271ef3b1c7604451d375407cf8a1eccf8536e02728903f76b2f88cc6f3e4c3f1

Analysis

user interaction
yes
max time kernel
198s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game.exe
Size 2.0MB
Sample260817-e833gatvft
SHA256 271ef3b1c7604451d375407cf8a1eccf8536e02728903f76b2f88cc6f3e4c3f1
MD5 04b93a49132869433ad87e0d0e30b7f1
SHA1 498c62d6ae93c4849ba199b982841a943115adaa
SHA512 ad47d6e189363e3914ca277c7f78440a9ac6ccc2378545c1f9e307053d07c31c3f74316bad8a150af6130e1830c92034efe92393dea7e9933e5cd96445d52b6b
SSDEEP 24576:3HHlrFzch8at7SOsBI80T3E2iq5A7CjKlFlA0xqJNTw5MAPrmqyDZ:3H5FzchZSPBT0zE2DAuelFLxsTpH
TLSH
T119A54907B66548EAC099C078CE1AC1319B71BC4D4BF565EF36907AD63E36AE43B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6096	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314150836764836"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{408EEF06-618D-4BFF-BE75-5671F6C1CDE0}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 5100	4432	chrome.exe	81
PID 4432 wrote to memory of 1956	4432	chrome.exe	82
PID 4432 wrote to memory of 1956	4432	chrome.exe	82
PID 4432 wrote to memory of 6096	4432	chrome.exe	83
PID 4432 wrote to memory of 3440	4432	chrome.exe	84
PID 4432 wrote to memory of 3440	4432	chrome.exe	84
PID 4432 wrote to memory of 680	4432	chrome.exe	86
PID 4432 wrote to memory of 6004	4432	chrome.exe	87
PID 4432 wrote to memory of 680	4432	chrome.exe	86
PID 4432 wrote to memory of 6004	4432	chrome.exe	87
PID 4432 wrote to memory of 4556	4432	chrome.exe	88
PID 4432 wrote to memory of 4556	4432	chrome.exe	88
PID 4432 wrote to memory of 5740	4432	chrome.exe	90
PID 4432 wrote to memory of 5740	4432	chrome.exe	90
PID 4432 wrote to memory of 5480	4432	chrome.exe	91
PID 4432 wrote to memory of 1928	4432	chrome.exe	93
PID 4432 wrote to memory of 1504	4432	chrome.exe	94
PID 4432 wrote to memory of 4092	4432	chrome.exe	95
PID 4432 wrote to memory of 576	4432	chrome.exe	96
PID 4432 wrote to memory of 576	4432	chrome.exe	96
PID 4432 wrote to memory of 5760	4432	chrome.exe	97
PID 4432 wrote to memory of 5760	4432	chrome.exe	97
PID 4432 wrote to memory of 2568	4432	chrome.exe	98
PID 4432 wrote to memory of 2568	4432	chrome.exe	98
PID 4432 wrote to memory of 5144	4432	chrome.exe	99
PID 4432 wrote to memory of 5144	4432	chrome.exe	99
PID 4432 wrote to memory of 2360	4432	chrome.exe	100
PID 4432 wrote to memory of 2360	4432	chrome.exe	100
PID 4432 wrote to memory of 4800	4432	chrome.exe	101
PID 4432 wrote to memory of 4800	4432	chrome.exe	101
PID 4432 wrote to memory of 4952	4432	chrome.exe	102
PID 4432 wrote to memory of 4952	4432	chrome.exe	102
PID 4432 wrote to memory of 4552	4432	chrome.exe	103
PID 4432 wrote to memory of 4552	4432	chrome.exe	103
PID 4432 wrote to memory of 2544	4432	chrome.exe	104
PID 4432 wrote to memory of 2604	4432	chrome.exe	105
PID 4432 wrote to memory of 2604	4432	chrome.exe	105
PID 4432 wrote to memory of 3992	4432	chrome.exe	108
PID 4432 wrote to memory of 3992	4432	chrome.exe	108
PID 4432 wrote to memory of 2308	4432	chrome.exe	109
PID 4432 wrote to memory of 2308	4432	chrome.exe	109
