11c70ba75fd9bfee1079daca5725438ec17019420705e87f373a1313ee8caa2c

Analysis

user interaction
yes
max time kernel
113s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/08/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Corz Client.rar
Size 304KB
Sample260821-genf2axyf1
SHA256 11c70ba75fd9bfee1079daca5725438ec17019420705e87f373a1313ee8caa2c
MD5 94fa9d6254f1a3d70dadcc0fe9cb46d9
SHA1 8073dd92ddb3546b8f701676873ac4136507a953
SHA512 b2a20fafe5780c33346943a0feebc6d76c3b2204e603b4048346c9a185e7a87ddc0ff7c927e757026ac7309f10a45a7e46abab86dbb962e4129ca3e6465043ee
SSDEEP 6144:GmD3mMrogYPSbBxx1Wl+Pek9EIj3/U06Rz3lv/1mCx3AcOY0TpVRl:GmjmPgt9xuZnE/Bij5t5xy1l
TLSH
T19664232094266148F64F8D89A1F2884707A090D665BF7FB775CFC52F927AA424F3378A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5112	Corz Client.exe
3008	Launcher.exe
4332	Corz Client.exe
3856	Launcher.exe
1524	Corz Client.exe
1128	Launcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1396	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317647020634753"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{8BEE43A7-CD6D-468F-AE37-5D985FB3D7D2}	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
684	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1680	7zFM.exe
1680	7zFM.exe
1680	7zFM.exe
1680	7zFM.exe
3280	chrome.exe
3280	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1680	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeRestorePrivilege	1680	7zFM.exe
Token: 35	1680	7zFM.exe
Token: SeSecurityPrivilege	1680	7zFM.exe
Token: SeSecurityPrivilege	1680	7zFM.exe
Token: SeSecurityPrivilege	1680	7zFM.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1680	7zFM.exe
1680	7zFM.exe
1680	7zFM.exe
1680	7zFM.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 5112	1680	7zFM.exe	81
PID 5112 wrote to memory of 3008	5112	Corz Client.exe	82
PID 4332 wrote to memory of 3856	4332	Corz Client.exe	88
PID 1524 wrote to memory of 1128	1524	Corz Client.exe	93
PID 3280 wrote to memory of 1328	3280	chrome.exe	97
PID 3280 wrote to memory of 5044	3280	chrome.exe	98
PID 3280 wrote to memory of 5044	3280	chrome.exe	98
PID 3280 wrote to memory of 1396	3280	chrome.exe	99
PID 3280 wrote to memory of 4984	3280	chrome.exe	100
PID 3280 wrote to memory of 4984	3280	chrome.exe	100
PID 3280 wrote to memory of 4116	3280	chrome.exe	101
PID 3280 wrote to memory of 3800	3280	chrome.exe	102
PID 3280 wrote to memory of 4116	3280	chrome.exe	101
PID 3280 wrote to memory of 3800	3280	chrome.exe	102
PID 3280 wrote to memory of 3308	3280	chrome.exe	104
PID 3280 wrote to memory of 3308	3280	chrome.exe	104
PID 3280 wrote to memory of 3380	3280	chrome.exe	106
PID 3280 wrote to memory of 3380	3280	chrome.exe	106
PID 3280 wrote to memory of 3884	3280	chrome.exe	107
PID 3280 wrote to memory of 3884	3280	chrome.exe	107
PID 3280 wrote to memory of 1996	3280	chrome.exe	108
PID 3280 wrote to memory of 1996	3280	chrome.exe	108
PID 3280 wrote to memory of 4716	3280	chrome.exe	109
PID 3280 wrote to memory of 1284	3280	chrome.exe	111
PID 3280 wrote to memory of 1284	3280	chrome.exe	111
PID 3280 wrote to memory of 4592	3280	chrome.exe	112
PID 3280 wrote to memory of 4592	3280	chrome.exe	112
PID 3280 wrote to memory of 4496	3280	chrome.exe	113
