075f6eb5de7ab4e44f9d991a8d9e5b074e460a56b879ad3ed43177d6df7ea873

Resubmissions

08/08/2026, 03:47

260808-ecfmaszbrc3

08/08/2026, 03:47

260808-ece1rszbrb

08/08/2026, 03:39

260808-d76arshj6y3

08/08/2026, 03:36

260808-d57e2sswdy3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
albert.png
Size 168KB
Sample260808-ecfmaszbrc
SHA256 075f6eb5de7ab4e44f9d991a8d9e5b074e460a56b879ad3ed43177d6df7ea873
MD5 0c90765bb7e27a93ea9fdb026bb2d396
SHA1 ef43c80a91de4fc02912000e0e21e4cc058819a6
SHA512 e255ce3cc7683626b3ab7e94a0778abecf880fe4472bf5b3de11957761e30a7d9c457cd7fc682e03d34bb7a33da188b1846cd195b4466d3b052e5f553526f91c
SSDEEP 3072:Bs9nYTljOoOed3KhqW4p5JdaehAFkNZU0u4Hzv3cIwMz:q9nQjOoxd76ehAFkFZvcNMz
TLSH
T135F3124248E49C5F35EF2CFCE4BA640050DA3A95B45BFE768F80611213EA4DE54AB7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306344687459790"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.bundle	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.bundle\ = "bundle_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\bundle_auto_file\shell	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
796	mspaint.exe
796	mspaint.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
3516	chrome.exe
3516	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4536	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
796	mspaint.exe
796	mspaint.exe
796	mspaint.exe
796	mspaint.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4536	OpenWith.exe
4616	OpenWith.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 5104	4784	chrome.exe	99
PID 4784 wrote to memory of 4400	4784	chrome.exe	100
PID 4784 wrote to memory of 1796	4784	chrome.exe	101
PID 4784 wrote to memory of 1796	4784	chrome.exe	101
PID 4784 wrote to memory of 2316	4784	chrome.exe	102
PID 4784 wrote to memory of 2316	4784	chrome.exe	102
PID 4784 wrote to memory of 3488	4784	chrome.exe	104
PID 4784 wrote to memory of 1600	4784	chrome.exe	105
PID 4784 wrote to memory of 3488	4784	chrome.exe	104
PID 4784 wrote to memory of 1600	4784	chrome.exe	105
PID 4784 wrote to memory of 3500	4784	chrome.exe	106
PID 4784 wrote to memory of 3500	4784	chrome.exe	106
PID 4784 wrote to memory of 3240	4784	chrome.exe	108
PID 4784 wrote to memory of 3240	4784	chrome.exe	108
PID 4784 wrote to memory of 3612	4784	chrome.exe	112
PID 4784 wrote to memory of 5404	4784	chrome.exe	114
PID 4784 wrote to memory of 5404	4784	chrome.exe	114
PID 4784 wrote to memory of 5460	4784	chrome.exe	115
PID 4784 wrote to memory of 5460	4784	chrome.exe	115
PID 4784 wrote to memory of 5180	4784	chrome.exe	122
PID 4784 wrote to memory of 660	4784	chrome.exe	123
PID 4784 wrote to memory of 4796	4784	chrome.exe	124
PID 4784 wrote to memory of 4644	4784	chrome.exe	125
PID 4536 wrote to memory of 5480	4536	OpenWith.exe	127
PID 4784 wrote to memory of 5832	4784	chrome.exe	131
PID 4784 wrote to memory of 1724	4784	chrome.exe	136
PID 4784 wrote to memory of 3516	4784	chrome.exe	137
PID 4784 wrote to memory of 5608	4784	chrome.exe	138
PID 4784 wrote to memory of 5608	4784	chrome.exe	138
PID 4784 wrote to memory of 5888	4784	chrome.exe	139
PID 4784 wrote to memory of 5888	4784	chrome.exe	139

