4defe61c88715bc8ec5127dab6d78fddb1d01df52f9332c7914e36a15d2ad5fb

Resubmissions

26/08/2026, 03:42

260826-d9nhqssape5

26/08/2026, 03:38

260826-d627qagl2s6

26/08/2026, 03:34

260826-d41k4ssamf6

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cr-keygen.exe
Size 410KB
Sample260826-d41k4ssamf
SHA256 4defe61c88715bc8ec5127dab6d78fddb1d01df52f9332c7914e36a15d2ad5fb
MD5 f4ce23f2903569330c4d98dab690d682
SHA1 b2fb1ea1e7453bd490b94cfd5cc8b3955f62623c
SHA512 b6ae12a5e7bb4334685822f0308e227c94c8a9a299d0c406c102fe70e9bba9fd3bef256986b2ea13657fe81d0888c0cb22ec31aaf4256b114141bbc8550e9261
SSDEEP 12288:8+qAcTT/4JZ/+j17lQXZGAz+o+MEr5jKCrSj:8rAKr4JZ/+R7li
TLSH
T18C948C6C779475DFC8CBC271DDA81DB4EBB064B6A70B4343A02316E89E4D687DF090A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	pastebin.com
87	pastebin.com
89	pastebin.com
90	pastebin.com
91	pastebin.com
92	pastebin.com

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	90	https://pastebin.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a30fc9868d13adda	57