PID 4432 wrote to memory of 5156	4432	chrome.exe	110
PID 4432 wrote to memory of 5156	4432	chrome.exe	110
PID 4432 wrote to memory of 2456	4432	chrome.exe	111
PID 4432 wrote to memory of 2456	4432	chrome.exe	111
PID 4432 wrote to memory of 1144	4432	chrome.exe	112
PID 4432 wrote to memory of 1144	4432	chrome.exe	112
PID 4432 wrote to memory of 3324	4432	chrome.exe	114
PID 4432 wrote to memory of 6004	4432	chrome.exe	113
PID 4432 wrote to memory of 3324	4432	chrome.exe	114
PID 4432 wrote to memory of 1656	4432	chrome.exe	116
PID 4432 wrote to memory of 1656	4432	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Game.exe"
1⤵
PID:4540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4dfcc728,0x7ffb4dfcc734,0x7ffb4dfcc740
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,6983422315390604169,15337837190282124538,262144 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,2031821376345218430,8371545613164176486,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,11735644582226299353,2866212242208925418,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:13
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,3821039220602811311,14096364330555794987,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,8092022744987930007,2945281191450935181,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,2104495371996729464,10590247489926143527,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,676487204106352354,8634285705649096232,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,11995259095382866407,2204339655911742723,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,15235686556495491394,3747578307040717024,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,8009403048721293560,8329850010172983397,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,3238507034488007836,5714709850160408966,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5740,i,11088897248971182851,553756375941512185,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4728,i,2477178572268251600,1202075741180650186,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6068,i,6155481988361763890,3407842063728208552,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4828,i,586484452609385958,3404134226608235244,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6168,i,6867462248815469851,13438758656078459619,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3208,i,6272856388990580420,5976256075622293005,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6500,i,6773224134976772923,674041133133221396,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6632,i,5349399822323852302,1521089854960994046,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6420,i,12916083838757918359,3571162695591968207,262144 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3236,i,7025636771425098155,3928464631214132356,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6184,i,5404524171944866604,164340813680707980,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6972,i,8796895796199001198,4155552620990292987,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6236,i,11608392640910073092,4552087781199344422,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6816,i,14960722315355987499,1708044451388952179,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6908,i,3603667395837923224,9209210042201935912,2097152 