792a459d12b2d89dc27175d6806cc247ed04b3fe0e333b09aab42dc82cc4739e

Analysis

user interaction
yes
max time kernel
809s
max time network
811s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LustCraft-Mod-Forge-1.20.1.jar
Size 37.1MB
Sample260809-ws8fpabm7s
SHA256 792a459d12b2d89dc27175d6806cc247ed04b3fe0e333b09aab42dc82cc4739e
MD5 f7b0b3ed1c0bda9e51906a8b1a4f0ab6
SHA1 01ccbfd0d4916313ab75fb34fe0dcc335aac57c6
SHA512 08f3faf01766879a66fc6f37c77a2ced759f0318c30a6fe269e744e63e8d1c65f9f6cc7b33f9b4eb0cb8557554c16cb8ff9dcea5bbc46b9e7b6c6c09f01e9ba4
SSDEEP 786432:ufv2t7vRWt1rGx7t73nZVZsL/X4iu7IBojfJxpSXKWy1k:Q+1omJVaO7DT90KBk
TLSH
T1E0873398EA82F1A4CC0FE6F959F051836A542DFA015D832F2E3DC079EFA5C150255BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2448	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307730617268147"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2752	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
2112	chrome.exe
2112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE
2752	EXCEL.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 176	3048	chrome.exe	119
PID 3048 wrote to memory of 1808	3048	chrome.exe	121
PID 3048 wrote to memory of 2448	3048	chrome.exe	120
PID 3048 wrote to memory of 2244	3048	chrome.exe	122
PID 3048 wrote to memory of 1808	3048	chrome.exe	121
PID 3048 wrote to memory of 2244	3048	chrome.exe	122
PID 3048 wrote to memory of 2928	3048	chrome.exe	123
PID 3048 wrote to memory of 4332	3048	chrome.exe	124
PID 3048 wrote to memory of 2928	3048	chrome.exe	123
PID 3048 wrote to memory of 4332	3048	chrome.exe	124
PID 3048 wrote to memory of 2068	3048	chrome.exe	126
PID 3048 wrote to memory of 2068	3048	chrome.exe	126
PID 3048 wrote to memory of 1892	3048	chrome.exe	127
PID 3048 wrote to memory of 1892	3048	chrome.exe	127
PID 3048 wrote to memory of 340	3048	chrome.exe	129
PID 3048 wrote to memory of 340	3048	chrome.exe	129
PID 3048 wrote to memory of 1296	3048	chrome.exe	130
PID 3048 wrote to memory of 2052	3048	chrome.exe	133
PID 3048 wrote to memory of 5008	3048	chrome.exe	134
PID 3048 wrote to memory of 4432	3048	chrome.exe	135
PID 3048 wrote to memory of 3772	3048	chrome.exe	136
PID 3048 wrote to memory of 3772	3048	chrome.exe	136
PID 3048 wrote to memory of 540	3048	chrome.exe	137
PID 3048 wrote to memory of 540	3048	chrome.exe	137
PID 3048 wrote to memory of 3576	3048	chrome.exe	138
PID 3048 wrote to memory of 3576	3048	chrome.exe	138
PID 3048 wrote to memory of 3348	3048	chrome.exe	139
PID 3048 wrote to memory of 3348	3048	chrome.exe	139
PID 3048 wrote to memory of 4684	3048	chrome.exe	140
PID 3048 wrote to memory of 4684	3048	chrome.exe	140
PID 3048 wrote to memory of 2112	3048	chrome.exe	141
PID 3048 wrote to memory of 3144	3048	chrome.exe	142
PID 3048 wrote to memory of 3144	3048	chrome.exe	142
PID 3048 wrote to memory of 3176	3048	chrome.exe	143
PID 3048 wrote to memory of 3176	3048	chrome.exe	143
PID 3048 wrote to memory of 3692	3048	chrome.exe	144
PID 3048 wrote to memory of 3692	3048	chrome.exe	144
PID 3048 wrote to memory of 4792	3048	chrome.exe	145
PID 3048 wrote to memory of 4792	3048	chrome.exe	145