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\albert.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9c2b2c728,0x7ff9c2b2c734,0x7ff9c2b2c740
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,16297222620439745789,2265904110513592367,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,9398732800410190081,8776088631437094778,262144 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,10877088392495841412,3679492396011419070,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,15226780596542376747,17115461494150615696,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,13261902847408511300,868836872279537525,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,3997922237655662113,12082837722134965896,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,10775614982520338629,15166888158652563560,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,5242744333272568641,1369260165998964494,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5644,i,17726566750160184786,4169058991692104965,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4748,i,17852530628070490783,17916528362805943382,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3364,i,15637856158309386567,4112455505910843268,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3364,i,16822925301155803721,8412581248042813558,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3356,i,9505808601712164576,7236938060408823304,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,1156670905016120110,5072796801287314753,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,14918954399437977339,984817563466306905,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1216,i,7033131508781764671,14430136633480146542,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3276,i,16087345243932000870,14553573761100131151,262144 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=2452,i,5457535755407262991,7909753279793043456,2097152 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,6726295311289637465,11795700112250077229,524288 --field-trial-handle=2188,i,3834804706500551491,2175923057097650702,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hydroxide-main.bundle
  2⤵
  PID:5480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0fd8eca3742d5dfa624d8640a6dc10415be9ad66aad1afe27ca3a60b60b16b65
MD5 1959b69a6ea8c9bca638bbc744bc7592
SHA1 1c58a1ded667f4f4e5ec1412fe28fdb8a4e7d67b
SHA512 ddef8378ebcb43bb719dfb0fa42741098188fb82b19b5583cb129844b12746dcb2b2e2c20cb8cdc2e1077a36101f85debe4ec253ca7bc1e6e356c099cac37400
TLSH
T111E02BA9CD21AC270CF92B6960104685E75113173F90D80F3A3D920C8FB5A3B816692D
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 1024KB
SHA256 c5c3b4d71a0611adeec0be1e2723269b575f8bd79f555696f7e37c6a46af3b64
MD5 7375679e19801422c9f1c571844e8068
SHA1 1efd42dbe5a6c832a88ad43242258b68f59b29f9
SHA512 598aac0d6c2e6f530290b5604b21f01f0bd6493b09184009a8018272cc51e2ede3bd2ba92540d53cd9c8d331b17bbe1b6403309995b593bed0b3e5a895485e7c
SSDEEP 24576:NybupW6jXde3lzPgslDtXajN4nq6z1GOfiynV68gKTWywZMOHO7F2Xf:Tde32YtaR4qg6UVRdTWPZcF2f
TLSH
T11A25235585046BEEF015CA356D9F7639CA021E362EE9EAD8C864FF1AE273440F9D43C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b8a7cd76db85a744cf8b574f47db8681368b0433fc82e55aacdfe53156098c46
MD5 be169f7c514fff37e86c11b10a175175
SHA1 04c24ae13a0e356f8b485ad5982f7da04b1c04be
SHA512 85680477080806a8459b7aa89b4e1bfa38461bb77be2296f44375d22bbf22ac1d6fea48fb3cbd2bc98618924570029a44f634bc994fab647aae87594c62b1a21
TLSH
