092a6c3df65f4c55132bbc6f0914a10a68eb793e77995f307f9295eab1251162

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DragonBurn.exe
Size 1.2MB
Sample260809-pabknsac77
SHA256 092a6c3df65f4c55132bbc6f0914a10a68eb793e77995f307f9295eab1251162
MD5 2bf1aaa7e2ccb6b2f7c6cc5d7200a95e
SHA1 61e8e5dd4b0431cebe024b040dfd1a86f898f791
SHA512 7856649c59d77e9a25f6bada8ae377d1c14905d164868c2d8a4f21f580129026ab600ef9bce9b92681122c8206f658cfe5b8eb16c2d9def44a7cd74aa8cd020b
SSDEEP 24576:Qor0uON3thfqrrPC1CgLOFtn/a3LqxkXdcskZ27asTohZxB2:QO0zVy/T/3CkZ2HsZ72
TLSH
T1EF45230CC46C5A7DE024423DC6AF6116B195FE323D806B95F0FCA9A797328D63385BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	DragonBurn.exe

Executes dropped EXE 2 IoCs

pid	Process
1284	DragonBurn-usermode.exe
4548	DragonBurn-usermode.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4244-0-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/4244-16-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3036	cmd.exe
4716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DragonBurn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307509097975767"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1284	DragonBurn-usermode.exe
1284	DragonBurn-usermode.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1284	4244	DragonBurn.exe	86
PID 1284 wrote to memory of 4548	1284	DragonBurn-usermode.exe	88
PID 4548 wrote to memory of 3036	4548	DragonBurn-usermode.exe	89
PID 3036 wrote to memory of 4532	3036	cmd.exe	90
PID 4548 wrote to memory of 4716	4548	DragonBurn-usermode.exe	98
PID 2888 wrote to memory of 4660	2888	chrome.exe	108
PID 2888 wrote to memory of 1708	2888	chrome.exe	109
PID 2888 wrote to memory of 1244	2888	chrome.exe	110
PID 2888 wrote to memory of 1708	2888	chrome.exe	109
PID 2888 wrote to memory of 2156	2888	chrome.exe	111
PID 2888 wrote to memory of 2156	2888	chrome.exe	111
PID 2888 wrote to memory of 2584	2888	chrome.exe	113
PID 2888 wrote to memory of 2584	2888	chrome.exe	113
PID 2888 wrote to memory of 1888	2888	chrome.exe	114
PID 2888 wrote to memory of 1888	2888	chrome.exe	114
PID 2888 wrote to memory of 1632	2888	chrome.exe	115
PID 2888 wrote to memory of 1632	2888	chrome.exe	115
PID 2888 wrote to memory of 1176	2888	chrome.exe	116
PID 2888 wrote to memory of 1176	2888	chrome.exe	116
PID 2888 wrote to memory of 4444	2888	chrome.exe	117
PID 2888 wrote to memory of 2352	2888	chrome.exe	119
PID 2888 wrote to memory of 2352	2888	chrome.exe	119
PID 2888 wrote to memory of 4716	2888	chrome.exe	121
PID 2888 wrote to memory of 4716	2888	chrome.exe	121
PID 2888 wrote to memory of 3532	2888	chrome.exe	122
PID 2888 wrote to memory of 1296	2888	chrome.exe	123
PID 2888 wrote to memory of 364	2888	chrome.exe	124
PID 2888 wrote to memory of 4368	2888	chrome.exe	125
PID 2888 wrote to memory of 4368	2888	chrome.exe	125
PID 2888 wrote to memory of 3016	2888	chrome.exe	126
PID 2888 wrote to memory of 3016	2888	chrome.exe	126
PID 2888 wrote to memory of 332	2888	chrome.exe	127
PID 2888 wrote to memory of 332	2888	chrome.exe	127
