hxxps://github[.]com/gungugugungu/GVK-Engine

Analysis

user interaction
yes
max time kernel
900s
max time network
871s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/gungugugungu/GVK-Engine
Sample260826-t5eb9sseqf

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2992	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322359065301359"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3588	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4284	3092	chrome.exe	86
PID 3092 wrote to memory of 3648	3092	chrome.exe	87
PID 3092 wrote to memory of 3648	3092	chrome.exe	87
PID 3092 wrote to memory of 2992	3092	chrome.exe	88
PID 3092 wrote to memory of 1716	3092	chrome.exe	89
PID 3092 wrote to memory of 1716	3092	chrome.exe	89
PID 3092 wrote to memory of 4072	3092	chrome.exe	91
PID 3092 wrote to memory of 3320	3092	chrome.exe	92
PID 3092 wrote to memory of 4072	3092	chrome.exe	91
PID 3092 wrote to memory of 3320	3092	chrome.exe	92
PID 3092 wrote to memory of 4112	3092	chrome.exe	97
PID 3092 wrote to memory of 4784	3092	chrome.exe	103
PID 3092 wrote to memory of 4364	3092	chrome.exe	108
PID 3092 wrote to memory of 3508	3092	chrome.exe	109
PID 3092 wrote to memory of 2044	3092	chrome.exe	110
PID 3092 wrote to memory of 4716	3092	chrome.exe	119
PID 3092 wrote to memory of 3448	3092	chrome.exe	120
PID 3092 wrote to memory of 3448	3092	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/gungugugungu/GVK-Engine
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff0f66c728,0x7fff0f66c734,0x7fff0f66c740
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,16826745751185903677,4908768164413212636,262144 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,5050224008543341264,8311659273941681303,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,17821670053082813132,3373864883123639239,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,14918022817032920571,17896113903872948787,2097152 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,5892500162845697962,18062542780528129017,2097152 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,13097429873950076523,7428068009077681791,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,9799254636357838469,7587128714264749716,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,16840997829944084171,10156213759568282088,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,17505843676314600646,12292794933625808217,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,10073588349198926918,2759478271008233249,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5812,i,4151485335616400509,14347428386888943224,262144 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4068,i,2591406549027607512,12421470870268439163,524288 --field-trial-handle=2004,i,4956337967189515923,6133302304844882009,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2600

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\windows.demo\HOW TO RUN.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3588

C:\Users\Admin\Desktop\windows.demo\bin\GVK.exe
"C:\Users\Admin\Desktop\windows.demo\bin\GVK.exe"
1⤵
PID:1580