T162C08C2932EEAC00DFC003FE24C00828F9284B2A015A1A178B4C2ED8CB2D2F362044C0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 511f6ccfa528a6b7cec89eb2ef1a8673b534ad04602e9346a981957931862a36
MD5 ed3839c4de6e147f72865b8ca1b35a8f
SHA1 91d85deee96fec709c5ae3fe12592f19d05cc52d
SHA512 c7f4f7c73e3d5dce02d6d088c659e8acd7bd1fff7384abbf8e53cf10df725b5a86974305276101e990cb8126ad787ce1bf33a6280e5bdf5134ef362a9239bd06
TLSH
T1CA718CF7C3E4867DC96196F4DB116E2FCE2D0A14521C3C56C9E8AE5B93E2872D20168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 46cfae583af04b14075682a9a76db35f0b788b23b7c881387bec9acdcf7e2079
MD5 a6079cd822a98074eb4176012f6a5e1b
SHA1 8622c6f2ce7e2d78eacfc3a3c5c92c14e09c0fc8
SHA512 9677b7dea98422dffd6e75d5a5a4ecb435184589b012dfc99063b703660d311a2ae3bb06b75b5cc19cb4d4f661091a8b053323ce72a8d2e51e4bf95b218999eb
SSDEEP 192:ZRW9I5G3HH6v7cpAPRp2qg9BHsb+WNn+o0o5ikwd4VyIsnAUgtaJ:ZRW9JHWwUXlgrw/0Ui9c8
TLSH
T17942D82DBD10657B9CDBC229FD257B57E7F5102125942E84EAFC892C29E76CC322B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b51266d802b5b8c34a36b78562c9503039b194196913240ec76c41f9106bc996
MD5 7c205cdc56da974a5f982e1cecacd8e8
SHA1 4d7567057fed01a1d63f0098dd4860aefea9cff8
SHA512 20f321d1b336f31b226a113c77006568fec12d5e78fe2652680a573f6033e542d28b334f0f12a9aa034eac14f670ca64714a4c9ad695f7ff05d0f8044ec16054
SSDEEP 192:ZRWQI5G3HB6v7cp8PRpaq639BHsb+WNn+olikeQ5ikwU4VyIsnAUgraJ:ZRWQJBWwMXZ4rw/pe8i0ce
TLSH
T1CF52F92EBD10697B8CDBD219F9157B57E7F5102125902E84EBFC892C29E76CD322B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 63480bfeea2f2aeb33e4b83d0e7ae2aebfdf1be4a13ebb271d9b0da3d551ee0e
MD5 494a7b619064d1758e18e6a65f251e91
SHA1 fa6d7ae953727726510bd072b37662b15a869fff
SHA512 53ed06494ca236c617333e9a9f358c59a07f997e8b4379dd59075274e37610acf1aa28d8f31f833da74ea4bdbb82b43898a2441d5ab4838e9951989f9596d431
SSDEEP 192:ZRW3I5G3HB6v7cp8PRpaq639BHsb+WNn+olDwEZ5ikwU4VyIsnAUgraJ:ZRW3JBWwMXZ4rw/yELi0ce
TLSH
T17352E92DBD10697B8CDBD229F9157B57E7F5102125902E84EBFC892C29E76CD322B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ee71e5669779fada97a33f0c17e6174db7ba841da93eca10a40ade02a2a3547e
MD5 651d424d57478ca1b52b04445f95249a
SHA1 a2be3fd071a04c3358d09dbe5cb29a14116b7e65
SHA512 b9eb3114568645b4998f06444ddfe2440a89d25a4113468b717f1e7bed8364ed2ef5120b4a5fa1df55f517950e941f397e657924c5e3c9639b83b9cc69b7f0ff
SSDEEP 192:ZRW3I5G3Ha9v7cp8PRpaq6eK9BHsb+WNl++olDwEZ5ikwU4VyIsnAUgraJ:ZRW3Ja9wMXZErwWyELi0ce
TLSH
T1FF52E82EB910697B8CDBC229F9157B57E7F5102125802E84EBFC892C29E76CD321B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4324574fffb9abee1781ed46cb4beaa8270b070dd5b55e1e7bbb12f935f4321d
MD5 d62d19c5acebfe11527bde53cd3fa9d5
SHA1 0f42eb31174f5c5a69d5caf0e77ff57f1952c9ed
SHA512 6f8df2ce5150a027f336ef03b55cccea8bc6088579f3edae9541e5749deec6c68932f363e78c6d6f5ed66f91637f19df76e588e75c11a4aa615aae681e27a82c
SSDEEP 192:ZRW3I5G3HBwTv7cp8PRpaq6b9BHsb+WNn+olDwEZ5ikwU4VyIsnAUgraJ:ZRW3JBwrwMXZQrw/yELi0ce
TLSH
T11452E82DBD10697B8CDBD229F9157B57E7F5102125902E84EBFC892C29E76CD322B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a1c7b071dceef97edbae8d4485336549b63f471e545f05295916b1d9e25fa14f
MD5 93a992bf218218d3848f4325f5f74371
SHA1 e8766d6559c501dc9273db847f5e181f041ff030
SHA512 c02a4caeb992c5a1dca72096756283ff1159aceabc76b98001c691ef37a1e47895cc24ad1f674ce0b50c8c7c99128b21e3b493a73483a789b24ada82c4b0471c
SSDEEP 192:ZRW9I5G3HB6v7cpAPRp2q639BHsb+WNn+olKk2s5ikwd4VyIsnAUgtaJ:ZRW9JBWwUXl4rw/R2gi9c8
TLSH