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,9892072916114814431,4129441703922659501,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,4830206077772773280,16362873570856315974,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:12
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,12955123336412201907,13568945686249781665,524288 --field-trial-handle=1876,i,918588739463131513,15641986971401013236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:1656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ec411acacf0882322c48c873e837e70fa89e250f240e13171c4e26b0e9e87618
MD5 b81395adf29e16496d9199c09856c22c
SHA1 fb0d1d2f6a1cf90df4a86b699deca192184b7059
SHA512 32beff9ffa34c912ce1b63b53c417d3a461477ac4fecbef39d5a920d9067135f2566e43030a45607fc58fa4c044242ac181b4c4158ca3fe03682a73b89cf2462
TLSH
T11BE02BA9CD20EC7714FC4B5854444E8BE74813563B40595F3A3C955C4FB4777458685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 21KB
SHA256 485b19a448838d7e03c61e8d6d7f7f20c9f7f234d87ae12811441ed648ca2b11
MD5 7321fa7278264b45ef2351b1adb19ef6
SHA1 df47f2b3bcbe09d1443308522699a1c890269846
SHA512 f704ed4a10f62af659e177a2babd1d32f562fdb05d169b54af9a321cde6b84c0c0005e3c79a3766201efa3644a2c3ddc54bd6591b526c07deb1cadd57bd854e2
SSDEEP 384:D4eM/XmoXDFDt1xoDi3uqD4Uylqz9Jrrh8uYDJlxJaA9zxjWdJdfpFfIXL4C:D4e5ozFDDaDi3Ed0JyzlSA9zxjWdJ/FY
TLSH
T15FA2E0AE2955BACA381031F527F69C3C30449133215559333923FF8EDB38DAA654D63A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 975198f03fad00dbd6517dfba12bb757f1f4e514268cc34450ca0499096df6fd
MD5 3213b49815f318750e4033154d973e65
SHA1 1fb7d16f1b6689f257910955f5392ce43f592677
SHA512 a33391ee9c6ace4389671bd6c3d7145638a0a847f9382f764ca5c43c02e8874bf5fa65edf66b21e9115b25e25e11a7272b6a33d08b99e18a64e2bffc27220e40
TLSH
T10A21EC9119C46378FBA66CB726B08F7B6962EC0BC6474E577A073CA9482F7C43844881
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 6c8044611d10171bc6eb33e085cdd535b187a24f358b90a2e47785634e944e32
MD5 c6b375c15322c8d7250d11323fb223d0
SHA1 6157d9bb35a4779ca3c5102bd0c05174d6910697
SHA512 ab7341340ee5f310b5471054a7454e982f39d76285533f57b785f9b134e2ff16372a54708d2dd302475293b9a4629d023f1d1b9a7a562318bc0ab15fd96a0dfd
TLSH
T11EE02B4526090AF0F3844577D7B20CE232350E4246930A758B4B0CBDBD2EF9130D40C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 a90aee306f3f741fba152f075cb8ab19b106a9eea0343a7e921b691523a28ef9
MD5 b5d6c94bcb0bda0cfd86f9ee5fcb5b1b
SHA1 fa8d28ca98bbb62e40eb080d047479b7aedaba01
SHA512 9f93af174e99da44ebb086a310793c987cb825552ab2f805d284b05fd4545a3ed0e4f859c0dc6e1270aab1a3935c63a492add341dabf35807a5b1f7c2605bb45
SSDEEP 192:D8ABDe20JTjJEJPafe3J+RaINEzzMNNMeEpBzVGMTuJ/lKO3OaRPMNGvxcneP4lk:D8ABDe2QT1gPafe3J+RaINEzzMNNMeEU
TLSH
T1D03272F7D3D88A7EC81152F45B242E17CE29092856783C57C9D8EF8B93E54B2E28154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cf7941322893946b194094098a8f14eea3b943cf087fc0387a8469ed5f7d5113