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cr-keygen.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3128	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321889220946118"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe
Token: SeShutdownPrivilege	4660	chrome.exe
Token: SeCreatePagefilePrivilege	4660	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1864	4660	chrome.exe	98
PID 4660 wrote to memory of 2660	4660	chrome.exe	99
PID 4660 wrote to memory of 3128	4660	chrome.exe	100
PID 4660 wrote to memory of 2660	4660	chrome.exe	99
PID 4660 wrote to memory of 4184	4660	chrome.exe	101
PID 4660 wrote to memory of 4184	4660	chrome.exe	101
PID 4660 wrote to memory of 2224	4660	chrome.exe	103
PID 4660 wrote to memory of 2224	4660	chrome.exe	103
PID 4660 wrote to memory of 3700	4660	chrome.exe	104
PID 4660 wrote to memory of 3700	4660	chrome.exe	104
PID 4660 wrote to memory of 4444	4660	chrome.exe	105
PID 4660 wrote to memory of 4444	4660	chrome.exe	105
PID 4660 wrote to memory of 3764	4660	chrome.exe	106
PID 4660 wrote to memory of 3764	4660	chrome.exe	106
PID 4660 wrote to memory of 2316	4660	chrome.exe	107
PID 4660 wrote to memory of 2316	4660	chrome.exe	107
PID 4660 wrote to memory of 1372	4660	chrome.exe	108
PID 4660 wrote to memory of 3512	4660	chrome.exe	110
PID 4660 wrote to memory of 3512	4660	chrome.exe	110
PID 4660 wrote to memory of 2900	4660	chrome.exe	111
PID 4660 wrote to memory of 2900	4660	chrome.exe	111
PID 4660 wrote to memory of 2296	4660	chrome.exe	112
PID 4660 wrote to memory of 2296	4660	chrome.exe	112
PID 4660 wrote to memory of 1232	4660	chrome.exe	113
PID 4660 wrote to memory of 1232	4660	chrome.exe	113
PID 4660 wrote to memory of 4428	4660	chrome.exe	114
PID 4660 wrote to memory of 4428	4660	chrome.exe	114
PID 4660 wrote to memory of 5128	4660	chrome.exe	115
PID 4660 wrote to memory of 5128	4660	chrome.exe	115
PID 4660 wrote to memory of 5224	4660	chrome.exe	116
PID 4660 wrote to memory of 5224	4660	chrome.exe	116
PID 4660 wrote to memory of 5268	4660	chrome.exe	117
PID 4660 wrote to memory of 5268	4660	chrome.exe	117
PID 4660 wrote to memory of 5652	4660	chrome.exe	119
PID 4660 wrote to memory of 5652	4660	chrome.exe	119
PID 4660 wrote to memory of 3388	4660	chrome.exe	120
PID 4660 wrote to memory of 4548	4660	chrome.exe	121
PID 4660 wrote to memory of 5204	4660	chrome.exe	122
PID 4660 wrote to memory of 5600	4660	chrome.exe	123
PID 4660 wrote to memory of 5600	4660	chrome.exe	123
PID 4660 wrote to memory of 5592	4660	chrome.exe	124
PID 4660 wrote to memory of 5592	4660	chrome.exe	124
PID 4660 wrote to memory of 5584	4660	chrome.exe	125
PID 4660 wrote to memory of 5584	4660	chrome.exe	125
PID 4660 wrote to memory of 5612	4660	chrome.exe	126
PID 4660 wrote to memory of 5612	4660	chrome.exe	126
PID 4660 wrote to memory of 5136	4660	chrome.exe	127
PID 4660 wrote to memory of 5136	4660	chrome.exe	127
PID 4660 wrote to memory of 5148	4660	chrome.exe	128
PID 4660 wrote to memory of 5148	4660	chrome.exe	128
PID 4660 wrote to memory of 5156	4660	chrome.exe	129
PID 4660 wrote to memory of 5156	4660	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\cr-keygen.exe
"C:\Users\Admin\AppData\Local\Temp\cr-keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb731ac728,0x7ffb731ac734,0x7ffb731ac740