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\LustCraft-Mod-Forge-1.20.1.jar
1⤵
PID:1636

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ReadWait.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbd0f3c728,0x7ffbd0f3c734,0x7ffbd0f3c740
  2⤵
  PID:176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,4046604534537581394,9582071749593357544,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2724 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,17202933084107663605,7374367129020302173,262144 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,3956919454047920706,16583910940305348846,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,5390807881885478447,17954631953678337611,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,3585254533051184795,1538619248567719798,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,13907153474201287572,15375881208072285478,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,14047759829047454649,6102468521273723865,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3260,i,12589233724041126174,17169030810903057416,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,11797207590179758908,14743102488350511428,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4968,i,3984066911104635110,8126176692688842645,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,12341140935716225081,14523287334927018317,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5148,i,12443410971744724031,16109182535560556318,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3476,i,13769164513689849759,7806732491642934596,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4456,i,14458909800511203321,2606385763902002786,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4868,i,14822388675940463317,13295693615792561345,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5104,i,11475450176502693815,9835655834304992911,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5944,i,5283797353614764731,7380020486544500395,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4360,i,9574512367580127016,17308850428608941065,262144 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,6193705435161979583,2839015874389226774,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3352,i,13606805760583445801,2894862652544358229,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6152,i,8044329966299289902,4649552623296162338,2097152 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,8639657374098564486,4651569800385763740,524288 --field-trial-handle=2172,i,17228554099940782178,14055208241708173770,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a9d2c8968e0dee65c4d5a4247f1e6406c5d1629bec1988ba51aaddb07f1027f4
MD5 1db36f421db6b7762a54dbc4109a9f06
SHA1 2395ca01e2838a8241ba6e1dbbab5071db0d9336
SHA512 40e2c1b1cc77f6caff0b919299dfdeaef5bf4ca8ff518551cb04b4d14d6f8fafc71459f810fce1303b45696086032c43975ef7ecebf786eca365ed29def02ef0
TLSH
