8e85b2e432c8d6217e83a74feee7af68df442ed514eab28f18786999a5a886b1

Analysis

user interaction
yes
max time kernel
546s
max time network
548s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
966314.jpg
Size 134KB
Sample260827-e1fbfaxwf1
SHA256 8e85b2e432c8d6217e83a74feee7af68df442ed514eab28f18786999a5a886b1
MD5 b1f3d495afc9387a630db01c3c046cb6
SHA1 a6fee0a08132adfcb59af162a72b212d09223ca3
SHA512 28f228585292c65d01c0c0c675005d9ae717a2da359fa13903ca759dded0e2d7396fc17b758d80d5a1d336de01c3e39ee9fee70f47a3115a4b76577a42b43208
SSDEEP 3072:OdxtasY3cuyZlj0XFXdnJuu6Qvg5kZiUakFE:IasYNXlxAu6uiUK
TLSH
T121D3F16F5B242894FEBE927094BF8D46321BD61DED539FA4AE11CD80431B7EE14BB840
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5368	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322782859872955"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{88B78117-FEF9-4C38-BC31-3A599C14D2E1}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2240	mspaint.exe
2240	mspaint.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2240	mspaint.exe
2240	mspaint.exe
2240	mspaint.exe
2240	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 476	1332	chrome.exe	93
PID 1332 wrote to memory of 4500	1332	chrome.exe	94
PID 1332 wrote to memory of 4500	1332	chrome.exe	94
PID 1332 wrote to memory of 5368	1332	chrome.exe	95
PID 1332 wrote to memory of 1544	1332	chrome.exe	96
PID 1332 wrote to memory of 1544	1332	chrome.exe	96
PID 1332 wrote to memory of 5280	1332	chrome.exe	98
PID 1332 wrote to memory of 4996	1332	chrome.exe	99
PID 1332 wrote to memory of 5280	1332	chrome.exe	98
PID 1332 wrote to memory of 4996	1332	chrome.exe	99
PID 1332 wrote to memory of 2040	1332	chrome.exe	100
PID 1332 wrote to memory of 2040	1332	chrome.exe	100
PID 1332 wrote to memory of 2448	1332	chrome.exe	102
PID 1332 wrote to memory of 2448	1332	chrome.exe	102
PID 1332 wrote to memory of 1064	1332	chrome.exe	103
PID 1332 wrote to memory of 1752	1332	chrome.exe	108
PID 1332 wrote to memory of 1752	1332	chrome.exe	108
PID 1332 wrote to memory of 3280	1332	chrome.exe	109
PID 1332 wrote to memory of 3280	1332	chrome.exe	109
PID 1332 wrote to memory of 780	1332	chrome.exe	111
PID 1332 wrote to memory of 2488	1332	chrome.exe	110
PID 1332 wrote to memory of 780	1332	chrome.exe	111
PID 1332 wrote to memory of 728	1332	chrome.exe	112
PID 1332 wrote to memory of 5236	1332	chrome.exe	113
PID 1332 wrote to memory of 3620	1332	chrome.exe	114
PID 1332 wrote to memory of 5416	1332	chrome.exe	115
PID 1332 wrote to memory of 5416	1332	chrome.exe	115
PID 1332 wrote to memory of 4232	1332	chrome.exe	116
PID 1332 wrote to memory of 4232	1332	chrome.exe	116
PID 1332 wrote to memory of 3416	1332	chrome.exe	117
PID 1332 wrote to memory of 3416	1332	chrome.exe	117
PID 1332 wrote to memory of 3840	1332	chrome.exe	118
PID 1332 wrote to memory of 2888	1332	chrome.exe	119
PID 1332 wrote to memory of 2888	1332	chrome.exe	119
PID 1332 wrote to memory of 4568	1332	chrome.exe	120
PID 1332 wrote to memory of 4568	1332	chrome.exe	120
PID 1332 wrote to memory of 6012	1332	chrome.exe	121
PID 1332 wrote to memory of 6012	1332	chrome.exe	121
PID 1332 wrote to memory of 4328	1332	chrome.exe	122
PID 1332 wrote to memory of 4328	1332	chrome.exe	122
PID 1332 wrote to memory of 4340	1332	chrome.exe	123
