hxxps://www[.]google[.]com/search?q=Bloxstrap&sca_esv=949c2399617feb1a&rlz=1C1VDKB_enUS1052US1052&sxsrf=APpeQnvjoAAl45PNU7zq49hpI37l3O8IAw%3A1786255842925&source=chrome[.]ob&fbs=ABfTbFVyMZGZf1hfvX9uKjN_-G8c4u0nXx4bEIpwm1lnNH832VstEKsVDqPorK0Gahnm2nq-aQnTz_mBV-EZYISbLc-StUIq_PhL7hb0Qt0YiIGOHqH0w9agDhJI7scVTX9bo8NT9KxcrOpq85urpuPX5V5gniRL8vgUJT_mRs8pKfxX8_1XfuHIMB2uRp9G3KLFcT2oWlQYaO5qodHLhdo3vqE4sEd5Ag&aep=1&ntc=1&cs=1&sa=X&ved=2ahUKEwjOifvH8ZKWAxVInSsGHW-XC4YQ2J8OegQIFxAD&cshid=1786255878190924&biw=1920&bih=911&dpr=1&sourceid=chrome&ccb=1&hl=en-US&atvm=2&mstk=AUtExfDaFYCyvZiqG8DkHTp5RuKy1iOJJ55UIDjz5T2iRcz0TzL_X-Eq3gQWHPMrvJe-xaGP1wVK_lhZnz3_z9XYKcval1tRzlkrnIcb3UFyGIfmmbW3M_1xh5Q_mwWh1_aHojCpXGr9j9MpU8SwDsjbqNDxl5wLY46_IVgubRHiY5slgt1n6E-0mUtmAmXuNho9LxfdS1G1zOzoKn3PU_-wBTncZTy9EG1p6VeBvODMnKEYmVWWk23BUV1J1fD6-p0Vorhppu0FmkMj_G9VBtO2uTqlCENrBOowyHg&csuir=1&mtid=Bxp4av7PLL-sruEP9pzAmA0&udm=50

Resubmissions

09/08/2026, 06:16

260809-g1f9vasbpg8

09/08/2026, 06:13

260809-gyp4zaam918

09/08/2026, 06:11

260809-gx3zfahb233

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
141s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/search?q=Bloxstrap&sca_esv=949c2399617feb1a&rlz=1C1VDKB_enUS1052US1052&sxsrf=APpeQnvjoAAl45PNU7zq49hpI37l3O8IAw%3A1786255842925&source=chrome.ob&fbs=ABfTbFVyMZGZf1hfvX9uKjN_-G8c4u0nXx4bEIpwm1lnNH832VstEKsVDqPorK0Gahnm2nq-aQnTz_mBV-EZYISbLc-StUIq_PhL7hb0Qt0YiIGOHqH0w9agDhJI7scVTX9bo8NT9KxcrOpq85urpuPX5V5gniRL8vgUJT_mRs8pKfxX8_1XfuHIMB2uRp9G3KLFcT2oWlQYaO5qodHLhdo3vqE4sEd5Ag&aep=1&ntc=1&cs=1&sa=X&ved=2ahUKEwjOifvH8ZKWAxVInSsGHW-XC4YQ2J8OegQIFxAD&cshid=1786255878190924&biw=1920&bih=911&dpr=1&sourceid=chrome&ccb=1&hl=en-US&atvm=2&mstk=AUtExfDaFYCyvZiqG8DkHTp5RuKy1iOJJ55UIDjz5T2iRcz0TzL_X-Eq3gQWHPMrvJe-xaGP1wVK_lhZnz3_z9XYKcval1tRzlkrnIcb3UFyGIfmmbW3M_1xh5Q_mwWh1_aHojCpXGr9j9MpU8SwDsjbqNDxl5wLY46_IVgubRHiY5slgt1n6E-0mUtmAmXuNho9LxfdS1G1zOzoKn3PU_-wBTncZTy9EG1p6VeBvODMnKEYmVWWk23BUV1J1fD6-p0Vorhppu0FmkMj_G9VBtO2uTqlCENrBOowyHg&csuir=1&mtid=Bxp4av7PLL-sruEP9pzAmA0&udm=50
Sample260809-g1f9vasbpg

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
62	1916	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1916	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307297897670198"	chrome.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{6BF7E634-FB31-48A4-868C-D6F8917B5478}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000459b1b1825e3dc014c85aefb2de3dc0153ada9d3c627dd0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
5736	chrome.exe
5736	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5968	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4100	4172	chrome.exe	84
PID 4172 wrote to memory of 2664	4172	chrome.exe	85
PID 4172 wrote to memory of 2664	4172	chrome.exe	85
PID 4172 wrote to memory of 1916	4172	chrome.exe	86
PID 4172 wrote to memory of 3028	4172	chrome.exe	87
PID 4172 wrote to memory of 3028	4172	chrome.exe	87
PID 4172 wrote to memory of 396	4172	chrome.exe	88
PID 4172 wrote to memory of 4496	4172	chrome.exe	89
PID 4172 wrote to memory of 396	4172	chrome.exe	88
PID 4172 wrote to memory of 4496	4172	chrome.exe	89
PID 4172 wrote to memory of 2472	4172	chrome.exe	91
PID 4172 wrote to memory of 2472	4172	chrome.exe	91
PID 4172 wrote to memory of 2100	4172	chrome.exe	92
PID 4172 wrote to memory of 2100	4172	chrome.exe	92
PID 4172 wrote to memory of 4276	4172	chrome.exe	94
PID 4172 wrote to memory of 5056	4172	chrome.exe	102
PID 4172 wrote to memory of 5056	4172	chrome.exe	102
PID 4172 wrote to memory of 4180	4172	chrome.exe	103
