f1b11db92f90a20bfea5355e28bfccf1fba0a74985d72a1e65aeb455f23a2114

Analysis

user interaction
yes
max time kernel
899s
max time network
888s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1.txt
Size 56B
Sample260828-197b6sen2t
SHA256 f1b11db92f90a20bfea5355e28bfccf1fba0a74985d72a1e65aeb455f23a2114
MD5 75f8c016b38499a79afb24db8314ecfb
SHA1 b29d50ab7628fe727fe2ec870add679c918edff6
SHA512 786d8297d883763db31b653e480da073a491799c56b7e6ad71e346500cfa998cab0a40af642505a309d659238409d801caa0451ab0d8345030ec1fa4a6d3fb0d
TLSH
T18F90025BC52B905D9B65418845052757F62BC418CA99D0F8F110804550122516055E15
MD5 SHA1 SHA512 TLSH

Score

5^/10

discovery ransomware

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	36	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a326b7235b92719e	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5440	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324293557730869"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2704	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
5516	chrome.exe
5516	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4832	OpenWith.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
5344	OpenWith.exe
4432	OpenWith.exe
5328	OpenWith.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4992	3928	chrome.exe	93
PID 4972 wrote to memory of 5632	4972	chrome.exe	95
PID 3928 wrote to memory of 5440	3928	chrome.exe	96
PID 3928 wrote to memory of 464	3928	chrome.exe	97
PID 3928 wrote to memory of 464	3928	chrome.exe	97
PID 3928 wrote to memory of 5740	3928	chrome.exe	98
PID 3928 wrote to memory of 5740	3928	chrome.exe	98
PID 3928 wrote to memory of 5244	3928	chrome.exe	100
PID 3928 wrote to memory of 3776	3928	chrome.exe	101
PID 3928 wrote to memory of 5244	3928	chrome.exe	100
PID 3928 wrote to memory of 3776	3928	chrome.exe	101
PID 3928 wrote to memory of 5976	3928	chrome.exe	102
PID 3928 wrote to memory of 5976	3928	chrome.exe	102
PID 3928 wrote to memory of 3044	3928	chrome.exe	103
PID 3928 wrote to memory of 3044	3928	chrome.exe	103
PID 3928 wrote to memory of 700	3928	chrome.exe	105
PID 3928 wrote to memory of 700	3928	chrome.exe	105
PID 3928 wrote to memory of 5200	3928	chrome.exe	106
PID 3928 wrote to memory of 5200	3928	chrome.exe	106
PID 3928 wrote to memory of 2460	3928	chrome.exe	107
PID 3928 wrote to memory of 2460	3928	chrome.exe	107
PID 3928 wrote to memory of 3772	3928	chrome.exe	108
PID 3928 wrote to memory of 3772	3928	chrome.exe	108
PID 3928 wrote to memory of 2988	3928	chrome.exe	109
PID 3928 wrote to memory of 5420	3928	chrome.exe	112
PID 3928 wrote to memory of 5420	3928	chrome.exe	112
PID 3928 wrote to memory of 3616	3928	chrome.exe	113
PID 3928 wrote to memory of 3616	3928	chrome.exe	113
PID 3928 wrote to memory of 5596	3928	chrome.exe	116
PID 3928 wrote to memory of 3484	3928	chrome.exe	117
PID 3928 wrote to memory of 3464	3928	chrome.exe	118
PID 3928 wrote to memory of 1896	3928	chrome.exe	119