PID 2888 wrote to memory of 800	2888	chrome.exe	128
PID 2888 wrote to memory of 800	2888	chrome.exe	128
PID 2888 wrote to memory of 996	2888	chrome.exe	129
PID 2888 wrote to memory of 996	2888	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\DragonBurn.exe
"C:\Users\Admin\AppData\Local\Temp\DragonBurn.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\DragonBurn-tmp\DragonBurn-usermode.exe
  "C:\Users\Admin\AppData\Local\Temp\DragonBurn-tmp\DragonBurn-usermode.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Users\Admin\AppData\Local\Temp\DragonBurn-tmp\DragonBurn-usermode.exe
    "C:\Users\Admin\AppData\Local\Temp\DragonBurn-tmp\DragonBurn-usermode.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl -s -X GET https://api.jsonbin.io/v3/b/690e4759ae596e708f4b20b3 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\system32\curl.exe
        
        curl -s -X GET https://api.jsonbin.io/v3/b/690e4759ae596e708f4b20b3
        5⤵
        
        PID:4532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      4⤵
      Executes a command shell one-liner
      PID:4716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc9b1ac728,0x7ffc9b1ac734,0x7ffc9b1ac740
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,6551389553778412017,10152435878888906895,262144 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,5769586383169066525,6142452992294511576,524288 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,6510477919721431646,4655747457833670574,524288 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,3059780516804784004,16854172039641146722,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,3491093126736168506,10537414459720422791,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,11784200590626159160,9548077222466420490,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,3969213804405328175,6730960695312762052,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,13466357482580160217,9188029955675410409,524288 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6124,i,4654974220747428260,14039848843291206653,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5912,i,2835463149611155527,3150216645257360611,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3892,i,9420900373657618247,1181316614272847059,524288 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1696,i,859836540698891115,12859556605941626286,524288 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,9412377985961408299,2288584371544326126,524288 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4500,i,1104818094563562387,3096081213073728821,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4448,i,12802377266327357137,14417823914186443984,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4600,i,355195766798364018,295142348568997433,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3256,i,3030065329776935223,15729662792732151279,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3372,i,1274843310631412287,11747632144800275623,2097152 --field-trial-handle=1944,i,6356769415876045872,12661344928492128088,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 823ed66c0bca518944fa5a96e6510d7d4e52cac8cc44e7a1da86d2bb0b0474cb