PID 4172 wrote to memory of 4180	4172	chrome.exe	103
PID 4172 wrote to memory of 1988	4172	chrome.exe	104
PID 4172 wrote to memory of 1988	4172	chrome.exe	104
PID 4172 wrote to memory of 3624	4172	chrome.exe	106
PID 4172 wrote to memory of 3624	4172	chrome.exe	106
PID 4172 wrote to memory of 4300	4172	chrome.exe	108
PID 4172 wrote to memory of 2716	4172	chrome.exe	109
PID 4172 wrote to memory of 4496	4172	chrome.exe	110
PID 4172 wrote to memory of 3936	4172	chrome.exe	111
PID 4172 wrote to memory of 3936	4172	chrome.exe	111
PID 4172 wrote to memory of 4152	4172	chrome.exe	112
PID 4172 wrote to memory of 4152	4172	chrome.exe	112
PID 4172 wrote to memory of 4044	4172	chrome.exe	113
PID 4172 wrote to memory of 4044	4172	chrome.exe	113
PID 4172 wrote to memory of 1920	4172	chrome.exe	114
PID 4172 wrote to memory of 1920	4172	chrome.exe	114
PID 4172 wrote to memory of 3076	4172	chrome.exe	115
PID 4172 wrote to memory of 3076	4172	chrome.exe	115
PID 4172 wrote to memory of 3800	4172	chrome.exe	116
PID 4172 wrote to memory of 3800	4172	chrome.exe	116
PID 4172 wrote to memory of 4944	4172	chrome.exe	117
PID 4172 wrote to memory of 4944	4172	chrome.exe	117
PID 4172 wrote to memory of 2712	4172	chrome.exe	118
PID 4172 wrote to memory of 2712	4172	chrome.exe	118
PID 4172 wrote to memory of 2148	4172	chrome.exe	119
PID 4172 wrote to memory of 2148	4172	chrome.exe	119
PID 4172 wrote to memory of 4108	4172	chrome.exe	120
PID 4172 wrote to memory of 4108	4172	chrome.exe	120
PID 4172 wrote to memory of 692	4172	chrome.exe	121
PID 4172 wrote to memory of 692	4172	chrome.exe	121
PID 4172 wrote to memory of 3148	4172	chrome.exe	122
PID 4172 wrote to memory of 3148	4172	chrome.exe	122
PID 4172 wrote to memory of 4256	4172	chrome.exe	123
PID 4172 wrote to memory of 4256	4172	chrome.exe	123
PID 4172 wrote to memory of 5028	4172	chrome.exe	124
PID 4172 wrote to memory of 456	4172	chrome.exe	125
PID 4172 wrote to memory of 456	4172	chrome.exe	125
PID 4172 wrote to memory of 2156	4172	chrome.exe	126
PID 4172 wrote to memory of 2156	4172	chrome.exe	126
PID 4172 wrote to memory of 5052	4172	chrome.exe	127
PID 4172 wrote to memory of 5052	4172	chrome.exe	127
PID 4172 wrote to memory of 64	4172	chrome.exe	128
PID 4172 wrote to memory of 64	4172	chrome.exe	128
PID 4172 wrote to memory of 1820	4172	chrome.exe	129
PID 4172 wrote to memory of 1820	4172	chrome.exe	129
PID 4172 wrote to memory of 3556	4172	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/search?q=Bloxstrap&sca_esv=949c2399617feb1a&rlz=1C1VDKB_enUS1052US1052&sxsrf=APpeQnvjoAAl45PNU7zq49hpI37l3O8IAw%3A1786255842925&source=chrome.ob&fbs=ABfTbFVyMZGZf1hfvX9uKjN_-G8c4u0nXx4bEIpwm1lnNH832VstEKsVDqPorK0Gahnm2nq-aQnTz_mBV-EZYISbLc-StUIq_PhL7hb0Qt0YiIGOHqH0w9agDhJI7scVTX9bo8NT9KxcrOpq85urpuPX5V5gniRL8vgUJT_mRs8pKfxX8_1XfuHIMB2uRp9G3KLFcT2oWlQYaO5qodHLhdo3vqE4sEd5Ag&aep=1&ntc=1&cs=1&sa=X&ved=2ahUKEwjOifvH8ZKWAxVInSsGHW-XC4YQ2J8OegQIFxAD&cshid=1786255878190924&biw=1920&bih=911&dpr=1&sourceid=chrome&ccb=1&hl=en-US&atvm=2&mstk=AUtExfDaFYCyvZiqG8DkHTp5RuKy1iOJJ55UIDjz5T2iRcz0TzL_X-Eq3gQWHPMrvJe-xaGP1wVK_lhZnz3_z9XYKcval1tRzlkrnIcb3UFyGIfmmbW3M_1xh5Q_mwWh1_aHojCpXGr9j9MpU8SwDsjbqNDxl5wLY46_IVgubRHiY5slgt1n6E-0mUtmAmXuNho9LxfdS1G1zOzoKn3PU_-wBTncZTy9EG1p6VeBvODMnKEYmVWWk23BUV1J1fD6-p0Vorhppu0FmkMj_G9VBtO2uTqlCENrBOowyHg&csuir=1&mtid=Bxp4av7PLL-sruEP9pzAmA0&udm=50
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffbda8ec728,0x7ffbda8ec734,0x7ffbda8ec740