C:\Users\Admin\Desktop\windows.demo\bin\GVK.exe
"C:\Users\Admin\Desktop\windows.demo\bin\GVK.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 28375e6c005a0a9580f8f31e3fed7387d543795857e8c379858c5a1c5b71d71f
MD5 a7f72d4899ff4661454e636f8dbc03e2
SHA1 089ee235c6cd64898014b8a4f383e82e53ebaa64
SHA512 68037b8e855bf892104a40162ef3acfc9ada112560386a85b415663654aa40d81d68f3abf0c6ce0c3f69ff44442b7132f47d9fa90ea3a7ff4b0b5b0f41a36d4e
TLSH
T15AE02BAED936AC3B18FE0B2C94904B47D64013573B41895F3A3CC109CFB5B36455985C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1f81cc1f44728ccea0ecc48f558deae4c764166a07b8e0a128e0a5b9038eb183
MD5 252234b32177a7ee27f162651c6a6cb5
SHA1 a7d60f52271ccec47829380251f585e21be1e998
SHA512 6b790f66dfd4ae16c7cef6ff5591d7b1666fc537edfe193b9b19be44c9b22f80ecce0119c7c3b63e6c7c02ab74195c0aaab569decac25efeacbe453d8304255f
TLSH
T1E75171885D8FE94DFBE03DB153E7078E363F053BA8D73E0600901E3868743865119B42
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 888bb99a6e2566a572d922827627782680d61fcfacb8538191f687d4280daf04
MD5 0c6c5195ebe889c2daff45ebb7a6b028
SHA1 e27ec9f9dae0d41419cd90f4303ddf90bcffc63e
SHA512 9c1cc6a90d4ab67a9805fa1c26f4950fb20c8854aff474e0f8e9cf79789e9eeee1bca14e20d826f1ff3a24cbb9f982fac681555b32b0f2a4d612647057a43de1
TLSH
T11E61A9F743F5956D8A1296F0EB04AE1FCE290524431C387A88E47E1B93E3972E14179F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d418abcc934dc43bb807b8ffeb6474bee48f3680ec6fd889136630373ae9a774
MD5 c58a27b0638775771f4cd4142d391696
SHA1 ecb7bafedb9536318f012c01c7cf3f902e2a123a
SHA512 6902cacc2520e067eab9815adc91cea261733f7b3df06e955bde50cd5a38f227d6a5a20cd5b484237fb2858d681cb1b7611b95650a050a482886422e2edab155
TLSH
T1F95186FB47B1956D9B0196F0EA04EE1FCE690120431C78BA88E06E1BD3E3972E14179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 192aa7d729ff0141c4d31870b7217d640b21e3cac3cd8e1f705f925b4d3a47b7
MD5 7925a66ded1bc74696d10c0dc9d3cf49
SHA1 30bedb9123023b6b14dba9ef5e4f06c913f6471f
SHA512 faf2d9d40c80368e514f7082f7644e55d96bd498f10afcc610c520cd952b7002b630ed243b426d818351f931d2ddb35c35c309db7efdb486a981ca1e609dd1a7
TLSH
T14A218CE7D67B745B04AE9DAB1E04BC0A28B9A83A0151ECF1CF97916CE0834F71F1502A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 03fcee2231ba69e586d117111ef26163a9eedb4b92c191c14771c3da655f74e4
MD5 fcf384e022ad22f7ed3c519812f3a8e5
SHA1 ded81a41232e4b389b9956b14289ffe117cf2710
SHA512 0551c20125527d7ba8efb8fcaf3358606f7906b0a3ade82e9f2ffe39d05990f599b647004a90629a51f519234107e0d289e6b98457efa077d04e3aed0193fbd5
SSDEEP 192:/R1buG6xR8v78pAPRp2bMh9DHsb+WNnYC2W8ez1UlkkwJ+VyIsnAUge:/R1buG67o4UXV5wxce5U2p2e
TLSH
T18B42D72EA9106D3F5CEBD219FD657763E7F2102261A51E84EAFC892C14E75DC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2a00c1904f2981459da3700d3627ee44f579b1a39119594f64a65851eb6683a2
MD5 b8ba0f94a3719ef8aa7d385ff6ce2e6e
SHA1 6e8725659ea368f33bea783503447ad916fdb434
SHA512 14fd34921c7fcc90ea400e2b3b0a2e636ef559812f0b6b2be644432decab72f4f4f3326c9883a7ff5b434d9c4945b8a95a822d6a0fb70610f3f06cafe515a004
SSDEEP 192:/R1buG6xR8v78paPRpQbMh9DHsb+WNnYC2W8ec1Ulkkwb+VyIsnAUgE:/R1buG67o4+XP5wxcewU272E
TLSH
T1A442D82EA9106D3B6CEBD215FD657B63E3F2106261A11E84EAFCC92C14E76DC3227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9cf8c7bfbc417dfdea79688ccf41933b4abd5b52683e49beb489718f8e156386
MD5 d80b406921e3f353394c807681b22060
SHA1 8a016a2933dbc4b4309ec4fc8f2ee09fb23ab7e6
SHA512 ba08ae67123f0a923019a91589c834ad7cd239f18912c3f0677f7ea5b11222ea2ea48d781ce9112d6f0eda92907da73679ace6974ee0130d76447740a9eadf1b
SSDEEP 192:/R1kuGKxRgv78pAPRp2bMh9DHsb+WNnYC22U231UlkkwJ+VyIsnAUge:/R1kuGK784UXV5wxo2lU2p2e
TLSH