PID 3280 wrote to memory of 4496	3280	chrome.exe	113
PID 3280 wrote to memory of 2152	3280	chrome.exe	116
PID 3280 wrote to memory of 4884	3280	chrome.exe	117
PID 3280 wrote to memory of 4884	3280	chrome.exe	117

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Corz Client.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\7zO0964D248\Corz Client.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0964D248\Corz Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\E1ACFD7B\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\E1ACFD7B\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:3008

C:\Users\Admin\Desktop\Corz Client.exe
"C:\Users\Admin\Desktop\Corz Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\E7010E7B\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\E7010E7B\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:3856

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Tutorial.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:684

C:\Users\Admin\Desktop\Corz Client.exe
"C:\Users\Admin\Desktop\Corz Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\0AE40E7B\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\0AE40E7B\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:1128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdab6ec728,0x7ffdab6ec734,0x7ffdab6ec740
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,7796543124732925019,6797088858103400151,262144 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,15109491837141217746,17538949039203577620,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,14686982357951795940,8861972139986574332,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,7397284036999753724,9646688715572368058,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,12603891948328367853,1127469560721297475,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4396,i,15214816309621870861,14403233630538367029,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,7336698481949089165,15409228106023729825,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,12805167471069906151,12575947164070986821,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,7106810371786095734,14856403640171629639,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,11990136726487811527,2526907690354335193,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,8596012276669705040,17207491662848764061,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5948,i,2660772697603028821,247359443102152737,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,12414150216904409612,16444838065511138761,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:12
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,7376257545322435974,16633436958272907545,524288 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6448,i,1610309071582282298,2268817865235590969,2097152 --field-trial-handle=1904,i,18421960539970366291,5096785745708311058,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 56bad5e4c1cf9936a6f2f52d143003722eaa131c87a6db28ef1360dc30be5333
MD5 c32507b7de975b4a62d82c77b3b118dc
SHA1 f7a84849d2308b443c92d8144bcbbc54b2f4ee88
SHA512 a00bc1c5de071c62902c86e2af1fec754dcd18bb867ba22ed32522b85829f3e86e40ca4eb45d2bc482115fe99ddbfe9ab17003aabb1d99723e232b2b431d30d8