PID 1332 wrote to memory of 4340	1332	chrome.exe	123
PID 1332 wrote to memory of 3840	1332	chrome.exe	124
PID 1332 wrote to memory of 3840	1332	chrome.exe	124
PID 1332 wrote to memory of 3044	1332	chrome.exe	125
PID 1332 wrote to memory of 3044	1332	chrome.exe	125
PID 1332 wrote to memory of 1092	1332	chrome.exe	126
PID 1332 wrote to memory of 1092	1332	chrome.exe	126
PID 1332 wrote to memory of 5536	1332	chrome.exe	127
PID 1332 wrote to memory of 5536	1332	chrome.exe	127
PID 1332 wrote to memory of 3620	1332	chrome.exe	128
PID 1332 wrote to memory of 3620	1332	chrome.exe	128
PID 1332 wrote to memory of 2240	1332	chrome.exe	129
PID 1332 wrote to memory of 2240	1332	chrome.exe	129
PID 1332 wrote to memory of 4632	1332	chrome.exe	130
PID 1332 wrote to memory of 4632	1332	chrome.exe	130
PID 1332 wrote to memory of 2092	1332	chrome.exe	131
PID 1332 wrote to memory of 2092	1332	chrome.exe	131
PID 1332 wrote to memory of 3432	1332	chrome.exe	132
PID 1332 wrote to memory of 3432	1332	chrome.exe	132
PID 1332 wrote to memory of 3536	1332	chrome.exe	133
PID 1332 wrote to memory of 3536	1332	chrome.exe	133
PID 1332 wrote to memory of 3584	1332	chrome.exe	134
PID 1332 wrote to memory of 3584	1332	chrome.exe	134

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\966314.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe61fcc728,0x7ffe61fcc734,0x7ffe61fcc740
  2⤵
  PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1804,i,18053456413045476810,8339498245663703603,262144 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,10216058363799975671,328734516597624839,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,6355159691985506344,1888515261902633658,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,7729446990216248201,9493953072324860126,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,4200521530065464557,1830055668690239373,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,6237143377462697599,5480956451687878523,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,10240729822788336742,1257850318915361783,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,4887853516946689171,2921926847784183406,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5944,i,3324747909842399229,5468787768228591384,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3392,i,18089657148623920992,12410479843542595399,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3348,i,10842854834342986849,10245344813731419764,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3512,i,14988313688429661565,10693178418660821827,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,2053073019849851340,17020200282726683733,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,1210963793445059572,6177283607712074815,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,1466999718500552625,12956538471150106899,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6048,i,10465138679034787301,1213158773236596866,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6248,i,5356742841963513642,4118622584608816579,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6676,i,6647171137198685397,16193630918316118609,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7024,i,17360629491888427076,17367209030526946856,262144 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,8862907339176799821,43572892845837120,524288 