T112E02B9DC821FC771CFD476D5068474ADA20135B1BA0856F3B3C85088FB16770189C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
Size 39KB
SHA256 2ec19e2bd078bf4c33fcbad2ea3b159169ab515fc8f17eb5c50274b5a6db8498
MD5 234487eaf3fce96c77832b620b5f8496
SHA1 ff7abba15513582851cbe55040194a06d7c9b6ba
SHA512 74ace4d87c248d2fdc602e4baf32e29a4a960ff6d54db891efc15c4567316c00347d1b59c278ab9a863daedb526c8ef658e8073fdbd84f79758824aad612a8d3
SSDEEP 768:Fw7i+/DSd8qxs5SOxiM4owQ+ULus7k+N00C06QgQE4uFdFx0dQgXAx/pC9:F8u84QSOxcQtpIqo10dQgQxo9
TLSH
T18603F1BABA520639F5E24388FDB84CCDB9BA0C00454EDD7234E859762D6A43E87151EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00017b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00017b
Size 608KB
SHA256 e514ae8310228063d1bec43a374aa49a06198b9fd0a248ec362ff4d14f944f8c
MD5 457b215587382e76d410e3f9c15ed85c
SHA1 e7637f7293572f12bf60f2a743d1c9586a6070ca
SHA512 67dc3cd0bf67bf65e4a9ef44499b23dabd78860f518b539ef50d05c0a55c16d58d097261b73d4a64d688343f20c4dd5283a76fcec949ce202a4eb5e28188ed94
SSDEEP 12288:ckgFGBbGHyrj62PJFufjzJb8VJn4QxSbyFXi2H6BeYh:7BT/62PJcfOVqQxSIynwYh
TLSH
T19ED42383BF09D96DD544303CA0A3936437B3C2AA62CCDB97AD1AE4B61D527DC6C502DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 5370d03b6ac015629db6159b373c69f635b5f285ffec6e831f8a4abda735a511
MD5 49e14b5b1cce538a60fc08116ee90262
SHA1 0d7e70d61776125beb6a166aea4dede2a80fbd2b
SHA512 26f1e676f25811dbb4f57836d89b48ff0c66c11c0c13d918e38f277a23a25a9b70c4e1045ec4e69a670cf73a2f2869bf47ac9425d08fd8663100c0cc57d00908
TLSH
T147C092688145601BCBAE87B31A67402131507D68618253B382C2C98EBD72AA0AB56655
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 731aff8b543e5b3669fcb13360e2ca1364084a561837346cbf073aab08b7d5bf
MD5 180d3d5ef69019089afd9ceff40e7a71
SHA1 c4200aed6e2e8d4bf8fbad701f80ba508580a52b
SHA512 e9608f6955679d168e8df0833671699176eb6794a353bf64c16e6f1517b8f2f839de824c1f955f9f2a7a99f26fcf8aacd2722f6a4b4e6d22bd75dddc694e29ec
TLSH
T12C11CC1120489A99E7598EFFE9D280603535392E81B3DE1B07F58FB45D72BE0C2D90E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ea6b88d5f365a791761e1194c91ef6463a82c9a31d2c2115c54ca8596e3be72
MD5 d73b35f311a4e50a611dc857e8068bef
SHA1 4d333c34afa0454d0d3be45d4c0c304f23f657dd
SHA512 06fe0289c6979396b338c62820a287ac2b4b8fc5695417fd761a57825d8984022c639961e5b7a3b11ae0da48be670ce41f3582ed2fc8bf6f99dee43e006bf569
TLSH
T1BB21DE55604C9549EB044AFBE8D288503531393A81B3AE5B0BF1AFB45D327A3829B0E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 75c651bbd5e693c556176591bc55b3b94ef285ed30ed99e4837756174ced18c5
MD5 2bfc7d5ee87ff01ae43aecc05e898e69
SHA1 77664924891208d40c976b7bfe2f43edd1b9b3f1
SHA512 906269c4e0aaea4605ff88bedfc02cb543f73b2beb80773292787ad7f556eaadb44e647529db45001f9497cda7e8ba5c9f3e3ef39548f03687fc2e3cdc786d92
TLSH
T16E41A650504D4449EB0449FB98C35C20363F787B91B7AE9B0BF1AFB49C327E28D9A4D4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xnxx.com_0.indexeddb.leveldb\000003.log
Size 85KB
SHA256 5ec0cf8375f5c95a7c89bdf70a78ccc8ecb74b6289b5bd6adf4608991ad8fdf2