TLSH
T19DE02BB9CA21A82B1CFD171894444A47DA40236A2A61494F3E3D91198FB12365585C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 282KB
SHA256 599faa49d48c724bbaae7dbf7d8e1e22d2484901d741002b052d336491febb47
MD5 e2cdf0fff004cb00376f8899f3131c6c
SHA1 e8e09fb17ed2644780fea8cb20fc97a136f7d643
SHA512 fa2a19620c5fad23971cf8aff1202aeede844591e1c7b18914e6dee36348d5cd6178509e6a837b280b8e484a7b76d6be1d9a680303f471ef3880f8de7f5d67f0
SSDEEP 6144:9vtg/I264dWx7rRZ0N+ouZgmaStmw50TTD6pt8eIxvU8NZnEH:9S/I21A7rcctZWStFA6Cc8N0
TLSH
T1B85423489D275784E6740360E857340DB58F5B2AA81FDAE3E0ADA7CEF52F23915F0984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 beab8f2ec8e01f1503055a8ffb005be6e1e2e6c8286b14d0e0faab4441404f5c
MD5 c809d6dd33c04b92f7d306029142cc0a
SHA1 b36c0e639fd0c72d9bdc75ff62447053e089eef5
SHA512 c0bfd3df44144c38038dfb7742c6e31b8bdf3ed16ed7c63edf35df78548470032d8a0fa8b46658b3901b473985fc8f811906b27d67e923ed9fca9a170d099804
TLSH
T1CE11640D98C87573EB08A3B7034A4E145B792289826F771F4341ECE860E7D965DC8CD8
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 336KB
SHA256 c7d2c9075a4d02bff79ed55dbd65d34fbe2e97dab24aaaffb66aa78196290202
MD5 31856b3b4818cf56d393fad6b3d0c06e
SHA1 f68d3b1f7b6fc0afa790d7b5b450338553560384
SHA512 33187a40f4deeda5f2556d1d39d3ca573a523a118f95d257468c90965444f826e201e189d13b146cb7e7f7ec096d6fe3ccbb7b522c71ca652b3d19f01cf6a70c
SSDEEP 3072:7hpBPNPcOnJYVHV/UdcMhOwyMd4aSPhuvw/v1SWQCKh8wyMd4aJ1yuMT5L1M+GZA:IbdWY
TLSH
T13474292DA2F6A2D9E02E43371A53DD27C735DEC866987016B5627E0C33E7B05326473A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000014.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb
Size 18KB
SHA256 b2307b2cd8fe30c19751178f1b694b83d0a7ac0b72b64cf9c612fea3369b1c2a
MD5 9f767aa1e2e53df65103885fabad6351
SHA1 cfde21e2e3f1787602798c6ac549f647b75010fb
SHA512 7c5f01dc62527c7401e8da526ab64badde28707e46f5a89150fb4919ef7f3b9c8946a1f272b0d72ee943715eab551f0a803e3b1bce4eecc1f0ed5cbb3669c828
SSDEEP 384:GaMYbeMwjyllIbm4f5DhUO1KTgBt0DH0JeMOm8PQifhS:sqt4f1DNBQH0JemnifhS
TLSH
T15C82AFB7AEED40D2D13E537B50FF528EBF25FA182899D49D3142300D1D926A3394AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000015.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000015.log
Size 68KB
SHA256 127532f4106216d82b03ebc04aa99bdb716a649d20d55eaffcac042d875e319e
MD5 5689417940c66ee461f8e89493b285d2
SHA1 72366044a1bef6e9ee3b48c09b509b91b7f42b39
SHA512 345da20e5a6de39f7c48078a4f2a41a54d618f582519289f0ca1ff58e755543e984bb1b7c7be5eb7600469e07dada843a6a2bfcfce1a2d4b5e3b54c358b2e107
SSDEEP 1536:iGJKkrKD92r38/c3JKkr7fFDp0i6WmHkXv:5wTcz2kwsfFDp0RWNv
TLSH
T117637CABD1E0D9D5D718C0F6565D57498F38189328F920EEB28F3A0DF47B2A01761E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 13KB
SHA256 3d3091bf3aacc9cca47e9e7df39987756c3a86ec3f02242edc038e8650ce30c8
MD5 c02658a9c12ce747ff2942fc79384aa7
SHA1 225ba2393a14d6c95053bdcfe453ef1f89a91887
SHA512 a0910bf6c4036543e85958dd5e84766fee5d715bf1c5cbe99cbd355587cfed0000814d50fb1dd42cc288a2584e75d637258c523e88a45c34a01c9b711b5e49bc
SSDEEP 384:tdm1EubD4Q5DhUO1KTgBt0DH0JeMOm8PQi2F:WEG4Q1DNBQH0Jemni2F
TLSH
T1C4528EB69DD951E5E57A927760FF114DBD22FD0929A5C4ED71C2300C08A1693388EF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 6KB