MD5 e263a13459fcbfcf48c69e4b12a10d98
SHA1 90bd65d9d9897f81f336da84b18cf8627f37edb7
SHA512 5ca59a856296ba0c8be802331ce65d4f5745c0a1dd87670ad5db655d5fe9e0d3e69bbc70516589d5c4f9255d1260ae7abbee8323b2dd34dc3b9c029b0724e9e1
TLSH
T148E02BA6C8A1AC7728FD071810924B49EB5523262A80991F3A3CD21C4FB163E4586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 29KB
SHA256 f5a128eac1e7293380ca3c60a53ed11880489d412d3155d79a58e6a0b8675857
MD5 f775b39b952aabbf078d75126b82da5e
SHA1 6a3df63974471c552b0d8d3cd80d2d15331a4b99
SHA512 810c5dbe675ea63ef3195e4fb76848e7764b1be159f1dc65e3b3ff05ea19fa3568dbb9ae6d128b069f7e6ed689bafd6a0b7043f91629383b67f318fa512f2961
SSDEEP 384:EY4t+H9DR1ygmh5mzii1F7DFrCgKfc9hXTE+W4:WMHD1x5fDYgscvTfP
TLSH
T17CD284ED971C46CC5587CABDAF7FA245231FF0F971B940B4AD8E4BB8A203499E053A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 57KB
SHA256 bf2fb31a1a54d1705e7d7de23c3d9c97d7798884ddeb945b782d49a10a90484c
MD5 931eeb4da7340b8e6e126c50e1f4be63
SHA1 ce3d90b95ad7cd7f2422c3e9c048eaee5fc3dcea
SHA512 deea9f6bd149dd5446de2da2645dcb22b85d2af3250aeddbfff1565daa1374733ee73672faf235dfcd549e9967ed15b866de95b8c1b517b7750e602851c765d1
SSDEEP 384:jMa11QgwA4LxS5JMIr6XeXEWDXy1Ey49vxsvLJUDrswplhdwaai+IXaUP7Lwg3Gq:QhZWDXvySXAaaKWW8QhIMemLb/
TLSH
T14D43B4D0672C67CC484AB27DDB6EDED2132E30EEB06984842F8E476CE406796FD174A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000089
Size 288KB
SHA256 8d8027cef4aefd730486a5a59cd709aecadd05157d4125b10f3262face4cf73e
MD5 361dafea42362ea46fbf8273c6ab5c4d
SHA1 e03090c9c9aca6e007bae5cf2bde6807c088a658
SHA512 f1170b88194822aab4ab926b4a46d4681850a85d155a7884c4679c6cf3aee04f418e9a8d20c75ccad9d66ae7bdcb9bf87ac65edf4abc66d45cc7676b85adf4b9
SSDEEP 6144:7bhKu0o+2+lUa0xxUFjCYBLdQ5efRB2uKgW9ibzzhXYu7xPLNk:7bvN+IthYBqsBygMib/hIu7xPu
TLSH
T1D85423BF2B478C84FC194930373D512D1E09E1C0AAE38778B48856594CA6DF5FE7A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008a
Size 234KB
SHA256 f9b2c93a89f1cac9c08adcd9a95cc35674b5c17e0322c77d23fa3ec5cdfe5bec
MD5 9a7ed54495546ec389375cd7da3ea232
SHA1 ee16faa99b1c34140d424f42e612ea70655eaf1e
SHA512 84a8dbf8d31db248e0c5ab7636717f2bd92c72ab433832ee2ac29455d91e5c2624af437da19e9baef503b16eefd3ff58697bd2aefa7e5213e09b29f2b5eca2e2
SSDEEP 6144:Z8PqzgCNQ3qQ4kl3W1rxGZhdapxsTvndvpUlU8tCW67m:Z8PmgCe3O43W1rmnEERpcRb67m
TLSH
T1DC3423488336254DE70C00B37AF307A67F71D2471A57871B59412A2ADC8E1F7BDA7A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000099
Size 217KB
SHA256 d461d34666a438e81c30323d33ca9861b89b3fe48869fbcc5bf3b4a0cf779a98
MD5 26f9bd32165369d4ff6676af9545ad79
SHA1 085655a085fbe00d96b7ca2bbbfad0465caada8c
SHA512 1ac59f9a0bd36adaec2fb22ba2b79156b2a0ddc996e6ab1be0786c79f7e71110a81c3a63b11b46fbf0a376afcf9beb727e683cec3bd3fc785832220d4be507a5
SSDEEP 6144:dKjT9ExLeWxXAhZ+oixO3c4c3bo3hmyHU:uEtHCZdkbfyHU
TLSH
T1F224234503B0D35CED14003E6DE2FAF96DE87A449AAC3785A4A3143C45876AACE727DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000aa