MD5 806fcbddb3065288edfd44446aef9c78
SHA1 8e7c79d76ee04d7df0b7eab6106eba96f1baaff4
SHA512 f1eed642464d52579823b52188c336008d73bbfc3a570e6e7a7ac36cad47b8abf481bb98519a7f6089cd9d8892f3a3dc2b4c6d66d1878e2801d0596fe1e6344c
SSDEEP 1536:gSRDdQtrtpt+GQdW15FgMKiGg1mg4Kiyg1/4Kiyg1IgzUMcpnNC875mW/rL3jZc6:gSRDdQtrtpt+GQdW15FxK2mtK6AK6IgK
TLSH
T1CD83892D59C55923E0B6857D85F60BD2AA237E427938CC0F91C9AF1E4E73A025CE1F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xnxx.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xnxx.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 26de19caa81f6875e2eff7a786dad5ed719211095a49939af90647dd30aab252
MD5 78f635aeb3835b3219fbca3d5e2f1bfa
SHA1 31436d8f690e583b61302ba89a70b4fcec48eab7
SHA512 37ee466eb1dc6e239cc84ba0a8b3fdd6d4e1fb6a1fd6168a791f28a70be3aa3770aa5632406251d5e0c32ef10450b59e1fe18d4a3971f48a48fb14e6024c218f
TLSH
T12DE06DA856CE8A7FF898C02772BC7B19D6E2B55C9ACDA8921B01D464628480896E8760
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xnxx.com_0.indexeddb.leveldb\LOG.old
Size 345B
SHA256 39ef523267af25745caa7b1ede38675b36b585a9935ddfc68673a2558d3e3c5a
MD5 3a86f85e75d6d4f193cf979554a97625
SHA1 fb95c7980cf3779137ab101c6c6e6c3b36969f1d
SHA512 53995e5f6b947e5c16b24269f98c91307016ee22b9711f25254317d892dd2aea28c779a385cf9090abe4ba86c21dc2a258011e30c0b08deedbafe4ec633476c5
TLSH
T195E0D82D59CAC95F7098C0A775387B0EDAE7651D9BCDEC470F01D90471CA408E4AD360
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xnxx.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 d080a4ef0be9f6b8f49f85bdcf1cfbef1c7488692953eaaf56e21fe29756f6fb
MD5 826c30bfb752e191dd1b903e422ff4e2
SHA1 c021b30d4b43386c238cd8a83134c07c0ac5d89a
SHA512 df3db2b67deccdab6a5f780aae2d2a67cab0c76984c8e8f1acfffbd3b47e1bbac5234f298f8e2312605bf0d057bb940eae58e2b975c013fa06f3f1a4c0aa2446
SSDEEP 384:DQ41kCaBKd+N5qITL51BJ8RaI4ItVJCdWGnfGe1GV17N3iguA0Qv8lgp11AKvNP/:Mioep1Cd2
TLSH
T1A252B0F7C3D8862DD81152F49B256E1BCE2A1928532C3C67C9D5AF0BA3E2471E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b93b8a5824eb1f26656c4ce8bbfcc28d41c8fc2f25b7ddc0c15ae9e7927e1753
MD5 47093ef570cf18743cde60039e81036a
SHA1 54a90f641e2a35b8806c04bf282ae34d0ccf3a5b
SHA512 902355bba7ec54d13872d5b64e24735827f2f057c25363abb99a7b5a3b7dbc8947bd9828e8e32b828959e399e2522d9ea7990f6fd257af6e3b323f7a49fddf92
SSDEEP 384:DLuwWtxst/1Zg56BoEN5JJJPL01BzaI48CdWGnfGE1GVRbKu02SvGeuZSqNPaqq2:ZPzezzC8f
TLSH
T18542CDF783E4866DD911A2F4DB15AE1FCE690924432C3C76C9D4AE17A3E2472E28174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 17e3cd7f4da9330ba3d17991249362ef879991a6340c04cdaef84e3e6a23f605
MD5 f29d1cdb531df868b4c42e78500786f8
SHA1 3c060c19c220228cf9ed3a477f17cc6fe279d834
SHA512 f156fa51c2e230a6197616739e5b2fac9ee947df6d088839bf6de2e6616a52c1f1cc40dd2c38ab41df5e72d8b8797655bff1775467bd24e10c959f44e84a23fa
SSDEEP 192:DQ41kCa0BKlaI4ItVJpwFV6k7T6NP3aPifPLfGnfGeJLEGVIyCmh:DQ41kCa0BKlaI4ItVJpwFV6k7T6NPaqg
TLSH