SHA256 9764f8a1645f82ee8f9dbdcc6046c8273badf703bea548f650e74a45b6a319cd
MD5 a4575febad05e3ccaa6ca43a1426a239
SHA1 c93165c04b154f68f162b458b3434e5c796d60a7
SHA512 37f8dbc03780860c0311bdea749ef2f09575c77b9389897959b1bb7c1d1b2303639d80876caecab14a7d1c05c0c26bc0f4fce3731ee34305b6af143487395bff
SSDEEP 96:V/J7/JCROEGcLC99bhR3C99WiIRVeWoOaXMvP9+CTro3gptmYKFLb:88EPe99LS99+e8rP9PrNmTb
TLSH
T176D16AE727C6A5E90442C0B3EE68E0CBCD9CA518974C9F9C794CBADF07F052B945A0E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 1KB
SHA256 418b20cc85e4a2c691352d95bd3d2dd633dfa886650b2d149237988d45ca19a0
MD5 5e4044d590c3ad9f4fdc49c466a6311f
SHA1 0145928eb01ac74edbb27b91d7f6e56eb37c5b8c
SHA512 5ae4f1aee727146d85951129c3a7c5ff3c2099eb95054628ae17577d4cd69a456a4946fabd10b770fe35b04e6af16c2f45e4786727817716b5cd72ce9715c528
TLSH
T163217C01BBFA9441F1B61D7459BF684AAA62B90D0C17DE1E2356A35F11E3E40DC3163A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 74f11df23a3601964d8fcf11c1ca407dc9cdf79488f2cba5c5f9f9e8dd764edf
MD5 da78e1163c8785053e6d865705d150c3
SHA1 fe4fd49747d7e75f8cd040f6df2a11e427a9b78b
SHA512 fb26749b31e11970bb78ea15c7ecd93f4cdc81e4e08748151b6d31dcbed56a35816a5fd777062d766624b728e3a3551b1bfade4af59c5f98502c17539249ec8c
SSDEEP 192:DuEw3hLA/R1ewzJyeQdJce9WJpaIKMgGXeAXMNLXfplRP7VA2rHwT5TJnR/iHGa+:DuEw3hLA/R1ewFyeQrce9epaIKMgGXtb
TLSH
T13132B9F7C3D8822DD92156F4DA583D1ACE291E6483283C6AD9D9FF4B63E5031E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e24613e24292bf13673e196d63150632dff5296fd029f2bf2bf2e64a7e65c0fb
MD5 46e8b160a4c7f7f0ccf76efd128cbbe4
SHA1 b4d3c2e084ae88cb5cd8bc054dd1577bc93f8abe
SHA512 21dbb819998904b4d8a9e6891a780b5d422d4a5b811f51799bd3493c765a775a0c9b982e10e5ef2836de22fd3d8d832aea3d4d343daa740dec3d8fc5e960d30c
TLSH
T17E11AB9BE1BD70B710BDA9AB1D00F80A1AB6F8311641B9E4DEDAC16EB0479F30B15423
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2a825b6594604d60b74266e34a6e5e5b79cc9a8e81515aa0083b0d414f65be97
MD5 bb8c2799b32efd85b58565fe7485d791
SHA1 97cd650de1ef4c15fdf0e479a103b1b0c4288f2d
SHA512 bffc79160323d1783f7a204755ac9770736cd2952bcdd871b03023e6293723a442b098f128f33ad968d398b330c8f9ddefe5ef5af3a440676cd37783a065b5ee
SSDEEP 192:NRLb19SSdGetfEv7lBhAPRp2pc1PW9NHsb+WNnIfidgRr2D32RcesT8apVyIsnA4:NRL5AY3gv8XOrwg92iRhaP8
TLSH
T11152FA2FA9107A7BACDBE229FD217717E3F5202525D42E84DAFC892C05E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3eb535304f4e66bcc16870867d2ae061e597927467937564499d6b5759a7d202
MD5 c129575c5dbc34f4dbb9a57f693cca31
SHA1 c92ca49b67c0a0629e17160feac719f661e68a2c
SHA512 8fcb4d109001798ddd77a8926cab6fa487e0b3327a0dd27feb2d330512d5bf0cf91f90f7518d054638a9eb97fe62d17cc04a4bf8880c05c9522542312ff411d4
SSDEEP 192:NRLb19SSdGetfGSv7lBhAPRp2pc1PW9NHsb+WNnIfii5ED2RcesT8apVyIsnAUg8:NRL5AY3zv8XOrwglEiRhaP8
TLSH
T183520A2FAD1069BBACDBE229FD217757E3F5202525D45E84EAFC892C00E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6497d371-e2e4-4905-92b7-6ac5244b89db\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6497d371-e2e4-4905-92b7-6ac5244b89db\index-dir\the-real-index
Size 576B
SHA256 f208186264ce03e91e78e6863fcc22321106e11d3f1efe53b6ae174a1f47440a
MD5 0f54806f630853da391875925ed7d5f0
SHA1 59a6d03b696ec836981a1c4f02fae51276d97473