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,17315614408980849106,3336804495589918935,262144 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,10128092569068512272,9197667689469817674,524288 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1680,i,8681267832291846149,4737937361647388344,524288 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,10286559690255307945,16931976269946022243,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3448,i,5424577954524043840,5312327503435405370,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,7876964685967396841,15207526753461778002,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,14461105150732680098,16228270461428422498,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4980,i,10975770211765760529,183701267207361777,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,7563379234023446404,2798666055890739152,524288 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5952,i,17507451425567070524,14334839831811340238,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6076,i,9332101823408935850,5727547031366184007,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5464,i,2928328851081709922,14537340854454087448,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6372,i,10331969154160142280,8093285904298922139,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6436,i,17241360005356389491,14634922667889172469,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6640,i,11230398283143196601,3901033836516974294,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6744,i,17113334215960955805,14572414015584161355,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6644,i,11871149284661576302,9257852054615498789,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=7176,i,3854452086014974886,13632066329629217020,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7716,i,15056972893496185968,15369037009680876286,524288 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7188,i,3110491112446084600,16053538604278636169,524288 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7248,i,12776473522771723152,17780034104274343211,524288 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6756,i,8096529084416695588,11273979074870723183,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6512,i,16763149145649994394,14837958820588391006,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7228,i,7542899568881013567,16068706227118495612,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7148,i,627940320330286329,17638454506448287211,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7500,i,5904314004419167368,6307758561632314890,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7856,i,16613759745078304345,695313671287879613,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7876,i,5608329879851378113,6620213424338196513,2097152 --field-trial-handle=1960,i,16447636570053168040,11188627577946376678,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:5156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 06dda8c69f5a614fbdcab2b3bae3a86df8fc8aa9cb816094a7926052b8df2131
MD5 3744b1ca0948185f98fe892220439b86
SHA1 590619fe2f5c22355720a29821afa6fe8db4195e
SHA512 6a12abfc77f324eb8d775cba7ec2458c889963cc1d3b0a46061ca71a574b59f42137d708b9e0617984dfd04009435c2cf7b9db2d9ddc0228a03aeaeda4c667ad
TLSH
T165E022E6C821AC372DFD0B1C90D54B06FB6613163A80991F3A3CC31C8FB1A3A458AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 76KB
SHA256 4a8dd5bc483405a650e933737740b5a4352fbcd55373c99a98096d2796cb6206
MD5 19a3f7d7b9ecd34dab0ebcb362d47b46
SHA1 2a1d370a727f5cece2006e5193a88c7620dfff76
SHA512 e52c82d1b54b5dc8266c10c631a97d2a6c99ad5a44d0de45743d4c3c2e0b01efdbbb5ea6ffb47188e20b0c9935ab7c38a224e1d634891469b4731cc49e5a3fee
SSDEEP 1536:o4mOvxOrbpATOlx5xd2hUwgpeexOBKDG9tLNK8ARSndL+QEEEc:oMUhAT45xoOfEXBPARDxc
TLSH
T15E7302D567FB02823CEDAD586B702C5CE4CB91B3D85CD18D5BDAF5B92A400819284DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 854edd650ce7f6e5c738022e64c32e98230fa9c30934dfc293f6aea88d1df7e7
MD5 7bb5e5e1732e703a1a19e77e0b163007
SHA1 d251ac6bb158cddfbd87568fec2352a3b2382371