T16512B0F3C3D9862DD81156F8AB25AF2FCE291924532C3C27C9D5AE1B93E2871D24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 aba5aca2159b638ca8e916ce34208f29a484652ef89ff3a661038b3c2a1642ed
MD5 6a5ba0a75ca8b3adcb5f2f34f5e491bc
SHA1 f217cb72ec22a68680b1acfae74bb9d4caba14db
SHA512 6695075a54577c4426538654f6b7a2b68000976cb16266cdde4244571662bd788b87f9f0594fdeae3cca7f8b288a0be6029aafff8df128269aac9bfb58b38e3c
SSDEEP 384:DQ41kCaBKd+N5qITL51BJ8JQy1daI48CdWGnfGe1GV17N31uA0Qv8lo1ApNPaWqV:MiWepoCd9
TLSH
T12F62A0F7C3D8862DD81162F4DB256E1BCE2A1928532C3C66C9D5AF1BA3E2471E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 2abe31722413acd3fef3a7b5215182562242e8696e7be59287676b68e63f2136
MD5 637e174bbf2a665d515ceb753c247a93
SHA1 b77e80a7bac45e66e88e0a3e286a9ecc9da610f7
SHA512 bf6f57668c149a126ae0e1e5198cfa4a17b846b1746823b704176151e3c93a9fb6b78820c1f3450be6e0828a186b9b1a54ff1c49257f35813cb2ed8de1ba68a1
TLSH
T14F113FA7D26EB57B506C45BF1E04F819197AB8310282A9F4DBE681FDB0904F72F13467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d7cea9c0502fe6db8e8f71cd6c63c5960f4f1913c8c4dd4fbc855012072b0763
MD5 7281e5d9faed71c6e1002c6e92e7daee
SHA1 36d645f61cf951e2697d103b74d0434b7e82251c
SHA512 a5cbe098c1f8afb5d755d4aa146ab54510c1c9216c9eda62acb4b806e10524cded04b6cfa729ef562b565f6f8379cdd9b540a4587fe40904ac5ff6481cbb7a20
SSDEEP 192:5hRxcBzsztSKO8JkLv7ApAPRpGGgMP/9qHsb+WNCfAG4awExnJWriVyIsnAUgraJ:TRxmzszQKKzk4XpkweKENwie
TLSH
T17A52D82AF9103E7B9CD7C229F9557B27E3F1102964942ED4E6FC992C14E75CD211B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e91e374f22cf54d56c0a22a676e0aa20f9e69391a69f27d7fdd9bac65d08456c
MD5 c2cc7d25769fa1289d8c359909590c57
SHA1 82d275c89a2eec950eb040c29c10c2843000b573
SHA512 22903db446f588c886863e97d8ee75939c3c53e927c47407281d368404ed037fec6c19a95cdab21acd13668c51ceac8815cfdf8dfe39df887da9ece802d04be0
SSDEEP 192:5hRNsztSKO8JkRv7ApAPRp2GdYE9qHsb+WNnAG4ci2OnJWrzVyIsnAUge:TRNszQKKBkUXlkwZ62UwVe
TLSH
T16442C72AF910693B9CCBC229F9657B27E7F1102964D42FD4E6FC992C14E79CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 79d68682595218cbc47e499cf6f2908f5ae9ca69aa64c14814436cf7b6a922df
MD5 fad1698ce35a8b5a2be501d4639d404d
SHA1 04709667c7c7cab94789bdbb93f44981a3dc2d5e
SHA512 356c73fac24db371bae567aae9bd508e99444c0a87759ee93e082284bcbc7213c7bb29ba6af962f1c6678871fc6ee6cd2387711f7ba89c45079a29d7f48b2152
SSDEEP 192:5hRxcBzsztSKO8Jkrv7ApAPRpGGgMP/9qHsb+WNCfAG4awLZO2SnJWriVyIsnAUp:TRxmzszQKKTk4XpkweK02Ywie
TLSH
T1B562D72AF9102E7B9CDBC225F955BB27E3F1102964D42ED4E6FC992C14E79CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 318bb9562f917624411ed5c3abc6d7ba5bd6ee7e8e9d2751bdfacbdfeb2ebd1b
MD5 19a019c70a24512ba93a85b2a58fe086
SHA1 bde1fd137c6897d4cf6eae033e0f778009802b75
SHA512 d3589b9c7ec07b61e43dab990577728cd3ee1d173b4f422296a1782d805228ec287daf4643348b8155c1cba2b648742108bc67c6c956dd01926ba1489258c526
SSDEEP 192:5hRxcBzsztSKO8JkRv7ApAPRp2GgMP/9qHsb+WNCfAG4awEnnJWr4VyIsnAUgraJ:TRxmzszQKKBkUXZkweKEnwce
TLSH