SHA512 089e96a454846c1119411bd70477e7f28a4fe5bdd50fa9745ff5b61bec00e790b9b2c3d74731cc222db6003e9ebd96c6b1bccb283284a20496679c7da01c6f4f
TLSH
T1CAF0F1E12390D8D3CEA2DBF512790061026484590A25A793818494537F3FD908ECE011
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598d81.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6497d371-e2e4-4905-92b7-6ac5244b89db\index-dir\the-real-index~RFe598d81.TMP
Size 48B
SHA256 65c904ac6a96975ec49dca838807852f6a89896b0ed590559d8bc0f469629d12
MD5 a379f77fe19c98b1daf973925f3aab9e
SHA1 615f16cad79602088fb80980c230cd9b9d5bd9a8
SHA512 d30a952fb4aa90848e15ad3a7e4d08812c017867e2a51bb59db612824f602b1e16926dff8ff165027e003c6ca035698481b592bc55220bae8006d8cce41aff2a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4a02bf2-25d9-46e1-9f7f-9c6b8b4c13b1\index-dir\the-real-index
Size 2KB
SHA256 b9a16dbcda11060fbea9ff2f0dd2c01ca241a1c5ecad9d666657247506ee5162
MD5 7017a8d54ad33c132ba0b2d5c727d7c6
SHA1 5f9d2e1e9758ae3560654040e62f751f2ca9274f
SHA512 c845f8e6c7ba7efbeaa666f4eebd379572fe37fc2a8e348814331892b5163440893ca66986ac152b5004ffae664a418d9610453fa12d6f04e3518869e663cbc5
TLSH
T1B151628CC98067EDDCB511FE2C54257293B02C24FC59C39290A4F5A37453A6827472FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4a02bf2-25d9-46e1-9f7f-9c6b8b4c13b1\index-dir\the-real-index
Size 2KB
SHA256 42606f787c389fdc9d93ca225746dfe2d73962211d2ebc1267fcfcdb47f26582
MD5 ce1fa8e15923e97e343a28e5a73f2eb0
SHA1 b1e1c9852459cff048bbb09299da2b11a14998b0
SHA512 4bba9fff7cff89ba7ab7111b73b1780ddadcf6ab3621f03b5fd566d7cb227052604f2974b044761a65d4f06c12d3ad63b32969a99b2bd3043fb03b10e15cab31
TLSH
T16851858CC98057EDDCB511FF2D54257297B02C24FC4CC392A0A4F5A274536592B472FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594cce.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4a02bf2-25d9-46e1-9f7f-9c6b8b4c13b1\index-dir\the-real-index~RFe594cce.TMP
Size 48B
SHA256 9c4deffef7b49dce0f06439a2ba07e22d5ef021ede95b7eacf2f0b14a4710a14
MD5 bcd587986ed785594955e291d3cacd06
SHA1 ebeca4b49c38c87797618f24f79ad52477bfbe7e
SHA512 2bfebebb0b275331c10b3f35ddad2cbfcba6a2e07b164577e07049ec2174f304f161fea353b3fc2d62efc9b0170c1308283d567d737f93b84cbd3e75e57a15d1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 ccaad2a867a72fd1b5ba7fe69c41b14cd242f024d72e43195c325166213bd3f2
MD5 d4f7086315ec5723a9952f3004e207c5
SHA1 f0a32abd6a190b3f5e3e37499ad9048f5d584697
SHA512 88a32565b13542451a7dc1d43c5b132bec063d73244850511f26dbf61f927f2423da5835d5d846ab39071f945fdbdf8ec41b7ff0d2893154b7029a149db50ae8
TLSH
T194D023C9703144561730EDD5E13431DD452FCD09D895D8E4554DF0C634BC513C541E27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 5ee7d9150ae8a4305792a2cb93c0ad8f171d2f6779c251c391abf03c05f57c7f
MD5 5d2b5de71ca50a5257528a2a4205dd80
SHA1 e5d029d2d8067377b912243e3ad190546ce309fb
SHA512 587f88ab543321617173cde609220d9f96fc3ab17047440adbe679bb96ed0dadf898aab1429d094fa91effd4b008128ca7133e5deef674bda936537e1d66a59d
TLSH
T12FD023C57531466D1630BEC0713468DE412FCC44ECC1DDD44D58B0533374927D206D36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 bdc2634dbcef41a79b6472d092a7edabe6db96eb1604666596c334dfef2d7e9c
MD5 5edf6cfda5961b7ec135751017c732cd
SHA1 1b5d876df99e28848675ff9fd389d65ec2de6ad3