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=1600,i,14986990616932794098,18404586243089194064,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7312,i,8021276027954791124,10625772277540099410,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7504,i,8648476415961598530,12851539801047811726,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7844,i,9124829167954790515,6158252799601967311,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7300,i,1446679504620200138,12449733787197237921,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7788,i,3000129027430546906,17794134383055932975,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7836,i,1872091064707507805,8063484741389499569,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7752,i,12545016717996199675,5619049161676607516,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7756,i,14853963682155125357,14962908137502175107,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8116,i,7133445552659339069,18166549811963479726,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8100 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8260,i,15264084697114999178,2368184195432200271,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=8436,i,11066611667260111989,3726431072122340372,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8244,i,7494748969277368321,7516921328198303731,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8460 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8260,i,15928765782964902774,1681129515489692315,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8268 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=8380,i,1993837352727031115,12448325904793620673,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8752,i,11487224548559804255,16896856331047142580,2097152 --field-trial-handle=2024,i,16323558107743756276,17083216150881869238,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8396 /prefetch:1
  2⤵
  PID:5572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 21c0c6677a65c79080ba8e2d2603a0673a51e5ba4f27747ebd301a07eaafb1c8
MD5 045d2f383b1f96317b8208bc12fa99ff
SHA1 722428d60a311f2a800c2c60fcd56cef16da8311
SHA512 af8fe77b304cb8f8de829811353ea75cedcdb848b8496f9202ba37fefb6133808a769bce3af0139a4a17604c489e97bdb04d4083ded873edb2f2ddac36e7071c
MD5 SHA1 SHA512

Submit Download

0fb771ad-3bd1-4182-8354-0ed74cd2e64e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0fb771ad-3bd1-4182-8354-0ed74cd2e64e.tmp
Size 15KB
SHA256 164ba5e1c378db3ce99f41ce2ddab97b839e6e6f2cdc9ab59d36b2979c740aa8
MD5 a2ec0d325d384b29d8ded615c47dbe8d
SHA1 b07e7c6c95925ab93e295d017136bd18e1df1941
SHA512 d94bd1d705baa14ac852ef79c1514fc2ce0d1c59152beb235a2b9fc4c938ffb9b134aaa83e266a9cb71b87e1acc50812834337021007156ffeb922b17c3cee5e
SSDEEP 192:pRQcBz6v75tWwyxMcUv7khnPRpTpLzGhKd9fHsb+WNxXNWUvJGRsLsmd6WxXeZGx:pRQmz6DnWxQohXtFwI6r6A5Eyie
TLSH
T14662C82AB9A02A775DDBD219FC127B5BD7F5203655D02E80FAFC892C01EBACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7058bc634a5ab7487871e3216e05efe2c157b9159a307542d14daffed50c85d8
MD5 e4d8600d874fea92019eddace15d07ec
SHA1 288b4ed430f4127a2589d8faca20226116a1b9f4
SHA512 31c4b7c003768db7115ddccefcab830401690f898b657944f72b2db6c88ae6e88160f5d83ba7e81d827fbf5ee183d46efa6dce42609ad074627113f6a8a90f01