T14942D72EA9106D3F5CEBD229FD657763E3F2102265A51E84EAFC892C14D75DC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 21fe45fd4d60e209705845f2ee599eb660999a78da317730a88445ad24a4d4b4
MD5 a568250aa58af691fa4464a900b6d635
SHA1 e98145e65a84dc3e53ed3f9e8c6a8bd17159f20a
SHA512 e8716d4748bb04a0ec47f7d5f8c142f0657af402834dcf3cca943f0449b787cae024efc13e9dca7e6dfba8628b8246911da320d46c648e8286a934ada58b6165
SSDEEP 192:/R1buG6NR8v78paPRpQbMh9DHsb+WNnYC2W8ec1Ulkkwb+VyIsnAUgs:/R1buG6no4+XP5wxcewU272s
TLSH
T19C52C86AA9106D3FACEBD215FD657B63D3F2102265E01E84E6FC892C14E75DC322B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1090f2550f8b5af7e995dc8ced64b94adc2048ff2807d0c9887af670785cc952
MD5 1a41fa3c8346ad648c0c203cf3b8a164
SHA1 380fb2e6e5a80bc42c19ef400c824109bfc87c7f
SHA512 aacec8646c40699942623d187e00dba4281df775e69819925ed201f2dbe81a3d681fd0322d4147d1e83d984731f163e150e06b30609c024faca31d2f6478b2d6
SSDEEP 3072:QyGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:QFm7Rkm1tYpBeh2BAoO
TLSH
T10DC3023B9D65EC375DB9BB1AB04E0A1F1EF249A7C920DE46C8D45A0433FA6CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fb41eec172250977237596f194a9d6680d4a2a96f8c9ce79555c4e65551ca95b
MD5 b4858b1827dca941e101ec82f15ed4de
SHA1 85c58583fcd761c230e79ee052cfe44bcf2f174b
SHA512 d17384fd713be1e5cb76e6062d4188596c4d3edba6690bcf273b46f6f0f74d84b58ed1ecc25f499431512b1340d679a33df9796c81dee2002e3677d9f9dec552
SSDEEP 3072:8yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:8Fm7Rkm1tYpBeh2BAoO
TLSH
T15AC3123B9D65EC375DB9BB1EB04E0A1F1EF249A7C920DE46C8D85A0433FA6CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6dc7f2776371dd4fa5b16bfd25c054ca99ffb37ea1a3d593f8a4505590d59cc5
MD5 de74c8341c379497470b6a8ec34ddb35
SHA1 1e55e7c83f72ddbf209c72300ecd963a4c680d7d
SHA512 4ec9b97856ebbca09bb14d674ea90c86c6b26bc439a73de0637ffca3ed5677c03cfbe9d39a80dacddf77a9cdb71c8b53901b1c4e90d02dac32eced1419fbf545
SSDEEP 3072:yNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:yEm7Rkm1tYpBeh2BAoO
TLSH
T17DC3123B5D65E83758B9BB1AB04E0A1F1EF14DA6C920DE52C8D89B0423EA7CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f56d73a7c05faf49167cbf1902675c562195d9231ec7b8d83633deb21fbbac0d
MD5 84864d72dec468ea4ec4b2035b3edeb8
SHA1 07235abddd7972d2b4304cbde62c4c824b0d8382
SHA512 16dffc2da3c81a191bd3805c0eba79ed1c6f9d46807bd31b4c181671606237843dd8373c4f306ccc05d9876f1ff21fae01228e6dd22dfa8f339cf1c9621a1a61
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:km7Rkm1tYpBeh2BAoO
TLSH
T1F2C3123B5D65E9375D79A71EB48E0B1E1EF249A6C930DE4288D86A0473FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 500ccca54bba32165576733f30c6779bc24ca0c86f2f17f1f5c5c1a2091871ea
MD5 37ee5ec5dc0d4c8694630cb8a3fa54f5
SHA1 b6db1d479a6178175c484b2238c432c15810699e
SHA512 8c46410606da9f760d03aa6408c5e6be90d07b8edacca5d698c32aefc2dc606714850db43d6410a0273137676dc8a1863ec731d37f3ffa0cde3555765b5d2dee
SSDEEP 3072:fNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:fEm7Rkm1tYpBeh2BAoO
TLSH
T166C3123B5D65ED3758B9BB1AB04E0A1F1EF14DA7C920DE52C8D89B0423FA7CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows.demo.zip.crdownload

Path C:\Users\Admin\Downloads\windows.demo.zip.crdownload
Size 10.6MB
SHA256 e72e8afc6b0e916adad3673404d2acd079216cf834798ba6e74c237961f9fa6b
MD5 4c8d44d8e46a7cdc152343bc093aed7b
SHA1 111cd333606b78c0602b9a5be5870cb717fc4bb7
SHA512 8d36b0a0b934f09b53e6e796aabb1dd4d49267b67802d9fe9e1a9960dd60eabb96ed66c02cefb8fe34e8d99fffca86fac5a9682a35d2e4c621f056717ba0551d
SSDEEP 196608:dJn5bgDIj7FbGC4PlH4hWKR5W820H9eiYV6FLEF8gjhGfQv9rBaHWCiHltdRhWu:dVJgDIjxbGhy1+81eT6KF3jcc9rBxb
TLSH
T11CB63356C2C933BCD1135A2BB9D93B9066A3E13E480A56857FA0F250B78D1B03DB5EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download