SHA512 fd191615f36eb2b99d24dd9887937229c963b8a883dd4a669cb08cacd994678250a9c4b7662d29ee5c52100dde4f3cd9ea02eaba63baecaabd01bdb59d530ef1
TLSH
T153D0A787386441594636AED57434B1DC521BDD4CDCC6CD68569C30037374D17C010F25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 6edd9c710a992fb4d6f4a25978ae557c2f71c90eff2a20921180257064f8883b
MD5 7c46911cf591a3d9a1d89f3f7e485940
SHA1 d809f5127226ee701091f45bb8a36804b5cb8435
SHA512 fc602b7a67a92ba0ad6230fd74c1db854173368a5be6b665247e0558fe2e2971def0c2bda1515ffae2b862aaeabcb09eecd13a3fd0c536e96ab6f5ad981b41ff
TLSH
T12CD0A787796545594636EED46434B1EC521BD94CDCDACD68438C50026370D17D011F25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 bc74e76de3286b3c5d9c23a090da0ceb57995a9a39146526f4e7055639bd17b4
MD5 f926f381f34f8b839396f4025674d242
SHA1 6cc020cbbe79586ea6dc5c493ccd4a21dddae3af
SHA512 9873dea0e5b424624087a5cfdabdf4f1ee53ad4ac4c6b062919f4be7ad9370d8c06f76679f500ae170ebaa3910ee01e3f5d3f4dca5c1142ab6e68360566405c4
TLSH
T103C09BD77420855E4A35FEC56034769D961FC54CD4D5CCF4518C60423134D23D501E27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 e65be6acc99a821d130b7c88c8233a86195ecd10f264999c74db343c5df8876b
MD5 13b19a070908327a3580ee5d86cced21
SHA1 9840c7d31ca4ef53433793db18e748a0cb12fff1
SHA512 1ba4d4386f2516de9a3531db6b3ec763c9c627ce3a5d616cbd77e8e4621b319e8c2651d24bd8f762913f841f2f87d83357d45f3c6b4c2f79823bbfd71a31f7a2
TLSH
T1C2C09BD77420469A4931FEC57134769D961FC54CD4D5CCF4558C60433374D23D501E36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe593e47.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe593e47.TMP
Size 137B
SHA256 50664fb9fce6ca3d753da962bb8683941847413bfd8e10b74e068da3113e7318
MD5 6e03628962b3dfdb419d865c4603e657
SHA1 ca6adb613acf52b34f900e1e1f9a90760823b72b
SHA512 20a61d742a9b1f9d2ddfc7b2c470d2b910637b1e1051b5368f61d1e75a4a38225841066c3e5dab9c5a87b23a5bb7d2d76ebd0a0c80a65fabfcea5231f2313954
TLSH
T18CC09BD77430855A0B32BDC5603477DD962FCD4D98D5CDF4558D70423134D23C505E26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 2068415df0f5d46887f8d1ed2393ee924af1dc5f01fdf03f6000def0c1e068b9
MD5 1a48d063841bb4e10055b8ece1cc47cd
SHA1 90d23ae211a1d5baa7d775edef55e41f1df15369
SHA512 ddf9148e91afb5fc741d8552d3e37f5b6662b54e9112af627e0074ad7d1576349ed1f5112834f792a22165536537ed51cdfd2442b2a0b892aa71839df1485f79
TLSH
T1CAC09B588D429150C85705B41D1314D97118AE55CA093701C2FC75F7D9B72318118251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598d52.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598d52.TMP
Size 96B
SHA256 63d9d0d38b9b3a2f92d4156d461e139c519e249cff5891a892222739a1defbaf
MD5 f5c2e142c8f2b49cd4ee52fd4582a56e
SHA1 94f402db6d08028fd29437bceab9902f55463bef
SHA512 7bc6d89bcecaa61911a979447a8efcb89662aee4a547e9838fda0a15a6eeacaa7f21a9a8730c25b22a47310e647af1514b45ae1eb8ae2df37ebd4bfa4290bc0e
TLSH
T1B0B02288C0023322C00B03B02A8280CC3020CFE0C20B3203CBE00AA2EC3823008202B0
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3280_1189860530\Shortcuts Menu Icons\Monochrome\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3280_1189860530\Shortcuts Menu Icons\Monochrome\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3280_1189860530\Shortcuts Menu Icons\Monochrome\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3280_271340945\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 e2f6320481788992c0cef50819fc0ed5cfb27b1195145b93ed8c8c15d5f18a47