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,6765576064935249637,2544227235582878132,262144 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,17917843477427116537,608081894021612491,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2180458364560126216,16708805796288490848,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,1028540628751187526,11709157960081016789,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,15844820835320307549,5287822609395266965,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,10108971891909727424,9307973087747442490,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,12393096485801825482,4510745856291918915,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,2472013492542622425,18116147438352927499,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5648,i,7737870051639678520,5642345650797539243,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,6158841114545433663,4775293387185411208,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5396,i,11929458804824049104,17688280547423886773,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4744,i,15580722384274796426,5460366386627105149,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,17415234512125848875,3206500751391565279,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,392406595906757777,959738701674317050,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,2013091195504997819,17220719859437382764,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6056,i,11848516028539899495,14000897551396399196,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4388,i,11198556854954560955,11557229301513075744,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5608,i,5334239843122670087,12280040396827570861,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5400,i,16865433092684826398,7071088570233543096,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5864,i,2213641659133617966,9440236939878030128,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4724,i,15919990173431041663,14015352005455599707,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6352,i,16967024476820705270,3187999542589609991,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5780,i,13680182646936742503,9448656104505223985,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4764,i,3686401342911704910,9967467091321167700,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4792,i,15994408199409338069,11247318258458255796,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6212,i,9258386064778994072,9114914273563836895,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4424,i,7427626321992476615,5285506503201634083,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4408,i,4180314613252349554,6953613954778664034,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,6107215773043610443,17928034366582212509,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,13330025950552873903,603090098909049690,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6272,i,6719970269856523682,7432137096310862972,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6088,i,14466755292328519887,1683811630558139993,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4712,i,2119774457655715272,14628964119068348101,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6044,i,7736596793361257991,3446036538674329691,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5932,i,16750300120217316677,7960465920853951344,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6880,i,9424355546935972163,47705362471997122,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7008,i,1605146233488739318,10405565823187269200,