TLSH
T177E02BA5C922AC671CFD071960504647E66413272A90494F7A3D810C9FF4676469681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8e3ee7d0d75dc684eacf864688801541cc3c6ff57eccfc4fbc588f38c22682a7
MD5 89a723d88c3f2896e4eeadb80600ca5e
SHA1 db56810fa08357093c540262baea92cd65cd01c5
SHA512 5d0754bb72ce8e52fee71ac1c09bbb57d5ce9bbf8e623873b510d3118521a13a98d1b110802599b38034eec56d98b447043e9232a15568eb73d99b6cd75f2c3e
TLSH
T1B5215447FBF90554DF204DF718D44CE73834816A02473AAA09138835E24FAFD4852AB3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 d9afab3a7cfa208269494b0368af4425463eb7576f253adbfe5036fc934986f4
MD5 b73c786a87a71e2b92f641fc3a09e022
SHA1 48ab8c6eb05eacf189092331311eb64fa09914e2
SHA512 53335d09aafe6ba45df519fbbdfc00fa3e1bc4f8a616174354ee75a22175ff4d2947446b4e9aa7651bbca2f7fa30813aea41d822c63db65b2218035ae8b69a13
SSDEEP 384:DTpz9Y/WJgpJ8bHsqlzFaIH6x/mpZWsLfgajGFffNNrN1IgTiZgLjnWavl5UnEEH:HkGn6XnnY+SB
TLSH
T1B762ADFBC3E8A62D9D2156F4A7256E1FCE1D0924432C3D6BC8D8AF1B93E1471E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 6de9978f4655a5394c1de007cf530d70f7d86e77addc8b7fa39aced33b9f1715
MD5 e82a883d026c167a67d6b701fe6f7307
SHA1 4a4fc1fdc3346f1629d2e42200e1241c3102d175
SHA512 acfa9ccc6ae3b94314495ed3d4c157a0abe6c49efbebcb66d3bb070d4b1dc87b1c4eee8cbc9c5c00a1b13b76016ed1296aac35e5f080e213a1e3c09c5dd2fafd
SSDEEP 192:DTpz9Y/WJgpJ8bHsSaIH6x/mpZWsLfgaPbvuFffPisNPjN1IgTiZf16TLjwSgBaa:DTpz9Y/WJgpJ8bHsSaIH6x/mpZWsLfgQ
TLSH
T18132BEFBC3E8A62DDD1156F4AB296E1FCD1E0924432C3D6B88D8AF1B93E1471D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 7dc4f50fc994e7febec729791daa8ec4dca2994d2dbf25b1c5a7ecc89b3b5a9f
MD5 68effefc1b8e4ce660b4f8e8ccbcd5c2
SHA1 89478f40ba508f86b8b5b8936c51f213b33f2996
SHA512 0ea493d15297338d45d98b1b60238649c5e46e453a2c70eb5ac6e5d6ff1e09559d81ca812656fa7694c5c38b47794ca157babe0f2df42e3fba86a9f2eea6f5fb
SSDEEP 384:DTpz9Y/WJgpJ8bHsqlz9KaIH6x/mpZWsLfgajGFffNNrN1IgTiZgLjnWavl5UnEE:Hknn6XnnYPak
TLSH
T192629DFBC3E8A62D9D2156F4A7256E1FCE1D0924432C3D6BC8D8AF1B93E1471E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 ec9670abfcbb533aff2183dc2ffe2bddca4f9ca6fbcb05f16011e9861d5ff5d2
MD5 e86167957af95d7582710da4efee4f24
SHA1 51483dfe61b9ab43e3baa773ca1cb89cb1775113
SHA512 d2c1107d91b8b5d31c85a772d3ebf02c2eef658f40369db726fc66c81b8aa23e7d67cae628a6ad50525cccc4f6c3d41a861416f35a0ed824ce9df8225033a989
SSDEEP 384:D0uLitqJJw5JywIl7aUiSdaIH6EdmpZSZLfgajSmfqNqN1IgTCZg6jnmaDl5UnEZ:pgen92iPWOW
TLSH
T10942AEFB83F8A62D9E2195F4A7256E1FCE1D0924432C3C7A89D8AF1793E1471E20175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b1d0d676af3dc655d6de61c648b3c45a81e8e9da4676e653b49710e980cfa665
MD5 b9a93312ce2cd9295e97e06bc31a2926
SHA1 673abc11a1409a44608f9dbcb75771cee62aec8b
SHA512 f02f85e90685e7138e673fe14da461c42abd69de07851c686dd3f360c2eb0a2911e84e058654c3ae01316b95ab80d0859af38f4f7a34154f0fef662904e3a5f1
SSDEEP 192:YREcBz6v75tWwyxMu2v7khnPRpTpogtd9fHsb+WNYFeNimd6W0z+OVec5euz0ZVK:YREmz6DnW3CohXxFwvR6xReIie
TLSH
T17062C92AF9946A776CDBD21DFD127B67D3F5103625902E84EAFC892C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6d7a4bfdac4f1d544f77eec576ea5927c69ff41ee8991fe2f7ef316b93c105b0
MD5 02c33a103daa065ff5eec9e5d9613502
SHA1 898dff452e636c7cc2ad6610881e3c41bcd6c394
