6714
SSDEEP 192:gRUcBz4iHoia0fv7lpupzPRpz9GtPg9fHsb+WN3A+Vcp/B6+ZMLerMkw3ra7VyI6:gRUmz443ZgpXDRw9U/JZMLbba9e
TLSH
T1ED62C56BE92029378CDBC32DFA11B716D3F5212625D42E44EBFC9A2C24E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 ffbcf8a338f97d4d50184f8e2b1c86ada6ec31fdf7ecb0b6ab009edd4a1460f4
MD5 fed0d03ddde05776687df5dbf1d09239
SHA1 196884e6356c7017497322c5b8d44d421959be67
SHA512 9d938d6b1e72ebcc3a5b9f80fa7ea21a1c0a31f875dae8c1969d5b16d5cae84e40f484ad14ad00e428699fb9610080998e78a649428e3486d71eeba2fcab67ee
SSDEEP 192:gRUcBz4iHoia1dv7lpupzPRpz9GhZiYv9fH3Yb+WN34RVcp/il5W6+ZMqerMkw3d:gRUmz4JdZgpXgR0AU/qqZMqbba9e
TLSH
T1FC62D55BF9202A774CCBC32EFA11B716D3F5212665D41E44ABFC9A2C24E76CD221B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 90c7c07af843eb99df5f86e129fac2ad4341a2b976ce9fff68f2493ac5ec945b
MD5 b52a48f2496cb02984461489d31b04cb
SHA1 2c10f77e54deef99acfef8377752cfaa2061d907
SHA512 8f4b51afd5bbcca53548112cb8e7f453a9a462efe2c409d8955877afb34700f918ba8f800cbfc1a24c466d6e8565bc276b822d9c2fe678d9a95b4644eb2427c1
SSDEEP 192:gRUcBz4kHoia1Lv7lpupzPRpz9GhZiYv9fH3Yb+WN34RVcp/igxo6+ZMderMkw3d:gRUmz4vzZgpXgR0AU/b0ZMdbba9e
TLSH
T1CE62C55BE9202A774CDAC32EFA11B716D3F5212665D41E84EBFC9A2C24D76CD221B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bfc53ee81a89b97a07a0b7f801dfc356c8e65b4792b05a98a982f39a39bc4212
MD5 6bc0223cac01f72c016127eb74abef47
SHA1 89437dc9e199281e569baad3ec0fa32ae482f701
SHA512 7286e12652d017297bd2309f220eb67e72185c43c6a8872747697770dedac7f8040c2e581676403f50dc57011343de9e67d6fa1c719950233bdfc856d772f54e
TLSH
T1FEB01250C0067141C01243F8114A149C7118AF10A74A170183E07A638C25150C018072
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cfaf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cfaf.TMP
Size 96B
SHA256 6eeb8ef7cc351e32e339e0c05a932ea0f1e9489dd9f154225ba3d3a3b13d271d
MD5 251976997253bfd9f6ac5057bbf271da
SHA1 3b179688e8b90fd96cae9c0571d03aefc44d6d51
SHA512 4a7f0bbd98aa324d735c79568fb77ccb10a6390d4d0feb26bdea0e5c08fe7b26199b63947ccf08dc17632a4dd4d9a3fef3b9575d94226765ac766c2b948092de
TLSH
T163B02280C2022322F0C303F02AC0A8CCF020EF2ECB03020BA2E02A22CC20B3000220A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 05d9d1e9577dfdfbe561c4eacd9c40e267b14e20c5b4bb8eace2581d5353687e
MD5 5bac95bf214e37be62f5328266572857
SHA1 7d4e5528ab6138d10cf967d7ea807e5dc45d49c5
SHA512 d9dd89554c5e3b5617999ad2258556e0f0636097ed92a0278069f16d3e768a614a2664200d506de3118f1048ff05de9b959cb3377944a8c9a0db8eb52e3d5148
TLSH
T122B0220C30008C33CA28CFB338C080003330BC28A3C3AA0AF0A0808FC803A8083008E3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c2f2b05877b0336de233438942bc43741fb72a7dcfafa73fcd70bf9f844cf1cc
MD5 212152e0295d29ef6c2f0d48ba56bcfb
SHA1 940c0bc853b4090ce9c927359a8b365f8d6c46a9
SHA512 d934caadb0c8a62897d49bc36d72be08ed21fdcf24b1bd7b48e4c7692909918b3d2bd945c5c9f0f396f8a583e31f70816ab0769f5783cc9091bed68c06776d4c
SSDEEP 1536:nhueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:IDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T13FB30212CAAACE9BE4A49C79A4C413F3BEBD5F9523F1BA424166E4023DDE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ddd2433c5829b26aeaeb35bfd51d16fbf23e11323b22f364f85893a9ec57613f
MD5 7a4e662c2e5ff1c2387a75ad91de7cf9
SHA1 7361eab39a2b2c81ae03b2368d527f40046976bb