PID 3928 wrote to memory of 2272	3928	chrome.exe	132
PID 3928 wrote to memory of 2272	3928	chrome.exe	132
PID 3928 wrote to memory of 2028	3928	chrome.exe	133
PID 3928 wrote to memory of 2028	3928	chrome.exe	133
PID 3928 wrote to memory of 5880	3928	chrome.exe	134
PID 3928 wrote to memory of 5880	3928	chrome.exe	134
PID 3928 wrote to memory of 4312	3928	chrome.exe	135
PID 3928 wrote to memory of 4312	3928	chrome.exe	135
PID 3928 wrote to memory of 416	3928	chrome.exe	136
PID 3928 wrote to memory of 416	3928	chrome.exe	136
PID 3928 wrote to memory of 5516	3928	chrome.exe	139
PID 3928 wrote to memory of 3048	3928	chrome.exe	140
PID 3928 wrote to memory of 3048	3928	chrome.exe	140

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\a1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb1fd2c728,0x7ffb1fd2c734,0x7ffb1fd2c740
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,15189527771358761924,10479072960529814037,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,11967533460434258932,5604735386101311902,262144 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,1386529665779198024,5314888159011693052,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,12139669278551073520,12531177316370805584,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,14110903691471097102,12302990625973804165,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,6736306240079233097,5266857092988538080,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,18376926910018801570,10514084274137537733,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4908,i,14058913380090390917,2040193920732749156,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4724,i,695738720691599312,9069069251426856870,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4756,i,13252547405717763060,2905428932193252212,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4736,i,13026598350805683937,3218253829109050841,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,7954068567565711891,2284615764969782635,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6400,i,4749319619956066328,7571042730452035380,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4996,i,1705717145577195177,1959006929138777448,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,346598375815797182,11059376034147820863,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,9029253110802159317,433190036301303328,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,1312388897067762621,14644303051346671710,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,4227388604784328773,464965832690165592,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=868,i,1002055710577289902,3213550515150262351,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6452,i,17833809175335685232,12484063953910379105,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7108,i,16157316458455345590,7658314844435844844,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4748,i,15832205457904964592,13153475921089508023,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4628,i,12437738978242513018,16034919727255325899,2097152 