T10A52C62AB9102A7BACD7C229F9557727E7F1102964C42ED4E6FC992C14E79CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e5615a1feb3f5ad1179d36ea4cf473f14e716c8aea733d09fdb05f3ca09a8adb
MD5 4eb6bb36b830eaf848131778fd23d641
SHA1 440ee0bfe8d42187cf2cd869b8588230524ba54d
SHA512 14b56d5b1e2252de3923e90397d00e58c8b1ac4fc71f5527f93a637810ec2cb48622611b5b8c10119a5d8f21b711e599915fb64b2dfd38f226cdb4e44c5348d0
SSDEEP 192:oRxcBzsztSKO8Jkdv7ApAPRpGGe044Ky9qHsb+WNxsOPkQgvBawLdic+kD2DnJWL:oRxmzszQKKdk4Xfkwmng22Dwie
TLSH
T17962D72BE9202E7B9DDAC225F955B727E3F12029A4D42ED4E7FC892C14D7ACD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 d3dd14400c4ebe87be26259f8b089f7fa2a7127e694ddc07b53c98337eb2466d
MD5 b8dfa8737d96c4ba7885f2276ff2bc27
SHA1 4275033fe3b578f54f14d2519f1cb63c38f31920
SHA512 b01092d72d4749132f3a94b21b637d19103c1aec71338388d09a3bf9cdffbad2c8a5994088d42a42ff633bf610fe9ea7ec070c16a93f72f1cf4248874d9d4daa
SSDEEP 192:oRxcBzszWSKO8JkXv7ApAPRpGGe044Ky9qHsb+WNxsOPkQgvBawLdic+kD2DnJWL:oRxmzszTKK/k4Xfkwmng22Dwie
TLSH
T12A62D72BE9202E7B9DDAC229F955B727E3F12029A4D42ED4E7FC892C14D79CD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\eec84695df9093f912683babdb0cbeb5c3be2046\fdcb9520-afb0-4632-9beb-7c176619a735\index-dir\the-real-index
Size 96B
SHA256 2edfb3e557f7a80d1878763772e49906dfd51a7d8e781ff1d3a55c1fe2498a39
MD5 9710467f9a51c84701b6cd6281aae030
SHA1 c3f5668da5a1536113ba9a62ef1d6e7b3c92c777
SHA512 41d9e40e568dbcf9e87c0ab7777d35744ebfddb829528ae1c399ce7d93c4fa494e00c15980af7e27523655523c940da4d248942aa7212bcb74c4588d82841d26
TLSH
T125B022020002C802CCF233F2300300CC23A00C30000323A3A88888FCCC2A0FC3B0F2A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d3aba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\eec84695df9093f912683babdb0cbeb5c3be2046\fdcb9520-afb0-4632-9beb-7c176619a735\index-dir\the-real-index~RFe5d3aba.TMP
Size 48B
SHA256 f8ad08ac2a68979c60bcc627f4576f4b0d31e01fa8d931e4769c697728a474e6
MD5 2df0537e17fd2f633fb3536c042b52c5
SHA1 32cb1286fedcaf573fbc145e2ccdaf4869d4e92c
SHA512 4495ee5d591c9c3e0725a1183b3b80c5abc19504a390e0340b875f647efff0b10eec259cf7057c2d83130a17c9402cebad0c51b6fcac8140d58801f5cd2c86e1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\eec84695df9093f912683babdb0cbeb5c3be2046\index.txt
Size 135B
SHA256 cfdaffe5ae722a85f0a4388e25a78e32a1b81a2b1ca71978ed70109a8337d885
MD5 22864fd063283a4d8ccfb9ff6c2a0706
SHA1 9c4c49b14b17de9cdc47b38a4c6be20a303930dd
SHA512 3ded8808e521136a64ec7f622b52e356ad311dc5775488a43a90e5f5595bb2e7a76a4ff13337a45b0116ae12493f1c8885254577bdd17f06268337eb22653352
TLSH
T1F0C02B4B1BD08008DE2D88C02162300CC233F158CA8448EEA00081120010D330C24F13
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d59cb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\eec84695df9093f912683babdb0cbeb5c3be2046\index.txt~RFe5d59cb.TMP
Size 140B
SHA256 08b78a64789b3e007f4fc2067c258b0f189ca1ec1511ba92735cebb773ea4b27
MD5 46a15649e17c779d6058fbb0b45c40cd
SHA1 4999557351c1318a044b257a581b198953711033