T1BA42E82DBD10657B8CDBD229FD157B57E7F5102125842E84EAFC892C29E76CD322B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 354a398392050e78cb713484b37d136b48cad6b39f5436a6ef2027eaf0768e62
MD5 d10a914932d97f423d17cadaad573edc
SHA1 bec34531cc87f4ebc11cc98375cd7ae204bcaea8
SHA512 3f6afde3436411e79713577a496dbb2978a4864cfa1a03ce089aa4cc85e8f72b669e23a7745897438c875535a63732abee61c474361e24a8ebbe5f2ed0f96ede
SSDEEP 192:ZRWtI5G3HB6v7cpAPRp2q639BHsb+WNn+olKk2n5ikwW4VyIsnAUgraJ:ZRWtJBWwUXl4rw/R25i2ce
TLSH
T10752D82DBD10697B8CDBD229FD157B57E7F5102125842E84EAFC892C29E76CD322B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e62ce79ef47a34bdf5281544db59365f50a1db706bb9edfa9b3c28378887ac29
MD5 88e54d130cdb53d018af2fa19e8b1227
SHA1 7edcab0bcb235d23f8b6c0ef61ba9722186667c0
SHA512 135ac168a532361ada8739367aa3fda0d5e1470834421a2da93b5c107092875e34b8a5231440507f5fb71261a2725b5ecfbb5a6b62150a346dcc531147dfc277
TLSH
T120B0124084019102D00706F8115614CCB124DF21960A170E43E0A96288255519425060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f930.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f930.TMP
Size 96B
SHA256 990c45450a7b09f7ae150e358962a68d0ba0e27a293ac886e5929f8e0ebeda5e
MD5 ad76efcb6eff3e967a3f41b130b5c73b
SHA1 c8476316266436e790457f532e8fe73a2fb88532
SHA512 c0d8cbe692b716bbe1492a0f08d48363fdd0b4e797af6b4961d079c27e0424817932d7895efa2191811b1a0fb969952b1b7fde0974f7314dddce5c7b79edd9b2
TLSH
T139B00265C1036212C06303B42D9D96EAF274DF35C607125A92E45AEBDC6D66195255B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 67667cbec177557ac59dda248ac77645c3e84be4f5a3341f3b4d4555d864da57
MD5 8144cd6dbf3578361749010a4645aa05
SHA1 0bd0db505c76aa3d4058de39db281fb5d5be84cb
SHA512 60444dd733f9f1472e7dc9ef6c7e066e0807e5f721cc14e67b1f5efeb05b88fdbce00723e7115acc527e925275704b09da9324ab1a325f78b47136a1d274b88a
SSDEEP 6144:5APKO8VY/v/3uukrVEQ0nEnFmUi21rSm8uUVNSlzYk:eZ8VY/XznEFfi21b8j8zJ
TLSH
T1DC3422326DE394B32C9A305435DE2A24DDD40956C396C98B6153BB45BADF2C24BF7E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 beae699f3294a318e54984bc973ad3f85c0ea8092ec7ac429df1c3d7fed94d7b
MD5 56f65d058381e8f47269737ca5ce2898
SHA1 90b555b12045f6b4b2b7fa065714f368a6af8873
SHA512 e9f81b078401a5955dfe584b657106c3cf22e3e9187c8fc5b558dd0c262757c1052161774e6c36a5916e3d28048714bdb27d8937fdd5b09d02446ad6c88e732b
SSDEEP 3072:SkFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:NFmUi21rSm8uUVNSlzY/
TLSH
T1A9C313007AE3F9F2EE5930447BEE2A145D6C0D818291C6415273AD419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 775d39a038fbe002082278c5392a00232ccbc0a580ef0e2073b13872c0e0edde
MD5 835a5d9e2b1dfb4439269dfbab841f34
SHA1 56855098c36dd4b0c41228d31736ec20a172ffb3
SHA512 4f4511576d7712a1540d8a96b97fae39dbde991b5fe70215de5c1f18c527d2d3cd2c84945668e93a517bbd8158037f68e047b0760bec8b60da34a3bc60d8588b
SSDEEP 6144:BPKO8VY/v/3uukrVEQ0nEnFmUi21rSm8uUVNSlzYk:lZ8VY/XznEFfi21b8j8zJ
TLSH
T12E342252AEE394736C8A305835DE2A24DDA40951C2D6C5876153BB89F7DF2C20BF7E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b718824a95c088c4297c1b454ab35f5d18d1731bfecba71abb30923e8ef217a6
MD5 598b1bce64ed50991d9deb2ee1bc1f42
SHA1 590cc24ef4c6c074faee55c0b95c0f4cb10e9589
SHA512 faac0cc8f2867f44fcab607feea9137c3b34049eb3cb457a5757deb454d17d7f70c77c88ef5592ce608449e380bb3b4bb2f9ef77121fe6d193f203e0339e89dc
SSDEEP 6144:QPKO8VY/v/3uukrVEQ0nEnFmUi21rSm8uUVNSlzYk:IZ8VY/XznEFfi21b8j8zJ
TLSH
T155342252AEE394736C8A305835DE2A24EDA40951C2D6C9876153BB49F7DF2C20BF7E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hydroxide-main.bundle