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4596,i,12982032101440660410,14863855148759666530,262144 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3136,i,14202921395828540379,7180438614927398797,524288 --field-trial-handle=1936,i,8492485362590409216,12646470503486609207,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb1fd2c728,0x7ffb1fd2c734,0x7ffb1fd2c740
  2⤵
  PID:5632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 5a8e6ff32f6bb6427cc0998fb314ff95032429cb54b3783865bbb1b06bf3a624
MD5 265e8a637128e13bedd26cb6ea29215a
SHA1 506e234cbc82bb4f90f406f0de318dd61285d40f
SHA512 bd40a74648a5cf88b68bad0eb66885aaf33cc08534b9d26f2fe7ee59d19dd0e4778b4ea0a1c80b6e6a5af14c3c6d0bdde483ecce38be9f60002d94f04ba83a6f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d3c8e48b8402118cb6924e1df6f5ff2d3cd23796dd2a5c48f77c6f3cda1b2557
MD5 26f0decbed1efe2d5bb5cc0a7cdbd353
SHA1 2dd939a0153474834f1118f0e6ecc83f3d4fd911
SHA512 2c4475c502843711d861c453347b93da85e088b16ac5331e161a1fd027e0a4dc0ad4f683a50e27e64f91ee74789015f762712a0d9965edb034ffddacce17547f
TLSH
T1C5E02BAAC972EC3709FD071E90500745E65423973A41444F3A3C85194FB563F464685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 41KB
SHA256 f2ab78a264d08f1214ca3dadb6604dba724b181e3d4e722df522b9c719c952ef
MD5 5dca6f0efd8057f61027c93f6c5f4a28
SHA1 2d52fc6ef5f0072811c8b2ed4b9a5db41da57ad2
SHA512 aefa252d6fd60c376d3c99796def8eec810d118aa28e7949f444db2f89ca752fc0cc7d18ac46bb5cc5f9843dcf0c6384caf82d6ce2aebfd14456ad352b97fd58
SSDEEP 768:uiPeGCTU2LKdTjK1rl0Ync9I3PHw1ALw+wytdFDC2AHkBmzg04Q29G5DTYt:XUQS1rl0YncC3PHGA8ODDCxHkM+9G5S
TLSH
T1F513F18877DEF0114CBB98D870BF79634F645F938829EE7215EB24C98024B8E6872D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 21KB
SHA256 2634df0d79333ea639d7079f566163bb700a57783d3a8f09061c6b11a8a78bcb
MD5 16fee8edf1a69e98d81813f19fffa56e
SHA1 9aada423702d320e5dd580c831a3de3da06129c1
SHA512 0ed3ea486c66383aa308222a5552b5837ec0527e9716d837d5f5cfade007790d7f0e7f622ba41c535cfea7f510d85675da400d84863e60577af238e918913714
SSDEEP 384:80VKnq7QTS0TNdGqzD1+x9FpWtSdJrZJSk49KqdIaKLIfMuMJdPPYp:Kq7ATNYqn1+nWtS3VJmKqdKAMJdPPYp
TLSH
T1BDA2E128696925E7C4FC8E8852D6602A2D415C39E8F3AF9FFD40977C0743B284C1B2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 22KB
SHA256 40c97e11264cb1ac171847f410e85599e7ba7647e6dfe8d9d7f2c4b26d6ebb8f
MD5 6a9512d6b7d560ec8d28637f1f0ec189
SHA1 b0eb2fc3cc520974f84c177ebba34cd683646878
SHA512 a541189a3eb0ce250f32a5f01c92c100233922b9fe853e936c60b75e97c010929840aca21b204fe7ae3b4cadf380ab4f2134e9554328ba7ef7e105879546aeab
SSDEEP 384:H5OXeQD+vKTt/Ph2RWJFm8D8uX/ZfR7uCqCvoo99QKcvdnjaIfiHdLCU5SClv9L:H5cD+2tHhvJjIwBJaCqYrkhjfiH/5XlJ
TLSH
T120A2E1437C6FDE68803B92753156C173E412B239119633A3E303B76A95B850DFA59ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 77KB