SHA512 317803f81cb3c8d0a8ed26ad1e3390c57ce9fd8e338ac467950dff6ccff46e37493de75f6d6fb4070435da2aaf88bfc45e3567bc9becb6a79bab8537cb11493f
TLSH
T1BAC02B4B23E1C00CDE1E88C15171300CC633FD54C9C048EED001B1021030E334D28F93
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1903697ab5454d7643c1a34abc2e7246d10133a15026fb54ec5de294f2760600
MD5 98f5e6961fde3d64d806010f258088fb
SHA1 f864596a7196399394bc61f0197812adc8ee4b65
SHA512 e68cfacd2f543652af971569cb6dc9bba082b18cb6b7decd30108434ff700c2a671b85c1ee66adec0fafd6c5c39cef4d5a69ac5ce619360002f7d0f34eb0c87f
TLSH
T142B0121085115111C48302F411421488B1949F50A70B1B1143F06A77CC351658414150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b5560.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b5560.TMP
Size 96B
SHA256 04502f85d49148cfd34284a23383faea8d6b9fa1346648eb97364df12ad7bfa0
MD5 5a4a3a4662d31e532a3c0934d8833714
SHA1 224d427fff49211e026af4485d46a1680ae5e211
SHA512 c8b1e1266ee61a0d0bea829a80cea27f1eee8800ae4d1020e8b3c1e96de39ab5a6132721ac3b39a1acff0c8e0d86eb9174ab56b212571271e50b808b8a7b0c5e
TLSH
T113B02200C002A202C00203B03080C0E8B0A0CF38CB83320A83E02A3AFC322320020030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 756a21179b982c56eadb80f18dda454050edb7ac40684a8e8a1253449d1230b2
MD5 1a119b68aaaf29482548039c7a08d183
SHA1 000512a075acba93842ab723c2365d4c4f474fe9
SHA512 f16a301bb0d03eb5e71c4af6019317bff13547d5224b86eefe05228a332b71dadd3f7f2d6f948ccbadef4131044a3de88da50982ac869ed6abfa4d6a6d172e69
TLSH
T142A002650980603DD14C427091E101512B24AC7001C35201C895449A9CE41818A23D00
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c9a7d4c8c552abd8cbbf89802f8d82c8ec21c6df1e405ee24eac72d1cf6d41b5
MD5 58f87ddc21b37a4e22e66e8c05027ef4
SHA1 9a29d7df5bf1f9272d8a47f5f7164bc23a85e7fb
SHA512 cf79c64cae5735a0d8adb7beefdd4f476f37b96d390c777a213e6f5258218c48d1f5ddf3262f8f528795e5f2043ff71078fc169eab8f52560858e69f6d1b7dd1
SSDEEP 6144:CX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAo9:CoNweqYhLw/7lp9oBGcAo9
TLSH
T139341372DD326BB95CB9ABAF300D1E2A4FF295E9D568E542C9C57A04335DA8C070893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 fdc7b7d506ae281a6724a93da721d92dfb314e9f9b511bcfdde1c8facd612b32
MD5 a907d62c422f4bb842e0928df5824d53
SHA1 7f844316f627fd793f6839fbe11f6a764fca54dd
SHA512 4f603c2a0139b71401598ac5f3f5e9476fc5cdbc9c59896a9efdcceddb57adc8205b76803d3e0cd6d8f807b80d0ba545fa97a66863dc4c7c14923178a42fea0b
SSDEEP 6144:nX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAo9:noNweqYhLw/7lp9oBGcAo9
TLSH
T13C341372DD326BB95CB9ABAF300D1E2A4FF295D9D568E942C9C57A04335DA8C070893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 845f46b2ed06294a8481718909127a4dc9dfed86e17f83e247066826d3c78544
MD5 66f73e77432e3f82ce1f2c8d7babf203
SHA1 33e3a70bd993dac7d53e3abc907a73f361647fd0
SHA512 c67b4b2b6205f2182679f07482f60192c75da68a8354dbb7841a747a2f76e0bc0dac7382d0219c31241ffa993404fbf6173f0bd3c7028f4bbbffbe8533b0916b
SSDEEP 6144:xDX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAo9:loNweqYhLw/7lp9oBGcAo9