MD5 11b33ecff7890490ef0f27c6e50ab854
SHA1 3dc4ae926e3a4512bbca7e9129ea9c0b942b5a9b
SHA512 3bb4f5930a400fb580aabe1f8ad4e1519598d9c5ee5c9f07ff49f04713e6420e1072802796c05d41a08546e4413e012e134b3e35946fb814b02da107fc620d40
TLSH
T150718EF7D3E58A7EC41152F49B146E1FCE290918522D3C56C8D9AF5B93F28B2E20174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8c7415d0d12da9ec21962126abe783eeb06689eb64f2679cf5204dccfe78cefb
MD5 6d47b0b6674c99901cb1dbe2e2533541
SHA1 d4a72ff0e982dbf54e92ab58d4366e15d20dfbd0
SHA512 90fa36871307f7172eae3affa7260bbf801c248b43ba83041d4c8d8bd24f351001aa94a609888dbf3d1e32ce7581c48448aaab9db8aa800b163619f2bfb5aa91
SSDEEP 192:JRGBTFYRHQEGv7+hJPRpBTB9wHsb+WNP651ZmYqme+Dqkw3H5VyIsnAUgraJ:JRGReRTy6vX3OwYeMekqPe
TLSH
T14F52E62EA910763B5CDBE629F921BF53D7F5113221951F84EAFC892C14E75CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 02fcd6fd1f6ac348c1cab3ff60bc48acfea7a96fae20fc2adec9ce15a7b67da2
MD5 0cc4a392b8730f83f9f8d09033626614
SHA1 19d55af5e1c4d93d44306c1bd6fc05ce72819d72
SHA512 60bc61a8a10ef538eefaa07e1f456a28428e47625bfe481abf6ffd980aeea75e659b8fb4153c067de1d302093b76e0df0dfd220fb97a08a34d053f370c51f7d7
SSDEEP 192:JRGBT6YRHQElv7+hAPRp2O9wHsb+WNnZm0yDqkw375VyIsnAUgraJ:JRGRZRTV68XpOwo0AqDe
TLSH
T17742D52EB950753B5CCBE629FA217B53D7F5113621991F84EAFC892C04E79CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fabd89120c21b33a2110f5d880a94c117bc15ffe418f99ee2c78ba1cc2b1915b
MD5 ace7611f9f0b6972cb4c9b777e52a26c
SHA1 f5d570b41452c340be02d4cb3ed400be7913ac94
SHA512 873072b52ec6d3021cffa56ad5b2286be249163e71aea3332a6c6ec9d77d54da6f1b0f4f4c52c5a6669356ba1d92c909a662224c8c2ee25af2de597b44a2c540
SSDEEP 192:JRrBT6YRHQEev7+hJPRpBTB9wHsb+WNnZmYqme+Dqkw3H5VyIsnAUgraJ:JRrRZRTa6vX3OwoMekqPe
TLSH
T15D52D52EA950763B5CCBE629F921BF53D7F5113621951F84EAFC892C14E7ACC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8571835ecd68da2d4be3b2a9447a55431d67a86e3ec44cb65325e02490402bd5
MD5 dfbeeb94dde431b9c3f03d49053ccef7
SHA1 6e27e6d15113b78975ae6046bc9d1299eb341bcf
SHA512 36eb8cae71bf64598e0d47ed72647873d880a09e0b9ed91fecc3211242683755dfb9e1c8111b6eeee064563c2348701ed6020af3a813df13b9bc367ac5f5457d
SSDEEP 192:JRGBT6YRHQmXv7+pAPRp2O9wHsb+WNnZm0IDqkw3Y5VyIsnAUgtaJ:JRGRZRH/6UXpOwo0mqe8
TLSH
T12842D52EBE50753B5CCAD629FA217B53D7F5113621991F84EAFC892C04E79CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2b40e4b01f4fb37d32fbab76d21d003bbcf77456020b07c3ff18c0fa095c07c4
MD5 808aa5ceea3bb9f1a5a9bfd4236015c6
SHA1 0c1c74a4553e5422d3fdc908884cc67c466f61a2
SHA512 49a19729c1628c18c76c1d4a4279cf1ba0e9cd64e536f14a54a63c0623c74ddf679938b25e36713645973dbe20233197d9163dbb506b242d9d8f99b90e695b6c
SSDEEP 192:JRrBTFYRHQEev7+hJPRpBTB9wHsb+WNnZmYqme+Dqkw3H5VyIsnAUgraJ:JRrReRTa6vX3OwoMekqPe
TLSH
T1C352D52EA910763B5CCBE629F921BF53D7F5113621951F84EAFC892C04E7ACD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6f335465e72b442fd073ceb2212bb64d02e6d9ddee6e2c7e956c037728d6fe4e
MD5 b398dc0179227b8c26eb9065e33eea05
SHA1 9cfe9d11bb9f28e8fea63800fff90110c79b2b4f