SHA512 30243e45587765042564812ca7b8894ab3e1484b4218f0c15f96c59ccd0f2ba0b70f776ce25e9479e919c8ae60a868f0e76aa3bbce7dff635cc56757afd15cfc
TLSH
T16C41CEF1329830F1DB448D7946FDEF017AB5090495A31EA63889597607F27F88A673E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5ba6c5e2d0256cde0ad48d9318d74b319a40fcb7667dacb61f498397f7be96ef
MD5 2470d8f565461e338e1405784f5f0b14
SHA1 eff3bfc70fd47b3a9430fa24f28d4a1693559fed
SHA512 247d39de79dc1c04484c735f94c0c3477869e644cca1de1b200e85b004d8516a3187c2dd8f69204827bc5a41cd2666d2131eeba672bff3b0954875475b9a9788
TLSH
T13A419BF0328830B1DB188D7946FDEF027AB5090495A31EA638C9597607F67F88A673E0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 30KB
SHA256 94a8d9a097237f6f81a5a605ccef394ee63cd0136dc1945021b660ca3b7cb0c1
MD5 380487dba511cdab2d044cd1e7dafee9
SHA1 730892f4792c7ec210624d64c8284f454d26b0a3
SHA512 3bcf058e8f9c4bdd9bc8a5a9c858ee55f496ee177713df46a3b103f8f2013ec88c2858d91eb1974bc3ec1e2b2f95b7cad92ff92e789896709e2dc0f87facacb4
SSDEEP 384:D0c3Vec/N2Agz1v5Be13t7tMekBeFfaVQaIg1/yskzNoiNNM/aZhfjS8aV8YBYPV:Yh0Zfey5pMl1/tzxC8Bs
TLSH
T1B6D2AEF7C3F49D2DCD2191F0EA262E1FCE690924576C387A85D87F5693E5832E20168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 157893dc7465d7708072282c36395911800723ff5481b780140176a2d2c880c5
MD5 154f261998df1d26386fc94b81a457d1
SHA1 656741f630b2d77293939eacbff210bbcbc2d52a
SHA512 d8ea62172b70eb621364432cc4ba3706c6e3649603f20984b18bdf197a4ac13435a3e08eb30d6c7f9766cd2c98bd6886683dd3ee1bc26a66d12f463200214b55
SSDEEP 192:TRecBzKL+rAaJxOIv7hpAPRp2HEhd95Hsb+WNJwBv42U2Nm2fe6sLvapKVyIsnA4:TRemzkiKU9UXHrwI62g2vsjapK8
TLSH
T15A52D92EF920793B5DDBC219FA667717D7FA143221942D84EAFC892C14E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 aed7b66f8349871b2dd25048c312b52d1a6f5384103a0b1af184c594a6401bb8
MD5 83008fad0e2a3e31687106a2ae8343ab
SHA1 90786e2c0dd4c73eccaeae623a6f8f1b759f3d64
SHA512 44cda2aac2ad554b91da19de7d0701d85499f125b185e7e8b1d77b6fe38d16e94bb6203caeed7e96674e8ba819e5e2083bc7e9860b8a8b15e97fda5a0db52f98
SSDEEP 192:TRecBzKL+rAaJxOWv7hpAPRp2HPEhX95Hsb+WNJwBv42U2Rm2fe6sLvaBK8yIsnB:TRemzkiKi9UX3rwI62c2vsjaBte
TLSH
T1D152D82EF920793B5DDBC219FA667717D7FA143221942E84EAFC892C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bfdb89a9e511ec38fd34f62382360532cb21ab967ceee5fd05f3608d52251cf9
MD5 ba734193deb09c90d7633df1a70a99c5
SHA1 82f7f11e11cc0ba7839563760134646ea98f42d5
SHA512 b73b9726a33c32fd17913812c3ec15bf9e23d4347f4de2ec19bb89f103e17536e4706a46e36551d74d9f282ea99a6b706a091ed443edce6ec4d3aab4d3ca0852
SSDEEP 192:TRecBzKL+rAaJxOGv7hpcPRpKHPEhX95Hsb+WNJwBv42U2Hfm2fe6sLva9K8yIsB:TRemzkiKy98XbrwI62H+2vsja9te
TLSH
T18652D81EF920693B5DDBC619F9667717D7FA143221A02E84EAFC892C14E7DCC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 492b826307d331fed58d88a7d9516df442f3424505c9e7eadb65180cfe73bb50
MD5 98de2372a1652fa5c76b854fa5e6beea
SHA1 f39f2b0665cfd7228c257c6ac8884a37ed101493
SHA512 1eaf287cea252e55450c8392a7f05378b3341791cef71ea55eb2c1b7a7ba5ef635af6c7087f147ee0b667e862bb7eaab9973f4702bd584fcf882444b3a609b4c
SSDEEP 192:TRecBzKL+rAaJxOfv7hpAPRp2HPEhJ95Hsb+WNJwBv42U2xm2fe6sLvapK8yIsnH:TRemzkiK39UXprwI6282vsjapt8
TLSH
T18D52C82EF920693B5DDBC229FA667717D7FA143221942D84EAFC892C14E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 906513d82df14ab58f90e531ffbfb4acaa841be51f7582eadac6b57aec85b679
MD5 d513fda2bed475ef8c2bacd79841cf80
SHA1 a5e7ee7abf83e2c54e3827345955f9579bcfdfeb
SHA512 48cc9f9f4b73b2f2136fc9cecc84de32fd311defdc27a7a7baed9f3507e52d5fdcc83c156929d5c9b8168c8d460e7c80b557f88fdea39f1ff8d03d5a91319549
TLSH
T1CEB0120280015201C04203F01642148C72245F10AE0B170193F069B2D825161C1181A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d925.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d925.TMP
Size 96B