SHA512 ed73ff4c56d8d4b334e23dc41efe974710cd304df8d500a9acab861cb902346bd5f79d8d2214a5eb2a7f9816eda1ef7f177ef6b2aab54131f4fa3718122fcde9
SSDEEP 6144:IjQt6T+jTeWbztLzx3GdnnJfInlf+zfAk3Wbhx:I88TklLzx30IdgfaFx
TLSH
T1A4342303994ACD5BA0753639C1D543B26FB1EEA517F1FC2440A676263ECEF845BE0A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 16bd2ce6ceb52bde36177ae94fd3b7012e8cf86ce112b2b6751800d3cb829bf4
MD5 6c4ba00d2e466c43577c29b851a2259f
SHA1 ae55f8df86306a70aa8ae374aa2d1aa08c95b10b
SHA512 a8f28f48cdb428bf173944e831339ca6c3a68f11f6aff4accfee9edee73fc7fa752d9a9f1297d9a48362d02b712825a2e341451f3786d42c2503a23dd9e40439
SSDEEP 6144:hjQt6T+jTeWbztLzx3GdnnJfInlf+zfAk3Wbhx:h88TklLzx30IdgfaFx
TLSH
T1E5342303994ACD5BA0752639C1D543B26FB1EEA517F1FC2440A676263ECEF849FE0A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 862e8ad055bcbd027f53fa75f8f21c02d9dd766f05cf77a08c03378385c53dae
MD5 f356ee2e27c0688049c54ce84d63235f
SHA1 894d63b9f6be184e3fb399a5287eda49d486896c
SHA512 666a4a4b1c547ab98a6c0a82c87fb0b255fa708d20a4d0bbd22557bb6956cfc6f8670b8c5d5ee8d8a63446dadc62aad7fee08403facaea50b685d2613a7b4f65
SSDEEP 6144:kVjQt6T+jTeWbztLzx3GdnnJfInlf+zfAk3Wbhx:u88TklLzx30IdgfaFx
TLSH
T146341222A906CD0B9471263DC18553B22FF1EBA657F5FC18509A76293A8FF449FE0A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 cedda7c3b70f0a5084d22bf3483ea1f831408d402ad0ed16f9a6b11b576c4deb
MD5 d8b3878e6779c46a2d66987f8eeb4c6d
SHA1 fbac6d5254efc418c1e3e1d46020f32de79436a4
SHA512 d6aa5526d1d44a1af7888fa480d5519471421bb1173568201b37f40acd15ea0582e9c6dfbb431d412077ad365ffeafba5d93fdeda1f71a14d0b5110b7c1c0747
SSDEEP 6144:EVjQt6T+jTeWbztLzx3GdnnJfInlf+zfAk3Wbhx:O88TklLzx30IdgfaFx
TLSH
T121342223A906CD0B9471263DC18553B22FF1EBA657F5FC18509976293A8FF449FE0A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 2035dee8094ca3cff3ac9d558e193b8a64824e0a3a8d96097294fafba83796dc
MD5 797e4271dbc33422a3c0524ee630f6f2
SHA1 1b3ed15e6f71fc38e06be2e62ed32dcf2f6445a7
SHA512 41b8bf398dc7996a9b5db212d7d73f6dec0353c44cbea689597de195ceab9050edccfb8ec3e1b9dcb1f3c9003d6c8e5a98c6e6981dd4676d3f3e06153fc4c1c2
SSDEEP 6144:4VjQt6T+jTeWbztLzx3GdnnJfInlf+zfAk3Wbhx:K88TklLzx30IdgfaFx
TLSH
T193342223A906CD1BA471263DC18513B22FF1EB6657F5FC1850A976293A8FF448FE0A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

TLauncher-Installer-1.9.5.1.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe:Zone.Identifier
Size 145B
SHA256 726345c700772f77872858e9ad2d54268bdea72e27e2bd5f3c2381edd8704a2c
MD5 dd77dc004eb3fed0d8d0b2bbdf05384e
SHA1 2537049342cc13203b844a259cec9802f67260bf
SHA512 c9c411d0662803b77c259c218ac81211bc9a6f755d92c5d1736aa4ff9538da47a3503e678eb056765c708f686287f54e112c979c825c9d75852c139947acd509
TLSH
T1CCC09BD7494C4455075223DC575D553FB5CB60584DD01521ECE154D2954C05CDDF3A16
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 690208.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 690208.crdownload
Size 25.5MB
SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
MD5 de90bdf89be7e8f55b9ea1e9f0a88613
SHA1 ea25984a475c95ad41abae25885db7b24514a7af
SHA512 42f6cc77ea8cd43d167236e81e4164da7c8030605d7d1759494f41f5b9b5dcdbaec3b4d901f1925f13d915756b52ec22927e1dc304e89fb7f9342b84c475d188
SSDEEP 786432:ytpZzp8Q6W10rrKJBH5lFRqJkkt9O2B4Bi5e:ytpTTuPKJBZlC39ORb
TLSH
T1014733357AA29072D772363496996339F77EAD70AB3802D322903D3C7E716C15A7C21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download