Size 49KB
SHA256 32276b92c025b4bca01261aea74f70be21ad73efd66063b8de4497b211bb47bc
MD5 c27afea97d5c24a7451be1581be8e212
SHA1 7bbeae8699203a20539f0abe0fa4e4ebb0d9bae6
SHA512 aa332f80ef107e69c25c807845379d8f9e7cc2c9a5664b564fae9ab00c55cea054d94b1886d24f3ded57866a26fa52634b369956dca79d2a121212796b0cacea
SSDEEP 768:eDI///SkMt+6HSLJPCh1Cfkv6jpRuNQ8JCslFdWM9Bw6JD6XDqN7cKwveOTG5:sAM9IJPCh1CfkiknpPP807cKwv9q5
TLSH
T1B233F25C7DD72593C46DAABE88B548EB14B202F06F4F3E8602A7E87EC470C9FC549808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ab
Size 52KB
SHA256 04215dce713e4cafd41c2d02df5a22d49ca5bbdcc730b2c0665fbaf922a1f5b5
MD5 36f73a10c6426caa40adab2c2c7a8a3e
SHA1 58a52ad1c46148e9e8794cc26d4748b58ff1305f
SHA512 6de9a4184650b09bbaccd125516b2b2b68eb36fb589efec0a54c58a0970a89c8ca3f5b553b5a703bac6ce790924720b1f7705823bbdcddfec46d1e41833697ec
SSDEEP 1536:/h0KDlvrPChxJDQCKIGdWB6csUdcKft8O:/hTv7An0CKIGoB6cpqKaO
TLSH
T1AE33D060594F326EEF5FA403A803DF37F9A22331317BD4116CBD9ADB6D511B28592B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 108e29441e72df9e683411c186748cabdbaa7aad7870734845e2c28c62a38f75
MD5 d4447e04ac19818aede980d6dca903f8
SHA1 d4f47a135100dbf8ecd976f4183d61a027a61024
SHA512 d51ac12191d1853e4ab4d0029cb1c59662009317af15809ff0d1113ac801c6fb104cf4a7141022cca32efa226b912f3e9ebc3896a1f6e6b4e8000e283daaa205
SSDEEP 192:DBV1DV8jjk83aIsVGr1H+4aqa/NPraPQfPiJ2lpoldlUwF5C7mo+6vqLyctlflIs:DBV1DV8jjk83aIsVGr1H+4aqa/Nza4fY
TLSH
T1604289F783F48A2D9D2196F4AB166E1BCE6D0924532C3C6BC8D4AF1753E2871E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2cf10343cbfe610e5b120c68508f42fbca9b071ecd4175a5ed96d219c178ec64
MD5 1d3165b1a2d3577cadade9a0883a438a
SHA1 18ab2e3a697886567e42d45cabdc69e65317133d
SHA512 c106c5faa936785ca8e5836d3262934153207b1e0e5ce29cd5522f7df601fd8dd10c3e36a4c2736ae1cfcbd44ecebdee2ff86d240afb4322fa210133600272c1
SSDEEP 192:NREILtPMR5Fmv7hpAPRp2EWY95Hsb+WNnPE4Cp27c2Sm6YzqVyIsnAUgtaJ:NREGKS9UXxrwsD2A2SmXq8
TLSH
T187420A2EB910697B5CC7C219F9227B17D7F7147124A42E84EAFC892C09EB9CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d3aec2f533c0a7f3285fd475ebaa383c0aad78f169a9d84f8c5f704ca7a1b1e6
MD5 ca675ff8691388bfd95af4b97924dfcd
SHA1 d042cad0e43d90ce3722a4ee2f2abe7fe5ba0f3e
SHA512 f8049ec53a72b5993e09cc72e022d436e9ae5cdd21b8581ad31fd258211139d3e99ac8c9f339b9f73eb66a084e085b4d57b296edf0ac053a6fc22d7397d84687
SSDEEP 192:NRUcBzILtPMR5FQv7hpAPRp2HIn95Hsb+WNnPE4/Ueqc2Sm6YeqVyIsnAUgraJ:NRUmzGKM9UXnrwsLeb2Smiqe
TLSH
T1DA52E82EB910697B5CD7C219F9227B27D7F7107125A42E84E6FC892C1AEB9CD3207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 51acd4f281372d71d6ce5bfc50c38ae2177e3f1ae2e16571c466674b2fc6b2d5
MD5 040007dc7aaed98fcd6b1a4d4f36c222
SHA1 2b63c7bcc88688aebd80aa01005186efbf92fd45
SHA512 d432f4b87d705df9af50a568dfa5f1e7370eccea29a91835b039df0bc62d7bd0e44c47acf50a2fa57fe00f4cba116894c80a492d2b1bf66f549fa3b86c7580e3
SSDEEP 192:NRUcBzILtPMR5vQv7hp6PRpGr4Xlaxkj4t2nxU95Hsb+WNVOyEPE4/U1XF2Lc2SZ:NRUmzGQM9mXmkltMrw0QLD2w2Smmqe
TLSH