SHA512 d970dd08c32df92665c719498bcd28df980f48f64039073307a1d5a672519120776f5de0acd5f236ed8c20944de9362d74b3f0728814db57cb3e8b2ca58054c1
SSDEEP 192:YREcBz6v75tWwyxMuVv7khnPRpTpogtd9fHsb+WNYFeNimd6WUYMOVem5euz0ZVK:YREmz6DnW3lohXxFwvR6eHeSie
TLSH
T13C62B82AB8946977ACDBD21DFD127B67D3F5203625D02D84EAFC892C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d0fe268f8c8a01ed54e82990c33a079aaf714af9be15233110af8cf4507f0eee
MD5 cb4e4addf1c497b82a276cd1b28137a8
SHA1 20c1b0a273693cd26181c7f24bce609cdd7d9b4f
SHA512 69ea864f15738cfb6a5ee9848a51b54ad3918d208b22ca3b0b1a0821e5c1074d8e92bc9cf6e015ffaaf8b14694f41cb1d893826634b032b81db942e34cf6f815
SSDEEP 192:pREcBz6v75tWwyxMcUv7khnPRpTpnzgtd9fHsb+WNYFJG/md6WxXeOVef5euz0ZM:pREmz6DnWxQohXgFwrA6Axe1ie
TLSH
T17262C92AF9946A776CDBD21DFD527B27D7F5103225902D84E6FC892C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0220702a6a33c6ea9b186ad69b3070092723f328a9e13fb6a4c89fa8508d7a6b
MD5 3536159d994c1f2211b57e3fadfafb40
SHA1 03f8138cb4245e13accfa43da0f41074a5dfc559
SHA512 df65f1025f7c85af7aa2425a9de2ee583d694de47f40e08843c3622ba1e4eed70c3888b1970d61eae6a9558657b49a88eda3807781ebb5890fe6a977541b0d19
SSDEEP 192:YR06v75tWwyxM9lFv7XhAPRp2k9fHsb+WNneN0K5euz0lVyIsnAUgtaJ:YR06DnWsl1L8XPFwQ0+k8
TLSH
T13542D82EB954653B6CDBD219FD627B57D3F5103221E02E84EAFC892C05EBACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f5f1d371ba7a131d8738da040003f02ee64fe2020f83abe7a118c07666a87db9
MD5 5023bb0e345a8a74d4c87175d5666f19
SHA1 6a3c90a4b54321e58b0c24ce58c471224352d533
SHA512 0a806d36649a443ae10997140a6a0bf466da882f92f29046f6ae4b1585892067800f7fff7609ebc6ed150712de095bf84f3f96b6ba8c280c4a05ef8ca5f948d9
SSDEEP 192:YREcBz6v75tWwyxMulFv7khAPRp2poJ9fHsb+WNneN4gn2s5euz0lVyIsnAUgtaJ:YREmz6DnW3l1o8XvFwQf24k8
TLSH
T1C152D82AF994693B6CDBD21DFD627B57D3F5103625902E84EAFC892C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 88441f7725ed5685a2b1d5ef5037fb37b54904dd97a8a2e234382b55065b22e8
MD5 c29b41f992c4ca55f64012533f9da5d4
SHA1 d5a8a53295507f58299f13453395eb33e04f9055
SHA512 0b1196d764e78b4d4c7d2aba28cad794876b0671219aef38c499341d98770405f20546863e3a2394172f1f8fb23b09b0b7356fa4b03378afcb84bc1a7b60ae15
SSDEEP 384:eojKB7KxkXqKf/pUZNCgVLH2Hfgslmc7pLuLcSjYZXODKZ+ErU3n6HGY3Wobe:ecKB7KxkXqKf/pUZNCgVLH2Hfgscc7pg
TLSH
T14C7207777C489A370F94CACCD8277F4FADB5025B66E9886486FA482503D5ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 32b5063235069a59adaca788da75264428364bdafc8135a02b25db702e0ba79c
MD5 4be9929334164df8bbecae48598b8e35
SHA1 df6918368d75e4d33d5de679eae35b5ca1705e53
SHA512 72fdb09903e950aa5dc75bb137c0e33bb492fd1e209819b1aeae9098d4e91abc0e177a46c93d1b822c680d5ed46e6118b19e06bea155beb8f2fc214759f98d4c
TLSH
T154B01240C0129102C50202F4214238DCB1589F14960A170643F06D26DC25191C014054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5853e7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5853e7.TMP
Size 96B
SHA256 8aa74ee1e3e533c20bd69fea5b5a9fdc9fc7c04eb82cbc071f0082c30c3f78c3
MD5 393d112c07ecb24bfaece7cf1efffb62
SHA1 253fe069f171f7e6a8ba951580aedc50a2c74fb0
SHA512 57a1ee0cf239be876f39b302f35db5ccc9326c52c703c1877f9d4f2ba66b4cf04c55f9f1d5dc2616aed621aa27cf011f4adf0809ffb580385f91ebffa00938a6
TLSH
T149B02280C002A203C80203B02A8280C83030CFA3C203038383E80E2ACC232B08822C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 b0652b7af9abc9e0f05238c961fc88cab3eeac899d4c7a0ac752b225f8247676