SHA256 c2a3045a3318b41542c717d5df64ab0e06d422a4e3115eab85fde9a693ad7829
MD5 1b539299538d0dd8721e627908117e05
SHA1 aa6bc8faa84fd8ccd6cb7b144cc18b800cef2745
SHA512 83402048b1beb27601fc5790d5f3f073c4c816826da147ecb54b52fc5f0f4b4cbb2a15500016dd7e136fc85cc8779cc66e44420235e41eb47d5ec399c64b1a86
SSDEEP 1536:NP2s5OqoTWINBvmd7pQnZLD+H8zvKKns1J0mLuexFsYShgargQ5BBkCCt:N95ObiI/+d72UH8LK+cVLukFugQ5BBkF
TLSH
T1A073028024614D6B74EFB9892E8CADE1E28FD8314DC1D96509DD5A391FFD0A7CDA88F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 161096ed5feb5cb977d8ef9e616bf51bfeeaaeeb11ffa1ddcc20706ae5da880a
MD5 52dedafc6ecc41fc876be4129f255f4a
SHA1 23a0184adf5185b3545a2da90d9be153ba5f5ba2
SHA512 aae6e1921d1ec8e92eb0d5e2c7979b2f58a0e50bb3fa9ae32c2726ba227847cbb3681ebde9c9a8e84a8f860e7a5d37d9e94b1f7cf90541ca8a51fde7fbf0334b
TLSH
T1DE01215EAEF55951DB00B67CCC675C812B72C05437C71BAA424E58397457B7151C3463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a6864ea377246b2210d4dbeb3ef47909e3eaea63e6e28ed3218a789f327fd2ff
MD5 8317d1eabca1a58b7920e6da2b9afd51
SHA1 d846ecf2d4aaea73de270a2aa1833e092ebec44b
SHA512 5476caa6bbf5c8d40b297b5cb9639c54471316baab15747a6b83d44e643b0d894124a39f392c1c2e77c84a4eb31c926cbb99eadc057d0b6e94641fc1ee2395c8
TLSH
T11721C84E9EF56961DF00BEF9CCAA18442E72C48A27823F6A714D4939B09B7712083463
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d4a7a7085413682fda2ae113b4f1580886f125d854b95b2952296bd93ca24193
MD5 03c63460685efe8e90d8dfe9688ad39b
SHA1 85658421a5efdfc653b893756665a7fb1a425361
SHA512 c6366b1d4f0f91eddc08696257c9064f0e366c7ea8ba53dba81d57aeca34f4b7e7cbf5fa11388926053ab9aa08d7bb7bd07fe6f1e513152ed05ce49977797204
SSDEEP 96:DQcG/cTc6c3baaNI1/hScBcncAcRceHcvbc4cH:DQ//YfObaaNI1/hSW6L6zHibR6
TLSH
T1EDB1AFF7C3D8CA6D896156F1E6203E1BCE6D0A18421C3C66C9E5FE5F53E2472E24168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 d420ace3ebb06e5745caa2b8e60f3e878e910180f090f391d3930572dff67d61
MD5 0045728b282556c05d1476e93ece809b
SHA1 6217b4388c957f89438500dea66a0e8081f729fa
SHA512 d99d0d2255d6ea722b38579449da914cfa2d8ddc4b87bf63f2adbbd1c1720a1de1ea9114707958620719bfec22b81898f5ac5173143bd60a04fa7e39ee8fcc2e
SSDEEP 192:DQ//YfOnT+intJxJibRaadjW6L6pibRYBOR4mMfqimaPQvtfPNNPhDjhSnTwC:DQ//YfOnT+intJxJibRaadjW6L6pibRI
TLSH
T184229EF7C3D8C56D886156F5E7256F1BCE290A28422C3C66C8D5FE4F93E2472E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9708239faea7143a885a1a879961fb5a824311f22d7b344d15554458fd26deb9
MD5 c021429abebcf67d52c90f2b8f638968
SHA1 0a89dc99711d7f6355274b443ce0a32d142070ff
SHA512 25c06858fd73a7e182996ac1255deb39669b29e379855c5ff7f882f7d23188f773c867335dbaaede9aca3dd22bf644b3b5085ee0e1e588d983e8917af95bf60e
SSDEEP 192:Dht1ME8wkitxJJxJibRaadjg6N6piuFYEdR4SZfUimaPQvqfPNNPiDjhHwgB0K:Dht1ME8wkitxJJxJibRaadjg6N6piuFA
TLSH
T13C12ACF7C3E4C66D891156F4EB156F1FCE290628432C3C66C9D4AE1B93E2472E25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 afe008d44452c987bf9b56b61aecad80ea335212625bf08edc30d32bd9eafcc7