T18D62D76FB920697B5DD6C229F822BB2BD3F2107115D41D94E6FC892C0AE76CD3207857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3346d7196b5b829b00a0e99694332547dc08391f\af002b32-b7e7-40a9-b547-8a572e3b8997\index-dir\the-real-index
Size 120B
SHA256 a06a145af826b8a943b06d9c9e06a20aeab6de52cb8a2e899899e9fb151ddac5
MD5 75d1f684b8cacbf47e8f7304c28a63e9
SHA1 6df76a7d8b1d5260a466052f668f4d4182fc306f
SHA512 9509229adf5e0da95df26554cf7e24479b1866c1a1f10793d7168e3a35f71f9885da9afdf9f6c0499e95093613fc37137fd087dfd5aa400fbd99c55c36d1b0e8
TLSH
T14EB0121150262932CE83837836A73080D3061D44C6C1431315DD81D4EC116FD9045E40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ffd2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3346d7196b5b829b00a0e99694332547dc08391f\af002b32-b7e7-40a9-b547-8a572e3b8997\index-dir\the-real-index~RFe59ffd2.TMP
Size 48B
SHA256 0fae2deb1ed749ea6917153d59d8d16b7b36b5e232ff63f380cd3377e38eb69f
MD5 a1adb0043a7066e629f3e8623c5c5614
SHA1 45d33d9cd6010c3d719704ce09d9b680410c21d5
SHA512 88382709ee16f801b8b2385a7c1ba17b87599978ec71bec6e3c9ba7c6b9b6644b83385a440d6603e81e100b2189f408096532269a2fda933e6ee4473cf97728b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3346d7196b5b829b00a0e99694332547dc08391f\index.txt
Size 168B
SHA256 ae476c73557648ac1a10f54adc5496a2bd1d0d5a0b112e25f3bc777a8c8b75bf
MD5 60625c8d7bf4fc01b3098150403ec37a
SHA1 803dd9ba1dd35f953ef675dd4b7601f5839f23c8
SHA512 0af65b1750a7412f4fd59c82d62fae35390a59a94c8eaa54309f91ee0fcfb8155b733f7e2aadec9327ee8333c1b1a8db37aafcff2b2b95fc46096b090621d67b
TLSH
T1CDC080971DEC150C1D5191912C323259F979F594CC514F5C445401C555495330407D7C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59fff2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3346d7196b5b829b00a0e99694332547dc08391f\index.txt~RFe59fff2.TMP
Size 173B
SHA256 844eb7c74de7c18f2ff298e26008aea2b458cb5b119b2dfd178d4b1fa0c8f93a
MD5 adfd81859ee0673a694c95c18d310cbe
SHA1 0c6edf76658e46c1026a85347c1d2a4fe021d68d
SHA512 e5c14483915af160bbc94f55adf6e7b92967bceba1d19146119c2368250e7b1bf88fa771c5ad3077dd346f538888c0cff85b5f9d92815ba9ddd6dbe49bbf6298
TLSH
T15EC0809715EC11041E5141955C323289ED787D948C454F9C445431C46578537050BD6D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f8f524e3d7ecb8314e5bb25f8d4b6c16ced78a482017657a385b7d391a4f1782
MD5 199db73b05250002187c3948400ab7d7
SHA1 c66e1a8196dff019685d4e0b8556201500e150ec
SHA512 e0d9fd100256b8478818e060f955d1538a08eccdc9138a0f7aab351ec13c15d081bc52449cea173af91d9c5e2ffb410444735da6945a79881128c0653830d6f2
TLSH
T1C4B0120588019101C04603B41142248871145F189E1B1B0193E46923CC3526180180A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 525c2f4194ad2703ff0ca4806e366500b7655775ecacf8397faf088686f29b4e
MD5 d26cbf94b038e88d647a95375e1cc9ab
SHA1 9976f2465ed3419d8ac3b7eda25803395c78c792
SHA512 16d92df5cff3813222443fa411ea3f822dcaf34c0b5cc326709c1a9574b5c65b1ffb8c703806fccb3a8c86e9c42d8982f5340aec5fffe416378b797bf28ceb5f
TLSH
T1D1B0228FC0022202C00203B022C2A0E83020CF30CA032202A2E00A33EC2E23280300A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 1c1fa08b432867cf0ee818f942c4a1efa12919bcae63b99b4154ecf41d3129b8