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7616,i,4570379391273050612,17315599618377226941,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7752,i,6643817537179344040,14750233770597579124,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7756,i,7369915423708581089,2537580202859074874,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7852,i,2875410170831787914,10138145518146782598,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7764,i,1240079151100491962,16446009129966771347,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7416,i,4446055491670340076,7655278888696693840,2097152 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8068,i,6133252095290671280,4881218432966408553,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7436 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8048,i,14455373012280912218,16202499089079548845,524288 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8104 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7268,i,733689668239509602,321651715090653303,262144 --field-trial-handle=2008,i,10231809226652880577,1607207807442321845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 079f5d165ae5bd17353e92e125808f6450d56666b5ab097a3a89ffcbec68c99e
MD5 9df398944661f2cbbcb7d05d7f51bdd7
SHA1 3adf38ee2e49511dbd0fb40b2b5ccf40256ee5fc
SHA512 c18a85c195140ea1c2dc0430baafc207fd46395c38abb6413be0d0681a06a6c3c529ce9fb0dfef029b5238aa5844c83650109f30f204628f84131ef14f8b5d96
TLSH
T1AFE02BA9D921ECB718FC171960084B86D75013162780894B7A3C910CCF7173A415A85D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 85KB
SHA256 1871a974a521e4855d5222ed08616658bc9d91cbe639a7a10a5c5178eaa442eb
MD5 f6925a19d4a88b0f8a7175959bc9f8ec
SHA1 32bee3e7ccd95dca7fc51ebf4ef303fc564efb30
SHA512 71c24aaf8545095880883bb9b706f9a7af88be26f202bd29b45505ba7335b742bba04a81b5bdcf51110330837e52ab2321274c3f013932917fce31517869f037
SSDEEP 1536:Ue+cmalJP+GyhHtSqGrV85qFEWSMGWmzLaxjNjbh70WgfCwrIv7FC:UlalJ2GywHOqGW7K2xpjeWACwrSFC
TLSH
T13F83121209CB660ABF974DD63A47B71BAB8ECC021192088CF41F514EF97A81B52B5F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 510KB
SHA256 7b2c094db8974f582016461365a2ae08f6d8df605b5c3425456ea34ebadbb49f
MD5 b9360ba837d6214758d6d7f06147b5d5
SHA1 cd5b5f8ebfacf815fb5e4ec698b5eb2e48dab431
SHA512 b2924c3dcb2a5d479ed256ea8ea0811d6832a8684a4c4128e35fb6c530b28c71e6f7b94e6dfd222b7fe97deca8b3a61f2ab5e1f017a2bfabf6b6e12db102ae72
SSDEEP 12288:xAAgS7Ur4hwuBsWt3OqNgBIyV8kTO3yzKWAO6v4:mRS4r46KO1Bp8kq3+hV
TLSH
T193B4232C8C8CBB84B5FB147E2D4A65781C8169ED392805D224B4572FB9DF2AAC705F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 61KB
SHA256 00847a5511173cc2c9c0537a86f94cac72b397a187c661ac7af705e101a1d13e
MD5 6fd9b317407c916fd47a518c5b19454f
SHA1 6da1fd08fa968368833345d94e4e4e05ef54d3e3
SHA512 7dbd35813434da9b91cfe9e1af584a72e2434a99dc62ccab0bedec188411025c4cfd0540133c1f8a8d5fd29ddd54a7097419c39f546f62630456555550916ffb
SSDEEP 1536:ZNYTD2WPOiv/aajKNuEpJ/3ZYTBZZx+Z1kdS0:ZNYOoOiKgc/JvaTBZZYZ1K
TLSH
T14E53028ED53068C2F16A7F552420372DCC98848EDC79C4E583C576A0659CBA2EDFAFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 51KB
SHA256 02d8e3320ca5e85cc5248861d310c77142b5e9742389c1a7fdaa4a501b105cb8
MD5 c71bccac50dcd8e8a649bc8e0ee98f10
SHA1 e8d3997c695d49beb6d498ece0a2befcece45596
SHA512 87b880c55b606ffb388ab31b4b70979eff5da50ddd3f04626e158db545c848d819ce6efff22805f8d4655c7e2ae3e77d37752bd8f44a48a5ecd22207297561c0
SSDEEP 1536:+GuOhhuzNzwjScH+kdcn1IklYrP3+fHTEz:+Uh8zGjTeQ+7fAz
TLSH
T1DD3301F7D0AEF5C7EB031D5B5A036D2CC502D51AB186C54A80EF1BA41938BA976F4682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 57KB