MD5 68969f104c3c9f9a638a1c1bca8d3040
SHA1 ee4a46237d2e324214eae60b231a92cfa9880afd
SHA512 cadaee3a48f0260d35116ed42c7ffad3346c5a44c395a2f011ef81a56eeeaa69edb485bf24aeabab8f483bd5505487956713ac0e9a67b58b02cf11c4188c9c4d
SSDEEP 192:Dht1ME8kitxJJ5JlES4Yaadjg6N6piuFYEdR4SZfUimaPQvqfPiNPiDjhnwPyEK:Dht1ME8kitxJJ5JlES4Yaadjg6N6piuD
TLSH
T1A102CCF783E4C66D892156F4EB15AF1FCE290628031C3C7689D4BE1B93E2472E25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 90484976ca9722c5d0447715693323b9ca05f96997565276a3dc3a59cb60f23e
MD5 36c88a54ce91ddbe4220f7b91a17bf87
SHA1 c808db9829ef4e7797d61f2e0ef6d3be136b439c
SHA512 996c0347a8aee70a160951517aecac052aa7efefc1ed9311ece1ccca66c685d6e69abe103e830b51f7630663b6a7a5fb9eb7782f8000768ef165b1a26caea0e5
SSDEEP 192:DQ//YfOnT+intJxRaadjW6L6pibRYBHaHY8F4mMfqimaPQvtfPNNPhDjhq:DQ//YfOnT+intJxRaadjW6L6pibRYBHP
TLSH
T18E22ACF7C3D8C56D886156F4E7212F1BCE290A28422C3C26C8D5FE5F93E2472E25168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 89a9d2ca64761499a7072c1f2e2cd4b6c404d661299e857003138d79f7716ce0
MD5 5694b83e2dc7454ecb6c3f4395c95dd0
SHA1 f7794e08fed78b616a4a69731721d2db7c63f7fb
SHA512 7aba9f1d678a2ca6bcfdb0cf4adcae5c5d4b4a7e1aaac5ace8b74da33d076497a06bcf20e0c7300da4c68e376f1c9ca30a8d4c218bebe07df6d7f8eac38358f4
SSDEEP 192:Dht1ME8wkitxJJ5JlESEaadjg6N6piuFYEdR4SZfUimaPQvqfPiNPiDjhnwPLWv:Dht1ME8wkitxJJ5JlESEaadjg6N6piuL
TLSH
T12702CDF783E4C66D892156F4EB15AF1FCE290624431C3C7689D4BE1B93E2472E25178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 853B
SHA256 d1bc70f9eacc6e291e6c105b73222fc9c975443e77fbe0a92d814c1f1eee8d3a
MD5 2872f4bd3298f89c631a97a8b3c65f97
SHA1 1d44656c99916ac22ba975b6c20938ffeead065f
SHA512 f766184c2f508f7b2d858332b3bd60573d04a782cfd8c3709d3e235b1ed95e3d26093627bbd0242241b08e5d1560bc61a4eff0a729bbd490a2273e6e75f479bc
TLSH
T16E01ABE3D6BFB42730B988FB1E44BC04147BA036015158E4DE67823CB0A65F32B16423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 17c9c898930f06313a703e8f1f9ef76418f44c71f3ab2fbe304d2e9d7c755dec
MD5 db7434c6d88f370b0004d4c6ebcf0fed
SHA1 21a0869c35f1576803a6d892de59e0a40c5ab0f2
SHA512 fea31d10997e5d390fca5cc8830ba7b76c5e9b4f8469ea0ba366fbe28c30350614da5780852fb53391d82ebc981f0f095b476a32d4cdbcd5950d821d422faf2e
SSDEEP 192:aRlcBzhsPH2BjFnv71hVoPRparg/ps7j92Hsb+WNnQGEip+AO2HLe88WkaM7VyI6:aRlmzhYsFvBhQX+nQwdnE2Izawe
TLSH
T17F52E63EE81069776DDBD25AFE167B13D7F1102221A51E84E7FC892C05E79CC622B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cc3fd3212038c8eb3dbcbf5286c50b6a0bff04c1ec6154a0b265c961aef8612a
MD5 d81f9c9394e29dae7f6c8760b03964be
SHA1 feb56f8f3da1ed1b3a7412c5849b768886d55af5
SHA512 4df263fb46e5795de02e8534a5dab56054e91f49139fd59d8270abc2322c421eb6a8f0a544cec08aef0cfd32e010d3b8e9f4d95610f40a29b804832f4ed7ebd4
SSDEEP 192:aRUcBzhtPH2BjEnv71hVoPRparg/ps7a+S92Hsb+WNnQGEip+AOThn22Le88Wka5:aRUmzhJsEvBhQX+5SQwdnEV2Bzawe
TLSH