SHA256 7311c3fec9071a0654ad320fd16de54494c5b3ddfd960c395293e9551fe35925
MD5 79f0fe390d09e343214d0c6ae4812d90
SHA1 628a040271cbfcc20eea03ca3279b0db2b8619fa
SHA512 1cdc73561a0554c8c7e3454b8b4e0fd280524e06ca751152c8b213d35dac782734a24da8514145c4b81e819732116253ff7dc665e152e872328fa0252a158080
TLSH
T1AFB0026EC1027212C0C303B0269D95D8B1B0DF65DA432313A2F15A67DD6967255656B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 daf23c538bdd34fba6f71ddc7a377e19c843ee20dd7271ad9e8aedddd7a39936
MD5 e56fcf744675fc0789016e24d050ffba
SHA1 066264dbbfc068a6243277dd2b6c13f432bdc38a
SHA512 25fed6c1bc654bcade8930b2365f4cfee40310a9b614b322196f76cbb26209928bb3a021de629a2c4f2e99cdb6e07c8f90892d3649a14024c01347ba85092076
TLSH
T1AFB0125411C07D36EA0042712EC6518413648C009A85119332934E8044062C81EC2140
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 4b9ad76a888f737d1d92b5196c4adb467660286ead6b626fba1dab5d3dc27682
MD5 86d08eaecbec1d2d2e1bdda6a58f467d
SHA1 2628c31e5da71a00856ba4696b486a16efd5e8ab
SHA512 5eeb7bab2fea248f5d7d062d09f1ecf69c43a9cb99675e2d5e59ec9a96bdaa14f9b0c2a7ce16c8045ef82420120fa1f624d5a5929bd794c940cd571c966736a5
SSDEEP 6144:fpYJXz0KdvBPvTqAH+B4FPXVOgqZ/ZLW3Exr:6JXz0GZ+AeuPlzqZ/piQr
TLSH
T13B341227FBD25D339EDECBA071862ECB56B2916A8028E320EDB55EC744834D24463D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 3c34700ce18b0a9c7edce8f64af6e4cd17d7c9f820fd4e06156343d3d61d1b71
MD5 a342eff616eed3295483285c54f21c49
SHA1 a1fc2ee95d5c3074dc13c8bd89e5fc0025ee3b0c
SHA512 7b4efa4d06e9c1ceb904bb27b0eb2cfb0f7ae6ae5e38c92550b6b6bd33df2b624e56a55af70993d7bff588bf3350be1b69a0746e652a05120438ac15ccd9e2e6
SSDEEP 6144:KzpYJXz0KdvBPvTqAH+B4FPXVOgqZ/ZLW3Exr:XJXz0GZ+AeuPlzqZ/piQr
TLSH
T1C7341237FFD25D339E9ECBA071862F8B4AB6D15B8024A314EDB56F8744835D28463C98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b74096f527fbeeaeef557cbdc0f791e8967997534549d45404ea9d1cd5597ec0
MD5 6ff56da267e2e684421a952267e2b2c9
SHA1 01d92e34534755c07911f7cad871042308fb2b4c
SHA512 8766dce869bb00caf0ad5aa3bc58f335b07fa75d14d52849b8f449b475377d4547bf6c9c19717a97dbca72e3ed9c24fb6e7e8a311ef9147e9f153d973950d20a
SSDEEP 1536:6XyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:cqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1E8C30237EBC25E335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93491644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 10352468bc39162447f2b73d18fb53bb7cdd262f1e1b055140abfe9ca4e7d3d6
MD5 e2d812b08f7651745f3a592b1a06a3af
SHA1 f3354750c885d73199ab0ca0de5b708e4e0111cd
SHA512 1e79175f5b642b6c5381a6a69dfebdf31c45cb383a5119fe69bc1c40444e0cbadcb741dc0c4021f4bdfe928309617b1089573e0b09c9d7e76e89a46a8394a955
SSDEEP 6144:WpYJXz0KdvBPvTqAH+B4FPXVOgqZ/ZLW3Exr:NJXz0GZ+AeuPlzqZ/piQr
TLSH
T150341227FBD25D339EDECBA071862ECB46B2916A8024E320EDB65EC744834D24463D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4392-11-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/4392-7-0x0000000007670000-0x0000000007692000-memory.dmp

Download

memory/4392-10-0x00000000098D0000-0x00000000098E0000-memory.dmp

Download

memory/4392-0-0x0000000000830000-0x00000000008E4000-memory.dmp

Download

memory/4392-9-0x00000000098D0000-0x00000000098E0000-memory.dmp

Download

memory/4392-6-0x00000000076B0000-0x0000000007742000-memory.dmp

Download

memory/4392-12-0x00000000098D0000-0x00000000098E0000-memory.dmp

Download

memory/4392-5-0x0000000007A40000-0x0000000007FE4000-memory.dmp

Download

memory/4392-4-0x0000000006320000-0x0000000006350000-memory.dmp

Download

memory/4392-3-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/4392-8-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/4392-2-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/4392-1-0x00000000098D0000-0x00000000098E0000-memory.dmp

Download