SHA256 bb457b42a52af42ce3b520d8daabf2c0892ab7d22ee7a46ef7c20218f147b3f6
MD5 ca488a7ad347750c8984afa20dde8e97
SHA1 2d06ab684d7473136762390dcb87db498053382a
SHA512 bb9b1655fb834488f4b93f9684283feb3e9733ba1f424ffd68bf8df8eed7609779366bcac41cb132745b76754a091c00afdb097fb877c08ee3c46ac172c1db63
SSDEEP 1536:bmi+n+MOro3LJFSLWNRYdkxqUGl4KFatUf:bmiqeolw6zYd0qUo4qIc
TLSH
T11543F1C7B6BFB76994474037616B47E9B72070A944AB7BF2700978327B79F04772A880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 32KB
SHA256 b385024be4c3b8da905da991e8b9b7a65fc0db4e5b7c27949c2082b0af2655f4
MD5 0928e468d079a1a61b4408ec99e5421c
SHA1 60deccde79676c95fc0998eb03f41b59c566ae98
SHA512 886346edb63eaea700af11a23051255db320f6301186c1643308355d946baee008bbc5d04ab89c938d8bd17a951a7a4ce935737544a4fc97dc420b1afdcba825
SSDEEP 768:NxtyD67HvjbYj8OPzrTIdOf0gH1hqHIwr0+6:NGWjfYjMd2toq
TLSH
T1F9E2F119F1616F300B08EC7B27E556B46425B8F243C1D4A1F9349E70C02F21B1BEEB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 73KB
SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
MD5 86ab42d92e8aaa951eed274da507ad23
SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
TLSH
T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 17KB
SHA256 ca61e9a6c7192093d11403e82bb6e6e19772665ef7963d5d74e30a75e1959ea6
MD5 eafbee98b6967f5bb8b7feab5f1a0a65
SHA1 59030493f4d5a3351800e951a6ff8325e58a7d68
SHA512 6ae04af7545e0f79dd45f30bedf58df084ac048e183488fe28938025eddc6021f5f79c4ddb1afca47ce11465ccd4bdf47ab202cc5703121125087485c4794649
SSDEEP 384:gF9bAIvD3M+IzmpIi0yDC2V0h4hAlAYnB9+VWocGOBsePA4QlSU:QkIvD89mpIi0zjA6HnBoyGOAv/
TLSH
T16982E003F6027EA0F5281015604E3A4D38551841DA4E61B3B23CE963EDBF457EE97FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 23KB
SHA256 29056940a68c9b8c47fbfda53bac2b2033bc0e924fc828dba13f694225843721
MD5 4d55be52bc3324799efb76a17be1684e
SHA1 d6fff1db3a54fbf270ea4bb1f2ce77626f1c7e65
SHA512 d4a4212aeb0eadb40f46b40e26c99ec90c0a996419c66f71700be2dc181ab2b655047b4b3eb64a68404d28dd0003293db2273374ef7af233f175d4484d27dd95
SSDEEP 384:ZreROeWXuwZBOVoY+08sJDrgPzFTwC4d0/SnmDS5aHTXoDJ/12SGJlPeoObS:leROA+Y+08s1rgPzF8ASuO6Xo9ZGJldJ
TLSH
T1E4B2D09DF8983D2DD7AC9884500D162B93F60A5BB5973082A84B737CDCED7C69B148C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 21KB
SHA256 6ccf834ab83ea01d915152cc32b03550c842964b8fc01814dea16111a6b0a28b
MD5 fce825bbb123f0ce6280e1ae7bff5b65
SHA1 0e643bb817510ff0f5eee99c0f09fde89dfd3faf
SHA512 c7e2a07dc9fc4695fa2e1f390d47aecf882b54910ed1a0b630197c15465ebb2e01d7684ae24f97a28b85555798cb623e0f7056cdc73afc40e03d0ee58ff89794
SSDEEP 384:NcX+MceVcdlJpjSo/mJM0eLmgTXM0k8lIspcIjtuXoaQGn2agbvM0hwgCd:uXFiDpjSo/pN5c5IJrGn2BvNed
TLSH
T105A2D1EA9FD9D77CB0244159A02CBC8E5E98B5604E33DC9AD1B7D02B23C458FA2970D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
Size 165KB
SHA256 f7cd2c425ea9f01514ba2e606820b9930a1ae7a8b3abe69d888fff4cc1ea37e8
MD5 2c3ee96bba6a6f465da94d588dc9bfbc
SHA1 2c3cd4ecce8ecafbc9d6b83b7870a2976929a82d
SHA512 0a1be9a0f3781f153fee3de1019148c01870b9201413db2db0ead2978b8a7759577ebe2ec880915f2f985473deeca6d409725b3d66aa6400eb77e94b13bfd3b5
SSDEEP 3072:G7EV+mvmHh5a41DCGNt/XFDoWuKwMfldBOfxXIE5Klc2/7fHwPSKomtzOUh7co7K:JreB5a4ImtfFtWCDBc+cSwBzXTC
TLSH
T1C6F322891B938536E0FD4FCB0E0A28C79D6C3815B4538A3A5BB38857E679441C26DE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007d
Size 41KB
SHA256 d5025e5c9b4fa99ec7204c91f054c7145fccdb24d8d3257d1be108bf9702bbe6
MD5 edd2b6655252b4e6d5c5cc775b4ceff5
SHA1 ee259ece556da0aa449bdacdf6dbd2393ac0db56