T1AA62E67BE82069775DDBD25BFA267B17D3F1106221A11E84E7FC892C05D79CC622B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 86dd0d08de4e795f66920068dfe7d88b9a4952e0fdaee47c9683ddb33e4ff566
MD5 22c87c198a343dcb013ebb9bfdee7387
SHA1 da972d08f82ead027c77b399e5bc7592dfe5908f
SHA512 61bbf4b72bafd91a27ca877feb33c55557a4006c654eb58694d34851099f56088a273464b17a4359af1b6d9333cb3d2e7e97268aef8471bdb8168a8bc5af47fb
SSDEEP 192:IR5xsPH2BUnv71hhAPRp2rgps92Hsb+WNnQffip2oLe88WkaMuVyIsnAUgtaJ:IR5xYxvBh8XmQw4c2jzaZ8
TLSH
T10352E63EA92069776DD7D25BFE267713D7F1106621A52E80EBFC892C05D79CC212B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dc2094c3c524019b9ee28d24cab30266f5aab415cd8f349143bec73ddb35f290
MD5 40efaf78086764944c6334a01f761ea0
SHA1 2b5764b9a8c3e53b051e0a36e3c8c46ce512631f
SHA512 d5d9c8186f43c55d348f6ead6642f248bb309516a6c293e39070cf87376bb015756589bc4906d89eec966584b0c7bbd12fbfb1ad3966aee18b186524a3a06af3
SSDEEP 192:aRUcBzhsPH2BjEnv71hVoPRparg/ps7ad92Hsb+WNnQGEip+AOThn22Le88WkaMg:aRUmzhYsEvBhQX+GQwdnEV2Bzawe
TLSH
T16C62E67AE8206A775DDBD25BFA267717D3F1106225A11E84E7FC892C01D79CC622B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5395641ca1f3c58c05e61d53a97cff6ebe0be54566f00e370a69e2f7859d3c2b
MD5 998f60efd6f06c9a8fc67b6edc0fc192
SHA1 5cbf6c9815b8642ff187e06275696ec7ea6a63f8
SHA512 2080b298f924c5ae113bdb2aa59ee488541ef4641ef70bb3cf80b8c4b25d24e60c2dc76be716735b5e41fa780a2a205de5a96a9bbcaec6b56956b1487ee54b4b
SSDEEP 192:IR5hsPH2BUnv71hhAPRp2rgpv92Hsb+WNnQffip2ZLe88WkaMdVyIsnAUgraJ:IR5hYxvBh8XJQw4c26zake
TLSH
T14152E63EA910697B6DD7D25AFE267B13D7F1106221D52E80E7FC892C05D79CC222B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d249d3de419cead09a5719e1e507bc27c153208528f54581c6ce98de493678b8
MD5 0fe657467387abaa060f4d97bfce943a
SHA1 9d19682dacf380304571e1d0d2afd1107a7b3bdc
SHA512 3dff56260d751b61518f9867562f484c80113eb2dd27d14803a82dba9ee51e9cb3f1f89c92f642028dcf8aeb99c10ae76c0e98e5e3c9ae9d03bf8042033a1037
TLSH
T195B0129084019505C01306F4328318A871949F10960A170183E4A93288261508114050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a256.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a256.TMP
Size 96B
SHA256 795d4e0cfd91693cfea1a0e53490d16ef5e9f644876986d86ed668325f18180a
MD5 ef0cda8a5723bef584b6adb0c791f2aa
SHA1 4371b24a0bcf677d52a53380716f709d2b048b8f
SHA512 2efa533380cf8e6945907a12bcee186629e842c13324cc3129295f8ffe8483a7e657582c6a94c8a2cb8ace40e9e52f300d41bb2d5ce8fb0102c7ecc1eba66a09
TLSH
T119B02200C2022222C00B0BF028E0A8CA3220CF28C3030203C2F00AA2CC283300C30030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 20c4af4f3987f9ae455de41314f119b405412da3c2d92dbd3bb8d0e33df5e893
MD5 6b8b8406ec5619a66cf7dcbeddce173a
SHA1 02fcc172f98d2c4f7d84536b6d0c2b20a0d751ec
SHA512 720b433490925a084c82c9c3b070d3d6380a508f374856625fb47f919e5561cb55417ef7c4ed7e3866fad3e7ac1829cd4b043a8d8385cac797c88553b252a03b
TLSH
T169B011A800820822EA2803B2CAC280882AA0AC202A838882A0E88280C020A80A28200A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 e37a81de4d25e70e6f8035c95f0c456b3b10f67b456516b9d120c71cb6210e7a