MD5 7cf4b367b89a51b14e72bcca7e82828f
SHA1 4817ce0d6ddadf053895cfcfe90a931688852fc2
SHA512 1d6737c87d6c0bb22562d6c3328c4d6302cf004657372ba9ec3d961f83a50348f906846274264f36c773a97988fed44716573aaa26e8326f98b52d7e2608c1ad
SSDEEP 3072:xXbUBLU6np6IAbMh9Lpb+yI5/WPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:WO6p6IA2A5/Wem7Rkm1tYpBeh2BAoj
TLSH
T1F434123FDE545D37D4E9FB6A715F2A2E2FF01EE24868CD88C9E58B0462D52690B08D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 bf6e31667da6df56a7102f0840f01298709f7624e9dcf0aa6fdce865a0be1794
MD5 26a13dc83cb3792ca49e40974b3c79d6
SHA1 80935045d414fa92417523bb0d8f75a95de7e4e5
SHA512 bfc3e8acba726cf1cf767cbb0f02acf989715591a46d354ff1b36c6fe4b9ffb3d0e260ed42b51739ff99f5b24a1ac8980f5545eaed5319485bb8da3f9996493c
SSDEEP 3072:wXbUBLU6np6IAbMh9Lpb+yI5/WPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:DO6p6IA2A5/Wem7Rkm1tYpBeh2BAoj
TLSH
T1D934123FDE545D37D4E9FB6A615F2A2E2FB01EE24868CD88C9E58B0462D52680B09D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 04b733d2f48a37899e250390c55234dec7e9edd88acdbc7a55a15c76f6d37907
MD5 72e174916e064f594421dcd5b0e599b2
SHA1 c0555c1aaf3524d11836a3e92d9b250c0ffe712f
SHA512 59e8ca2f265b90170d4974563437a218909b96820810df738fab81f4324a7a1dee498fde1771bc48b695625a40849a11f3e32b8281717ef3ce4f9d0a84bd927a
SSDEEP 3072:cGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:vm7Rkm1tYpBeh2BAoe
TLSH
T1D2C312275E75A97759B5B70EB08E0B1F1EF14EA7C920DE82C8D85B0427EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Corz Client.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO0964D248\Corz Client.exe
Size 435KB
SHA256 1f94d2d02d239105f66688384d2dfe415aed56061dc5dcdba48eed19e885cc22
MD5 72b04db8d8f33087c10af504fd7a9f6e
SHA1 72a2554f26f35b035b4ac79e81c4bd02153af295
SHA512 cd67337b794b92b216eaa10d7c6814e5c4e27186dd75701bdae888fa20c6416540ce498fbe29e480cd05f7c0e03c90eac1f585ae92434a67f7dc3d2b78cabbd3
SSDEEP 6144:jUE8mRX5BmYv4wEW0xDpALOuj6U+2gOBVvsa7y/ypfZqUkTktd28:jLJ5VEbCLZjTVgKsj/ifZqhTktd
TLSH
T1D994CFD3EE40919BCD7A0B745147B7B4E5BB6FF8F9D800D228E6699A045EC8B017360B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\E1ACFD7B\Launcher.exe
Size 1.1MB
SHA256 e83b2f3824c5a115e34640298c31fc6d28193a73b5761948fbd619b3d0ea3606
MD5 5fc8e897a6847d65008913b03b478b17
SHA1 f60b1111bc666822d25c0289f7d55dc26c61576f
SHA512 13706810ed8fb835b4d1d09762d88f1bb6c428a6f2020de4b9d62029fcf0c6c79714c6b940c3edc96fe9e0213f9d49aecb2300e61cdb165281fc37bbe6b94b06
SSDEEP 12288:Gbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDMkvfqItNqdg:GbOVE5ifGPRZwHvf3fd
TLSH
T131357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tutorial.txt

Path C:\Users\Admin\Desktop\Tutorial.txt
Size 305B
SHA256 d8e59344fb97e6138a74ddc46b5ef3ca3e88be8b226781d000fc9d7ef0b2509c
MD5 1c319559003f12b32d8ed690071ea8e5
SHA1 ecde41d4d029ad31c1fa3ce710ce4bc165c8632d
SHA512 d73bf4a469241a8bdcb8d308f6a13d29c2c0ac027b714ea5e791879ccb6b99b564df3ce9f90f582640d3a325250710f8baa6fdea0d1330de987f662cb20b8b19
TLSH
T18DE0C27F24A3606F4730D5ECB119FE1DE1A7C12CD8D1E4E8794AA0BE2698E338A1408C
MD5 SHA1 SHA512 TLSH

Submit Download