SHA512 20faf34e5e2bca8fde2f561af1dde58c61bbf550fb87fe74175d17de24d34e923dad864ca1011939f2f70600d357047a0b4781eca165515ff76ac1945765e4f4
SSDEEP 768:BEU/qZdqVxGDRsdtKBVYEe4h42aO0FzDzEUF2TUvWH36CvOORk2akYSKb3Z:BN/qZdqVxwI7EZh4/FfYUFI2WX6+k2Fa
TLSH
T1351302117C41D685779FB6BA4A75296932F4F72A28D18C54DC26107D0FADCF38AD0BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 7ef1a8be18e7bca2a930de9f73d53fc846fa40a0604c9a211df929deae3ec5a5
MD5 c204abc9a1eb5871e780d2dd4789cf86
SHA1 832f5104d6d1cb258f64bb49dee519737b5b61f2
SHA512 5d34301cc62090c0f8caa5f49f63d014923357f7e0283512386c43ee3d42ef5f2e8a34947cbccefadc5a31b85df5e75e3b543ff62fe1131d4bdb14791877cdec
SSDEEP 96:6P72wfKtDKgvVR5gk5oDxF7fP5yLMw5qcPFFLJ/HMgaKomOF+ko4ba:62EKtDtb+oKFDIP5qc3LJ/HM4Sba
TLSH
T15CC1F7827091CC1ACF848A77A3E5DE1ABB34B5D76A7B1F061F487D341A9B3A05EDE410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 aa3df7cf113ae15a3775415ee026458611737d538a7e4f784a388f653769f103
MD5 575ca20a2076c80394665e4a3634f7e7
SHA1 167d2131271faccef8fe45c8137f381ebf90c55c
SHA512 28a3ed39afa08c46295d5d410f136af7eaf47c928c7d512546bd0235b70bc4ef308f17cbad559f95eafe9db0dd593d624b0435c03cfa81b5885c741135cfd508
SSDEEP 384:DP2mlRzDa5eCwgOIm4UJJJL8e7JFUIVFXaI3ImX7a054ModSFOL+tFQ+BWH6EFJD:VDuUzh0aOhxfZWNQ
TLSH
T1F392BDF3C7E8C62D885195F49B196F1FCE1E1928031C3D2AC9D9AE4B93E1476E21168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6408925ff85b824c8ba3207f152a5e11685831799d4c55580fae19575850abdb
MD5 704d64e3f26b5eaea73bea0d2fd703c7
SHA1 172689800870e4a4b3fcfb272922e4bda808ee0d
SHA512 ddcdbbf4c2c30cd82e2c75cfc6741cd85445c1aa19f8534300f04fdfc45c22903ee86135e7962ff9e2134855318c21726e031953759e4e915294696274ff35d6
SSDEEP 192:ERcWrPk5AMyGOv7PpAPRp2ISS9YHsb+WNnTtZE722w7axtdVyIsnAUge:ERcWUqjUXjWwJ62lane
TLSH
T14642D71FBE18693B5DC6C269F922775BD7F6102221D42ED4E6FC8A2C15EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c3145d76e0904c9b47c5568b6cc025550c6b72b0d2574d5e1ab94abecfe51ff9
MD5 c33684eda6009a64a99afa880ce3dbbd
SHA1 3fafec57fb97be2a429d615a0b1bc65a25b1f440
SHA512 1bf9a4b2562dc9ec18d9ffd5f6dd8a559799342eacc9d134b69c0e0d786565f28bc62dcba63788b4c9ffa9e6eeff1f2935e02a043b351f6bb2828693dbb72f0d
SSDEEP 192:WRcWrPk5AMyqwyv7PpAPRp2IOf9YHsb+WNnU74LQW7w7axtdVyIsnAUge:WRcWwhjUXyWwYzWwane
TLSH
T12242D71FB918693B6DC6C269F922775BD7F6103221D42EC4E6FC9A2C15EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 50d77e288d048883afad6fab5db4b90500affd16257ee8905d8a4eb939811146
MD5 9c3b528a15072715d168910f70e0911e
SHA1 aad338e1186700bdce65bf1b327b67843ffc0d8e
SHA512 da4ab2eef8684908f0ecd9f19bed89bbd16bfcdd06678e5fce43703f822f020a8b3c3c5ff65b36b13beef4dc29cb624c5743c467144e03c4834281dbee51564f
SSDEEP 192:WR8cBzWrPk5AMygVv7TpAPRp2IuunS9YHsb+WNux1lU74LQW/w7axtSVyIsnAUgE:WR8mzWKlvUXKWw7zWcaOE
TLSH
T19252E75BB914293B9DD6C229F912775BD7F6203221D02ED4E6FCDA2C11EBACC221311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 593051e7063d26fe162a49dbf1c7948b14f18259c7f8c8fd5b25229adae5e433
MD5 39145bc8b2bb602505be21c62b25279c
SHA1 cb2122bdc147b8c300d9ba5c4d5a8eb5cb4d24ea
SHA512 37ef660139fb692663437eccf1f54803833242b390e89748c8acbeee06dcaefe869bc5e3481095af069f648ca17ae0487082e46d2550c533a3debb9cf79def21
SSDEEP 192:yR8cBzKrPk5AMyXVv7TptPRp6IuSnS9YHsb+WNux1lOsBHluQw7axto8yIsnAUgE:yR8mzK5lv7X6WwGfu/anE
TLSH
T1E962E85BA914293B9CD6C22DF9127B5BD7F5203221D06ED4F6FC9A2C15EBACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e6d02452da36bbed1b76190bf494dbd96f3073e3df566616724436b73721b87d
MD5 be4ed29a689bd5f7417b504fd268fed2
SHA1 4cba80bc4069eb1236e18b57bbe77ae407d62147