MD5 fc66478159091132def0d449927d2d6b
SHA1 50d2a53559e15b2abec46af8e42dee46a6f32b0c
SHA512 49a5f51eca9fa10792795c6e49938f3ea911067cef599e7c06dc93a46e3e22fa225b35acbdceccffa5d83fd4945adfdcfff0e427a57a0d5f4afc20613168ff16
SSDEEP 6144:fy/+cTuToAlKMQSGw6UwkKm7Rkm1tYpBeh2BAo7:T4uTogK7Sn6UwkF9oBGcAo7
TLSH
T14234122B5D77FD360D7AB769F00F3B091CF04B4ACA04D9FA94947F086AE26990909A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 282KB
SHA256 3d63e1ab2f4f4e8beae9c23cf744df6591ef04e0b9b514488daf8294a6f1cd20
MD5 02b6b1ffe65cb182252155cac8179c1b
SHA1 b1195beb68ed13c96135e9bcf44e4b7de050a0a1
SHA512 e31a89d6ce5adb17185537d24bd3fbd16c02841e54f010c19b84f745c6f05e5cc4f25afa128a8ceca738dc17ba27a7b81be2336ad58f33239a2dad019d8fced7
SSDEEP 6144:28FaVG/+cTuToAlKMQSGw6UwkKm7Rkm1tYpBeh2BAo7:20a14uTogK7Sn6UwkF9oBGcAo7
TLSH
T1CE54232B9C77BC295D79BB69F11F3B182DF40A06CA00DAFB90A17B043BE6594080D979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 8d24a7fc48073edbc8330404d2b237c85e53c9463306bb6d34ddd3b16882f13b
MD5 d8d7e7195d5fef64794d20de6245a097
SHA1 8700bf29c20d28a086ae796df9dded1734d4d7de
SHA512 e059a5f256238023f8d965f24d304b7294ff292ed7f5a394d51fa66f29df075c753b9912d00887ec1a0c95cb444b78a82b1850603c8c841132bc227b2e496df0
SSDEEP 6144:vy/+cTuToAlKMQSGw6UwkKm7Rkm1tYpBeh2BAo7:D4uTogK7Sn6UwkF9oBGcAo7
TLSH
T1FC34122B5D77FD361C7AB769F00F3B091CF04B4ACE04D9FA94947F086AE26990909A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 c9ebc4524f3fc75dbd52256ebf1fe9735f9c588bf4b3b7f6b42685652ae62844
MD5 abca384343f333847f1f5952400cc9b5
SHA1 e9db17a73a5ab67806003b550a71776b60162675
SHA512 f393c800b6a004fa668d9a304627874d768c2f8607d3eb1fbbdb3d86ef95775520ae4cc73dc130c4e525578fa2ebf947c97b6d1f737461eaaab861e476ecb498
SSDEEP 6144:Q/+cTuToAlKMQSGw6UwkKm7Rkm1tYpBeh2BAo7:l4uTogK7Sn6UwkF9oBGcAo7
TLSH
T16234221B5E77FD361C7AB766F00F2B0928B04A4AC900DAF685907F086AE1BDD050DA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 864e54711cc702771fa44544257f89c32b58e9b3018b437abb70d651fb90a52d
MD5 88c6279c5e27af6e97500595be21d4ad
SHA1 409bb848373596852930e7ce2e5b74ec5d11ed71
SHA512 342ea3ec21dad52d5d71e46c0df261bfe39059e7e1fe3a2bf4f8f7356296fd37a0e1da13c21ee068214b5ef9c1704fd35f0eb7a65c19bf9f8f6ac4cc90bf0b49
SSDEEP 6144:x/+cTuToAlKMQSGw6UwkKm7Rkm1tYpBeh2BAo7:U4uTogK7Sn6UwkF9oBGcAo7
TLSH
T1BA34221B5E77FD361C7AB766F00F2B0928F04A4AC904DAF685907F086AE1BDD050DA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6abea335c1308dc719ef080c333a2dc32ce0c39c43126311f061d14fa3921e62
MD5 99b58061d740914d22d895b6ed53bba0
SHA1 6e2b6447b77071eba6883342fdd9043f96d1fee2
SHA512 ad69659c06a3c0190ff26a612e1884c852139b84856954b370a41cf5960b0e7881c2623b24ff22524e4aac50ac539500e4d06e7af65a9e424aa033519cfd0a68
SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:9m7Rkm1tYpBeh2BAo3
TLSH
T146C312275E71E9375D79BB4EB08E0B1F1EF14AA6C930DE92C8D85A0437EA7CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download