MD5 cca8817fc04c4cf8c1d9c07452531a1d
SHA1 e6bce1591b62f23be2937d292d48609a483da25e
SHA512 d610a4d1ecb70200afe229ef90346c2134206472a0a9fcd20670a7f2466e4eadb23ea67c4622086aa849b2f5c0dfc16408b1c096ff2509a7c1a572a74ddb87a3
TLSH
T14CC01223C4056002C04603B410C3E4F87218FF60CB1F2BBD46F45916DD34175C235156
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f175500951806a3f209901a614737bc349a2acb9eb6f2c0bae3a32719720392e
MD5 ae1263c3ee8652d271af1eb982a73f35
SHA1 9df1b82bba7eb670c6e881b496c3ca4fee4db789
SHA512 a96ec8497cd1cbc6c65334cc29cba3dbf531706675edef411ec9ee78d03159a8ad69ba06b89bc23c0409d673ed77f39d0a766c2bcd6cc50f8163436d46d1da18
TLSH
T1E3B022E8F0008803CF0803B020C0E8003223BC200EC3A2033CFA8028E8822EFF2B00A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a205cd43d2612e9aaa61f4d767a29ae654bce2bd18811ba97190f5eae4d05073
MD5 80510029f3f2bd201b8d7d7fb6f34b46
SHA1 16516e41f055f5279e4b5b0e60c155c8a682195b
SHA512 b5460804bd86f760c280b9a3b47b21c1b724fc73626e7f7db63cee12a593e76beeba61de3d5cc7573b2bd65f1cc1f2fd76384cc256cf8d6bac1de489d356fe3f
SSDEEP 6144:5GzcSsbcDLtNygP4t/5YTEJoHZqZ/ZLW3Exe:5DVbg5R4t/5m15qZ/piQe
TLSH
T142342333BF823F375D94CF64B9173AAA43F600999070C109A6F47BF94582E46FD894A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bafd39d6df82fb5ffdc43983c94c4b0030c383fcba9f4e55783b127052220043
MD5 ae3c4b580a7346609781f4cbb663ef14
SHA1 d87fbed4d8363c1575e9d178f47772c61a32f7b8
SHA512 ce4ea1e4d200ddffd99d56392506233d366c513a28f70922974e715cd3fa7401e98fac87b9a0da21811ed752d9f57bcfbf9dad4f2d15ea562fbe884be17174e6
SSDEEP 1536:6qyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:hqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1F8C30237EBC25E335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5318e55efc831c5366e66c9b4fab5684fd6b886f37479dfd84ede3a2a9b90c4a
MD5 cddaa6fae3fd8c90ea05bdb2f1359c59
SHA1 2fb08fb73b771f6c2be3901f17354fa87da40fb1
SHA512 74cc51bdee542f5ce3935e6db1617385d12acd4be83ca15f663c2d00c67089783637ce41aec229ced6361f4b1c69a3562b0496c92c6949328fb283fb1beafd17
SSDEEP 6144:CyGzcSsbcDLtNygP4t/5YTEJoHZqZ/ZLW3Exe:bDVbg5R4t/5m15qZ/piQe
TLSH
T1CB342333BF823F376D94CF54BD173E9647F6009A9470D509AAB07BFA0442A55FC898A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DragonBurn-usermode.exe

Path C:\Users\Admin\AppData\Local\Temp\DragonBurn-tmp\DragonBurn-usermode.exe
Size 2.1MB
SHA256 0a58cf4fbc543187a5d087604c611591ded49d14c604e818f7971c23f739be84
MD5 37def4b715c5642a9ad2e17f36b86f16
SHA1 0270b8ce23288e7ff0450f76b3c9a73e84f2c8a9
SHA512 9c7a8501e4d60c16d7ebb0423e33049556a3d24fe2063d5841cd22a3f01d751083b7b30b71c048578be971a887032d08404de0eed67d595f3acfefe21a795f9f
SSDEEP 24576:pipdVZehGf52i91GsXSeSrmuUk6Ih0lhSMXlFEY+RJ7Li0KKzOWbZZZlj5AVXXUI:6VZe4597GqKrmuUk81CRsUOUkQS
TLSH
T1C4A5BF43F3A2C1E8C12699B8CA93A387E7727C544B2042DF37DC5A19BF9B5D09E76640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4244-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4244-16-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4244-1-0x000000000042F000-0x0000000000430000-memory.dmp

Download