SHA512 674c065d8f742145a8202e948a15f008523f41575f9a98d0e16ce85299337970dc33f1efbcae31e40c44ae355128fb60cbd50eaf6c65414afb36d1c92352857c
SSDEEP 192:WR8cBzWrPk5AMyqgv7PpAPRp2I5uYQ9YHsb+WNuNrU74LQW/w7axtSVyIsnAUgE:WR8mzWw8jUXGWw5zWcaOE
TLSH
T14652E75BB914293B9DD6C229F912775BD7F5103221D02ED4EAFCCA2C11EBACC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f9ea82d87e2a586706e155e32d494a9f99cdaeb035966cb4fa9046e8897b2ab7
MD5 80d48183ab600c13465458cb542cfb19
SHA1 e22b0222b2c214694cfd7ebda8f7e77d2e9c3cae
SHA512 c7d848d98b47d9620667e957927f6438e06b8665c046b3227d7b4296501481b38674968ff84268328b5051c4aba416de9d3d48cc34067864aa0524ec09d09f23
TLSH
T1F6B0120084015241C04202F0218378DD71145F10A60A170543E46E62C966261C064160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 b10005c6d52f09f62a3539ea235299a40805a4aa3f3bee1e66a6f108ccdbf6d8
MD5 b5ea076229c62c2ee79b9c7532fc7a6d
SHA1 36f8a40552054531be5fda85de0e491915377178
SHA512 7d478e1046ec4b9d8fb007ac48a1b4f6fd737dae5849e8d0fed9b6ace748d03f50e8aaa47d7270dd22e69a4ecbd7730d096eae3910e80fbd4ca48211c6eaa49f
TLSH
T17DC01211C502E121C03F03B429579CACF1149FF4CE4A534847F4A92A9838121D0381A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a44a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a44a.TMP
Size 96B
SHA256 152e7f97f33cffa9c5006e4b7def2e02219f55c79f72d09ab0f67ac12f718d14
MD5 f88844b6521e6c6db356fb92201c6e0e
SHA1 62773a174911be82e8794385b81d77d43741319f
SHA512 c262f2b435af3a8beaa6c0307d422df6779aa6daeb52f53cd68d76355553bf17d4e51b37ba3623617749b9d96721e20dc828ad924397f957da2a593b8826529f
TLSH
T160B02280C0032302E00203B0338088E83030EF30E2032302C2E00B32CC203B002B2020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 7ce9e27af6b8513a6fcaff45f3fcc3456522a69d9db5644a3f8aee9643f8cb65
MD5 541fbbf44f031c9e44d5fa24e4ad926b
SHA1 451a65620b8c140d9fa34b21adf2846d04962f8b
SHA512 c836e108d0b443c6fded393ac1658c3ed954ced569948fc54e284f539dcf1559f04c48f5934d7b9f0a570dce761667b17a383a102db13efd98c48f593d380a17
TLSH
T1BAB0124A00D41ED6FC2542F112C2C85023090A141280211662A2444084812C083E9534
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 d1220556b527929897567c1b857325d93e8629dfdd7392999479a5ac56985625
MD5 5f19cf6a3e3e8a203177bbd1ae0ab22a
SHA1 28aaa020a19125ce75a1f3b32089ed0e2b8c3613
SHA512 6853bba4b846b66d739897a8fb031b416e0b708eaa5042847f3abce1f517f6f1f0d66187bb9b972733ecb17afff75f0154ec29f2eea3944ba09436d473e638a0
TLSH
T1C1C04CF32421855B4B70EAD86118712DD5579A488CC8CDECD445545A657CA324403A38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe594992.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe594992.TMP
Size 157B
SHA256 00f966dcb5fc157c22f95b4d098fad06c2e1bf6a5f9e7f29d3833dfc8fa699ca
MD5 6a55bd051bde1068920683795925bf4c
SHA1 42dec474ae292735829f36919835da867f91886a
SHA512 835cd356216b661add7569b465d982a6ef73fa163f73651a59c36bd25f54e997472e4ead164c4568ad60c55025dbf7f1c6f06067f0c3ee38f12311b45a2f6d3b
TLSH
T1F3C08CE32420864B0B30A6D46128321DC02B8D088CC8CCEC8006304A307CB334402A38
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3b66c291943e934e90ec5206543df036a661eaca15e75437cb6a6493f5244182
MD5 90d82f5aa8ec5c91b9f84c434f589741
SHA1 27ab6da8b60181c666a654dae943579f67e95751
SHA512 89724d25ab4504258819ea983168bb89fd06d3e4000eb0c889025fd6114a44775a5381ec69ff0264d8b3adab78d566c0e230de57244343816e372a9b62d40522
SSDEEP 3072:IeKGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:IeNm7Rkm1tYpBeh2BAoa
TLSH
T1CFC3123B5D74AC375DB9BB4EB08E0E1F1DF149A7D924EE51C8D86E0423EAACC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 de3b6decd9a89e836b64e7ed76eb948665b2259b97d5fb9dea36467c9b500392
MD5 12a7cd542a2e1a92e5100df80ea026a7