Path C:\Users\Admin\Downloads\hydroxide-main.bundle
Size 328KB
SHA256 38ee905bc5444a6ec2d15f411473e3f8d0e18773fbc8683f1b2f86a7187cbfd0
MD5 c6dd98f1a52e9b47f9444080ac794371
SHA1 658edda3a499a513a953c734010be25c2a0e834b
SHA512 d8ee0c6a4f8eadeb090ba678413682cd6fc984a37ee3053e305fa8257954cfc716f957458b57a071b8237c9d8f17c9201561198904109c7bea59ea840e643643
SSDEEP 6144:PnAX98CVpiO7KtGM90BEe6XlAq3bzIikV9AB9nSK/jPpYXhqAbpqNP/9f++TgopK:INo590ue65wikzArHjPvAbpqNPFBlp0x
TLSH
T1C2642315E04DF7C1ABD31786BDD698170B69BD2E1807EE1470DF85E629ACF0803E8799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hydroxide-main.zip

Path C:\Users\Admin\Downloads\hydroxide-main.zip
Size 341KB
SHA256 c7286a336104c8518befc456a8453efc9a9b667b8d911d2566009c11ca6e4457
MD5 b7134a046bd6053cf907d50c0b86215d
SHA1 ad45069e9f0b2c826ea2a2f02b4c6886cb8c4c8d
SHA512 8f3d9971a6be1d1221c599cc2a91550aa07a75c86ffecd4441e8dfa82023999e6474611eebb7c8a058af6528ff591e9fa0ef938a734b19f6dc2939cd3687eee4
SSDEEP 6144:lX98CVpnO7ZQ+QwAR8wnaympDEmdwY270R/dmKGO3RAaNAgDKXvi/NCJy:lNQQFQwyRlmKf3RAam/vKNCc
TLSH
T1EB74232B804755E6C48F05725CDC96C533DA3A992961215B30F7A0B338BFA2EBF48E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download