MD5 aab0c62662f70af305d37bf2697e2144
SHA1 70930bccc671d4013f8ab94323b20edbb50a12fb
SHA512 d09d19530eaafa4502a42849fc3b0f01473cbd24d589b18a26ef5e322e5f59b58582a5d84011dcb187fe9dddf9b163a1a482aa296d5df25ea68259a088af8e17
TLSH
T18AB022AC000EBF03CA0003F020C200C03B203EA023EB8BA223F08828F0A2300C3A8000
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 e3c2d07c107647392b84e530b424e079a80a28a9518d737acbb14967fe0d4e01
MD5 35a37e328ef0081f4b9940dc18807ff2
SHA1 a1862706bddabc05b6849e11b5bffe5021e6cadd
SHA512 7a2ddff238047dde492a07d34adb8e2d5ac68f72cf3f4c660b72b8c8567fc865fcf1b8e16d86b01c4f3ee780761817efc1115d9c4a1045af119c2d092cb0e1cd
SSDEEP 6144:CRYIlZtkAVlYJ6X7ivkBDm7Rkm1tYpBeh2BAo8:iYIPGJ6X7BBy9oBGcAo8
TLSH
T19C3413336C74B8F295AAF25E254F1B1D1EF04D67CC249B56D594AF0423DAB8C160B6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 d41e3c7557fafd192f1b965da7baaf475e8f0b8be47e44394fb7ee10d1987b2d
MD5 8227f1b1e95711832859c14aeb84c16d
SHA1 a64032b98a8f76598611dd40f46cfd281d975d6d
SHA512 a5a89a0387748dbc990fc7772d40030cf4c7f7d875ce0953a64f4eb2c1dc96235fcf3dd0497911cba52095d56567908d3e0b5f4d9abb5f1e6e143fc4af6aa89c
SSDEEP 6144:ORYIlZtkAVlYJ6X7ivkBDm7Rkm1tYpBeh2BAo8:WYIPGJ6X7BBy9oBGcAo8
TLSH
T1493413336C74B8F255AAF25E294F1F1D1EF04D67CC249B96D594AF0423DAB8C160B6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 daf9257ab50446735ef4195532c19d68e5da5c3cec06669cadd1e8e2febca0f3
MD5 f809fa2d86d97e2685a3d93c2a9fabb8
SHA1 f4e429452734217807b63b01cbcfdce38737a1cc
SHA512 78c41c2e80c71cef14e1b6c202e19fee345b6b5295b6e9791f55c8a29103a52a471c7fbb61c05ae2dcbc8709d3333b9b1045fce2e1cb831b2bca0577a598abb8
SSDEEP 6144:dYIlZtkAVlYJ6X7ivkBDm7Rkm1tYpBeh2BAo8:dYIPGJ6X7BBy9oBGcAo8
TLSH
T16B3423136D78B8B295A9F25E294F1B2D2BF04D67CC248B93D594BF0463E6BCC160B670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 0258bce02cdc0720e5b8a085cb3b24fc047436aa27f9df6ba7ea148218b2119a
MD5 1ee7214f7a085010daafe803e99822a7
SHA1 de03104b96e1fb7002a118d99930a80c8da9430b
SHA512 a148d496c1ac78c6a55e67fc259e50fc416c2e7b4a47e9060af62914c7b938c9293cbc4e551a68b7aba0eac15e004958c81d1c9f7eb05ba3a5375a31865268b6
SSDEEP 6144:sRYIlZtkAVlYJ6X7ivkBDm7Rkm1tYpBeh2BAo8:0YIPGJ6X7BBy9oBGcAo8
TLSH
T18F3413336C74B8F295AAF25E254F1F1D1EF04D67CC249B56D594AF0423DAB8C160B6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fab48939e2444202630d03b6fb8371bf37039e8d7e44fcc4399d679de030db2b
MD5 8a58fd01ce212c3cad25dde95d0b7bd7
SHA1 3520b3ae5bc80559bfdeef0428030af8f05b2c9c
SHA512 299d663aaff911ab5d9b4631c6a8c6d6c23c07f0c6394f47449635772ec0d406adf60822194844613a6f40f64179d37631b7ab9d4a2ef1b0b2b50d97722c8ec8
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:um7Rkm1tYpBeh2BAoC
TLSH
T14AC312275D71E97B69B5A71EB48E0F1F1EF14AA2D930DE42C8D85A0437EA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 e65c4eed8aa19c26eb548dd185102a87eccc9597a29335defedd87a7d20e244a
MD5 1fe1b8437372361244c82a94e6296258
SHA1 7e1a1b36d72ccb42a78ba395bf5a3200fdec4c6b
SHA512 ad5fd7ac71abc618a3a5be630a96c911c9bf13590a36a9e847ba8a5b7098397ecae3a44039d43a1f5e49fc0e85d6e86941e34deacea622c022f4ec9953f26e2a
SSDEEP 6144:8YIlZtkAVlYJ6X7ivkBDm7Rkm1tYpBeh2BAo8:8YIPGJ6X7BBy9oBGcAo8
TLSH
T1E83423136D78B8B295A9F25E294F1B2D2BF04D67CC248B93D594AF0463E6BCC160B670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download