SHA1 a2aa401748aff71e2e411d74bdfdf0ee44d08fff
SHA512 8ee86b85bb1e05b51327225787b03f88bf6d9877a68c03868d70764c76cc2a3f12e5bf7e4bbf0391bec2dcbed7f7c5a4a08f5bcc3bc354c70a1c20edbe8e76b7
SSDEEP 3072:2rGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2ym7Rkm1tYpBeh2BAoa
TLSH
T156C3123B5D75E9375978AB4EB08E0B1E1EF149A6D930DE9288D86B0437EA7CC0908934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 661fdfbeabb7aedb14e99b1cece19954b15a709f5e41c32dbbb4a6ff205810b2
MD5 259e6cdc0a274322c0abc22cd50eb220
SHA1 5bfdb0deb2202f802fd851817bf67f542a793e0a
SHA512 25c1b5fa335de5c43ad112dd7800b338109cb7c4316f6cb09d669625fadbbedf3420b5f127a32a30b8d915c7ac6960e2ef88801f6a87895f382aa38ec4a6adb7
SSDEEP 3072:bldGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:bl0m7Rkm1tYpBeh2BAoa
TLSH
T125C3123B5DB4A8375DB9BB4EB08E0B1F1DF149A6D920DE52C8D85F0427EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5b82e69161b71376243cbd8bc29a8e2fd378e070905b8e991cfc086700e42170
MD5 ac95e55a27de077972e1012268fc28bc
SHA1 f61c086f2f39075a3d3bd83a398e04a3ac1bd9c8
SHA512 cfd9b7eb41bbb6b7ce8330bbaadbb2321754f276eb38b1a6b56bda1934ff6cfd0efe01e3f414f2d56120114dbd3ddfd330f5bcae5c28e476006d4d2cbecc2708
SSDEEP 3072:bKdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:bK0m7Rkm1tYpBeh2BAoa
TLSH
T109C3123B5DB4A8375DB9BB4EB08E0A1F1DF149A6C920DE52C8D85F0427EABCC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a732b3727f184e3557f5efd31745d24f3ec6939de926dfe7d28145e390e3a0e4
MD5 fc8e9d4a639b9b5586c99c1205a76b8d
SHA1 25fdc1cb74d341144854154416243735f159d418
SHA512 de24d355cc400b159cb58375ea59ff77be02b4797d60b127afc1d53f1dc41cb65242e0fa09fe1be6c936d773e381d68a10fc0888b80e975ddd9c61103e83a291
SSDEEP 3072:IKdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:IK0m7Rkm1tYpBeh2BAoa
TLSH
T190C3123B5D74A8375DB9BB4EB08E0A1F1DF149A6C920DE52C8D85F0427EABCC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e6a0c7d8ffddd249a1e6a311b220fef0e36344b7fa25557ad62a45db58eefd8f
MD5 71a255ce236ce62c4f63b72a3ed89424
SHA1 e69cd99a4be953f06b90add085c8ce187d6262cd
SHA512 73b29ad0928286cec6eeec9890adc66f2b663aa6034047e360a0046c48247bc7d35daed39627f2f2066c72aaffb6b668fd1804c42e911ed8ccecc331f6ea7701
SSDEEP 3072:I3KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:I3Nm7Rkm1tYpBeh2BAoa
TLSH
T146C3123B5D74AC375DB9BB4EB08E0E1F1DF149A7D924EE51C8D86E0423EAACC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 6c87a12162d18551d3822ad3dca9cda81933b8abe88305aa418ed2aa12bdcc72
MD5 f1bd6f6c2b8fb9cb2cd547e5df1e88db
SHA1 d609273d8358c25abb0e9998097de3f4addaab45
SHA512 8d02da676300deb8ff5636b1b86d2c6042ec83921293e2f7078fcd2830dba55b9a53f3a1648e55fd9e914d60a74155b18de72de3c3d352bd19a0c93240038066
SSDEEP 3072:Ia2yEDJFZcTXzoDUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:IaBSZuzIXm7Rkm1tYpBeh2BAoa
TLSH
T151F3123B9CB1E87B5D98B72E708E0A1E3DF25E1ADD209D45C4D96B0432F9EDC19059B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 795615.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 795615.crdownload
Size 14.9MB
SHA256 d3a66023c4a04b13b7df0159930f748f309c1307b1bccbd022bacdd68d878f35
MD5 a0c3321ff616288101e1184e9d5c5af3
SHA1 261e6651e2c1fbc710df2e63135333d0f6a838dc
SHA512 ef6e6594aaf98c0bfd1e86c541fa06effc417f5db7ccd7b796e0624d12f615297512099e331de4416fa37fb1e3b9e944fbcfce32a127a536399b42b255d34ae4
SSDEEP 98304:hlE7JmE7FIAUxdgeTsTE7OVfasIYyFLjW/sa+ZmD3JxOYoHwfLk3vSmaR0+Mc4AI:hSHDUsYsPQsIjKsa+ZWObAbN0z
TLSH
T12AF68E8573FC2B35E3B74B35A970621A4976BC1AA911D78E2B887A1D1972340CCF1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download