TLSH
T1C3342372DD326FB95CB9AFAF300D2A290EF2979ED658D946C8C47A04335D59C4B0893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 43d396f3d0ccd21f331bc2d014a39437b9d929059a7cf91da5ab5eacd789151c
MD5 6e4b860e4bbc487264b6aa4ab031ea8c
SHA1 37a32711ce2a9d1b4fef48b5011b2932fc58c362
SHA512 fcbbdb95e5afc83f04fc2522bd7bf07c93b66d297cf3991257f43a53166bf844bb559fe4abf2e7c4f347b6f8c29f1c9294c3db952ab89a4c13a78cc90bf03eee
SSDEEP 6144:BDX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAo9:VoNweqYhLw/7lp9oBGcAo9
TLSH
T1E5342372DD326FB95CB9AFAF300D2A290EF2979ED658D946C8C47A04335D59C4B0893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a9438092ecad79308a80daa58da8fea2ec428836c801b2c6bd4aaa06b3490c74
MD5 e15b78608287c2629d1106e31333ff01
SHA1 6d6feb9568a514dc8f5105e1fbe8b0f4f33b184f
SHA512 c097837b34cea433f42ca5a7d1d3d7a2124df43ba71d32f55e2c870b5279422be1231adf5e6e428e952cc415b5b23e7e95af25033c7a0d2e4be29da326d5779b
SSDEEP 6144:pDX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAo9:doNweqYhLw/7lp9oBGcAo9
TLSH
T18E342372DD326FB95CB9AFAF300D2A290EF2979ED658D946C8C47A04335D59C4B0893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f228eef55dada240eb1916c6e38f7dce6423cd3c6fbcc607639e441c80d2214d
MD5 36294cfbeaec11d6c70f0e9c1f560989
SHA1 57dbc9e3399d0c50a8ecb439be17f6885cf1b15d
SHA512 dfdce7324ac9b846446610526b634fb65223794c6cf2fa4087b77642445a59c3d55d8bddfc380f6432e8b341c87c5bea76fbb534b54f4e654c3999de73fba100
SSDEEP 3072:AoGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Em7Rkm1tYpBeh2BAog
TLSH
T132C3023B9D75EC3B5CB5A74EB08E0B1F2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1636-2-0x0000024741EE0000-0x0000024742150000-memory.dmp

Download

memory/1636-11-0x00000247405C0000-0x00000247405C1000-memory.dmp

Download

memory/1636-12-0x0000024741EE0000-0x0000024742150000-memory.dmp

Download

memory/2752-25-0x00007FFBAB110000-0x00007FFBAB120000-memory.dmp

Download

memory/2752-14-0x00007FFBAD870000-0x00007FFBAD880000-memory.dmp

Download

memory/2752-20-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-21-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-22-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-23-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-24-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-19-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-15-0x00007FFBAD870000-0x00007FFBAD880000-memory.dmp

Download

memory/2752-18-0x00007FFBAD870000-0x00007FFBAD880000-memory.dmp

Download

memory/2752-16-0x00007FFBED88D000-0x00007FFBED88E000-memory.dmp

Download

memory/2752-26-0x00007FFBAB110000-0x00007FFBAB120000-memory.dmp

Download

memory/2752-17-0x00007FFBAD870000-0x00007FFBAD880000-memory.dmp

Download

memory/2752-13-0x00007FFBAD870000-0x00007FFBAD880000-memory.dmp

Download

memory/2752-43-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download

memory/2752-138-0x00007FFBED7F0000-0x00007FFBED9E5000-memory.dmp

Download