SHA512 f076353566e37a3b5894cc41e2278d6a95df8ee6b1ed0510dfb76e230aaaedaba8179e3e6cd473df4c8a6eef699d757ebdeea97c65ecde4c20cd46535e0c42ed
SSDEEP 192:/RecBzBTFYRHQlGv7+MJPRpB/e+B9wHsb+WNP651u1BqmWP82fDqkw3H5VyIsnAq:/RemzReR2y6WXzOwYCZJ27qPe
TLSH
T1F462D52EA910763B5CDBE329F921BF57E7F5013620951E84EAFC892C14E79CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eab2e2649658e38f5c5ba6741f444c1d6dadd70e337138256e6cd9cf30e810a3
MD5 5de085515a1aaae9f209ee30e36834c6
SHA1 203bcd2eaf3b4178fb2a39451ebcbb506e8fa96a
SHA512 3c4b0cc9d12ab7e2665005505a1812ded35b5c6fd7c48dbd324a9167fb94e1e0517c1f56e8c914187333d2a6c40d1ce3565b066e3b4b2e995242f911aa63f667
SSDEEP 192:JRGBT6YRHQE1v7+hJPRpBTB9wHsb+WNnZmYqme+Dqkw3H5VyIsnAUgraJ:JRGRZRTF6vX3OwoMekqPe
TLSH
T11E52D52EA910763B5CCBE629F921BF53D7F5113621951F84EAFC892C04E7ACC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5f549ff6f0496896190f1eb69aa5e58cced5a9afb54044c23ed4b98a549d9c95
MD5 8d5b091d4fcb43d79b470fb63c0d245e
SHA1 780a88df96f6b56353ed23cb1ed14b0bf5b94b6a
SHA512 2d987c644f1e21b62059167472536bd1cb045341c9b3b17c3b9337df85b9f4c33e7c317d84f684422680e9119e5ad54119a5384f3be39ee1c4f59018b72fb5f0
SSDEEP 192:/RecBhBTFYRHQlGv7vMJPRpB/pRAB9wHsb+WNP651u1BqmWroevDqkw3H58yIsnB:/RemhReR2y7WXCOwYCZperque
TLSH
T1E862D52EB910763B5CDBE229F921BF57E7F5013221951E84EAFD892C14E7ACD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2cb82a24e0c425105c68f5846d0da68fcc59111218c3d44f6d2ebe3491500a73
MD5 45f33b50a013b4559e8d0e616a3360f1
SHA1 20b62646f1ea286af8fe1213b2b02868b2de3510
SHA512 fba6e5ff91bdb9b16601807d8d0da25d67b3ba86ff5d4bf2318ae5aed3140dbba6efd32df300b5b9bd6ae6c5c7002e3033119d4554a69b0de89a4569454f23c3
TLSH
T1A1B0120080035651C84302B0164B24CC71159F11960A170393E07E63C82E66180240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585bf6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585bf6.TMP
Size 96B
SHA256 a8b2a1311452bb63db4d15b1b52771d9defbaaea2f366ee99499f9b215e96cdc
MD5 e9637352cec1b7ea6bc2d16904be9b42
SHA1 f0b640b1404b24199234e172e61a0a38dcab976a
SHA512 5964794951f6ee8cd41973f702be9222ef823de9d57e627ed0c930325a377b2cdb90da0c4f3fc03a8099a2a5c0efe4fb32c783c30feadc49868cd65c37733f50
TLSH
T113B00266C103A752D04203F02EE695E971A0DFEEC6031352E2F16E67DC297B145252A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 64976b45180aa1431e4bb7f3d22ec7b4ed8a65b7115e07054bf301d2a3d83da6
MD5 00e32849f205af0859efbd6a16e27773
SHA1 240da518357366de4bec33a6404cdc6e6652c6be
SHA512 a28076e3bf3e6c3bb958fded75b7a495c34039b512639dd86a0a03e5c9a531d7145288116ac8b793dd1939cd26f917203940f4bb0fb3c36f9a8c3da47d69b146
TLSH
T196A002504B44055ED0321BB215D2139073A0CC10499787D388D04147EC941E0CE25441
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 398ad89421830e1627ee5a903bdce90d1f2fca12b6fda7a9d880fc4b13c57d2e
MD5 46c08831501de3c50b909d6dfb0e3704
SHA1 264a4d5a9f4bdcfbb1c8886f6ef34d5bb99f7924
SHA512 81bcccb43ded918da09e89dba5fc2a0a7d6cb1557add48ff2de127c287e83a5c1bf4d0b56eade18ce182198dd4fafc585c40d2592fd64da363315fd23ceffbe8
SSDEEP 6144:9g25N3BoXwUQlC0XQcLsUzI+/DWDfxA3OnjrYQ9EU0/hEh:V5JrUKXcGbiDfxjjs+Ca
TLSH
T1723412F25C397E6A0CF9DD9D680C36609FF86A97988EADC361D5178D20EF1C8416AC31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 5d3baf8f990893685abc354af235a9c64c3d9158c6bf357e09c837f4bdf07900
MD5 019b23245ed7bf89bb8c9c88aa72473d
SHA1 60af92ed64d761b871701a651125ed633d84451a
SHA512 920315cdb8a2cfef4fcb9d1d80d91b7f6d13b5b120b5158b71575082629b30d3b562107f6f3636835647d4a08ca1ad9e6fec541845c6e845afea950dd8966998
SSDEEP 6144:Yz25N3BoXwUQlC0XQcLsUzI+/DWDfxA3OnjrYQ9EU0/hEh:Yy5JrUKXcGbiDfxjjs+Ca
TLSH
T19D3412E25C397E6A0CF9D999680C2760DFF91996988F6DC352D6178D20FF1C8417AC31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 3415b0fff108fbfdc4dbd073eea87ac16235b5353f8b8725602c3a0290df2e64
MD5 9fb5499261b5f99bc145d83e5d38e905
SHA1 c1497b36dc5d081f3824351f9f29679f1b147382
SHA512 027debd7a3e204b7a8f35582654ca9c4a95af4ba7e47f1a27fbcb796cf6c5c9839f53e5a6bd4b27f6c3d51086372ebad4b66d1c63f6f1e960832e0f6b3b5916e
SSDEEP 6144:cg25N3BoXwUQlC0XQcLsUzI+/DWDfxA3OnjrYQ9EU0/hEh:u5JrUKXcGbiDfxjjs+Ca
TLSH
T1893412F25C397E6A0CF9DD9D680C36609FF86A97988EADC361D5178D20EF1C8416AC31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 297KB
SHA256 520b7597831a41232df86f9058db2e81b328684577bdcdf1543a5c2c3c7c8529
MD5 754e8ccb394729872a8df59c806cb5b0
SHA1 8eb540d5d0eddf0cca18668316c0e2c15ac68544
SHA512 e2106480d803f7f2e56634c11a0018a62d1256e6749294f5faa8f2ebd552f5c52475f7147f65aa763fa231056a3ce56ac1517889e8bfbb1201a210925f545a4a
SSDEEP 6144:2kmZxzU25N3BoXwUQlC0XQcLsUzI+/DWDfxA3OnjrYQ9EU0/hEh:2km/r5JrUKXcGbiDfxjjs+Ca
TLSH
T19E5412B25C39BE690CB9D99C1C0D3764DFF86A9A998E9DC791C017DD21FE2C4452AC30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 067c05e7b78b64c464d65e0fce6b7aeb5567b90792561d01215919339461b94e
MD5 dfc6c1768fe935f3f72cd09a754ed1e9
SHA1 60e728d65a657fd73cf71d647c0fb4ad4f18f9f8
SHA512 8afaa33576176936865eed6d8e463b3b7ca7ae1eea92ee4e7110561d3118e7d10bcc331fbc95233a0fa465ec180f1475c2526b9d2a58a086d01fd6a12c1cb4a6
SSDEEP 6144:Jz25N3BoXwUQlC0XQcLsUzI+/DWDfxA3OnjrYQ9EU0/hEh:Jy5JrUKXcGbiDfxjjs+Ca
TLSH
T13C3412E25C397E6A0CF9D999680C2760EFF91996988F6DC352D6178D20FF2C8417AC31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 986c9c6a812812bf2cde1800ba1b11d0020376d753f904f5360a9f21be4c52af
MD5 db8eb41892bc36b32a1cf1b464ecb028
SHA1 4bcba54cf85659d721e086fc7315e13283a4ac00
SHA512 3ee4353174b3df07927a690dd2814b25ecca2cc4f88812cf19d4f731727087309feb9858129cb3a72e5b8bad03e290ccd8c88877d6eb912d4aa1dcbfa34fab19
SSDEEP 3072:NzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:5WDfxA3OnjrYQ9EU0/hEg
TLSH
T1E7C302A15C35BD660CB8EE98744C3F60FFF4AD9A91879DC362E91B4D24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 db373a37cae9a3a295150c912877c9f3ab67c4c9fa58b21a3caf9b8cb124668f
MD5 8b277655fc0c36399272e78a4a36f76f
SHA1 6d769da5a478e8dc8db9479b26a54cf17d065a31
SHA512 cc2036f9a7328d5c3409d66b185476d2f5d6c677c8ab4cb12239b268298dfaa059c392ec4f90debe006dbc472e41d08d9c512ffbe2bf51a969b9b7a092c803f2
SSDEEP 6144:Mg25N3BoXwUQlC0XQcLsUzI+/DWDfxA3OnjrYQ9EU0/hEh:e5JrUKXcGbiDfxjjs+Ca
TLSH
T1DE3412F25C397E6A0CF9DD9D680C36609FF86A97988EADC361D5178D20EF1C8416AC31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download