4baf84feedf26ac5d28c3d0ad17d1b8dd46d2301adbb898bcb6b0c8ad8cb4d12

Analysis

user interaction
yes
max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Spoofer.exe
Size 375KB
Sample260830-3pd61abl5v
SHA256 4baf84feedf26ac5d28c3d0ad17d1b8dd46d2301adbb898bcb6b0c8ad8cb4d12
MD5 ef3a2694be75f8da903ec11ca6bbadf5
SHA1 38b5e0581787bdf3032faa30c133f7567bfa52e0
SHA512 92825d3bc2558c8350f9f04a4377f99eb2156f7281854a07ee2fdd0a10f12ed48c8216770da794dac1f95d9dc16c43e88e2f81e23b18a2bc05e10509fe9a1838
SSDEEP 6144:CtlTlMFHwgkbBUMQ00sp48oO6nNrLKl6v/Cp:CtBlMFHwgeBdD04F5qNrLX
TLSH
T137844B16EBE409BCF1B7C675C9E18941E7327C4E07B1AADF179088A74E326909E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3528	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2032	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	Spoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326068793366816"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{CB072603-6806-4D9F-AC82-8E8041D32248}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5716	LogonUI.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1100	3932	chrome.exe	92
PID 3932 wrote to memory of 4824	3932	chrome.exe	95
PID 3932 wrote to memory of 4824	3932	chrome.exe	95
PID 3932 wrote to memory of 2032	3932	chrome.exe	96
PID 3932 wrote to memory of 1956	3932	chrome.exe	97
PID 3932 wrote to memory of 1956	3932	chrome.exe	97
PID 3932 wrote to memory of 1664	3932	chrome.exe	99
PID 3932 wrote to memory of 556	3932	chrome.exe	100
PID 3932 wrote to memory of 1664	3932	chrome.exe	99
PID 3932 wrote to memory of 556	3932	chrome.exe	100
PID 3932 wrote to memory of 4280	3932	chrome.exe	101
PID 3932 wrote to memory of 4280	3932	chrome.exe	101
PID 3932 wrote to memory of 3160	3932	chrome.exe	102
PID 3932 wrote to memory of 3160	3932	chrome.exe	102
PID 3932 wrote to memory of 4320	3932	chrome.exe	103
PID 3932 wrote to memory of 4320	3932	chrome.exe	103
PID 3932 wrote to memory of 4960	3932	chrome.exe	104
PID 3932 wrote to memory of 4960	3932	chrome.exe	104
PID 3932 wrote to memory of 4688	3932	chrome.exe	107
PID 3932 wrote to memory of 3716	3932	chrome.exe	111
PID 3932 wrote to memory of 3716	3932	chrome.exe	111
PID 3932 wrote to memory of 4832	3932	chrome.exe	112
PID 3932 wrote to memory of 1648	3932	chrome.exe	113
PID 3932 wrote to memory of 1648	3932	chrome.exe	113
PID 3932 wrote to memory of 332	3932	chrome.exe	114
PID 3932 wrote to memory of 332	3932	chrome.exe	114
PID 3932 wrote to memory of 1708	3932	chrome.exe	120
PID 3932 wrote to memory of 2220	3932	chrome.exe	121
PID 3932 wrote to memory of 2772	3932	chrome.exe	122
PID 3932 wrote to memory of 5032	3932	chrome.exe	123
PID 3932 wrote to memory of 5032	3932	chrome.exe	123
PID 3932 wrote to memory of 3376	3932	chrome.exe	124
PID 3932 wrote to memory of 3376	3932	chrome.exe	124
PID 3932 wrote to memory of 4504	3932	chrome.exe	125
PID 3932 wrote to memory of 4504	3932	chrome.exe	125
PID 3932 wrote to memory of 3424	3932	chrome.exe	128
PID 3932 wrote to memory of 3424	3932	chrome.exe	128
PID 3932 wrote to memory of 4248	3932	chrome.exe	129
PID 3932 wrote to memory of 4248	3932	chrome.exe	129
PID 3932 wrote to memory of 5496	3932	chrome.exe	130
PID 3528 wrote to memory of 3468	3528	cmd.exe	140

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Enumerates system info in registry
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffec8f9c728,0x7ffec8f9c734,0x7ffec8f9c740
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,4045409095529532814,4479569031554207533,262144 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,682298634864503317,13930434754854310904,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,11351828431801576082,6053529081505572395,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,17363325854109502174,17092540073381378205,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,6421135297554248081,15265970904956804143,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,13710197420537853095,11080117113366042355,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,16002130380760102996,7938136721461714058,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,1947781523941258747,17619823976347533370,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,1810321844904120866,7901023198503483955,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,12475886423970376595,11558684916141241303,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5784,i,2969530489306549854,13205829590321435031,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,8699408354714789093,14413751112730948064,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,18260348121734515045,2714542743660936458,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5916,i,4105225020222361548,11479483789659396987,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,12438666264609937528,13732649786289558769,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,2295697100917146729,14105390156562812755,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,3859742424785853086,1789581822763352817,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6016,i,3182742830241513681,12939549074914635028,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5832,i,11486376061895264552,16847539621858953958,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4512,i,3301763248418997618,16283702449329110797,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5948,i,5326308004417789096,2620935802464052824,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6084,i,4535793231506270149,12752125217501510163,2097152 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7016,i,6073442791068087942,11888033139588152216,524288 --field-trial-handle=2016,i,5151450541733331805,16318416753623905940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:5496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Valorant Bedava Hile İndir\Hile\Settings.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\system32\shutdown.exe
  shutdown -s -t 10 -c "Bilgisayar─▒n─▒z vir├╝s taraf─▒ndan 10 saniye i├ºinde kapat─▒lacak"
  2⤵
  PID:3468

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3921055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f0c73d01cba2487aca12542213429fb9612deaa977ed9c8c235df3020d8c5064
MD5 efa5de988296fba51be0942c2ab3660c
SHA1 22e77faba1513711667499920f01f116d4525f6e
SHA512 112d306b72632ce7a1f38cfc2a97041dfbb296b9d7d28c89451c5b12f294c3988a73cbda3aa5e6b9674c6a5a63df11d6621e20cf63e2a99bf8a9c434fff4436f
TLSH
T194E02B65D961EC2718F91B28B0501742E758236B3A40894B7E3DC00D8FB163B4686D2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 21KB
SHA256 0035839f97544723c93fdc2a16786821bccbe601d1009453acb3742d59b5e60f
MD5 8f15f59cf80ea13e8b585a05e66a6435
SHA1 16fe03500f9595aded49c3b2f649c811f29622c0
SHA512 cba3f9c335b03a1a76a3ad0a189a493a0420245d8d711d4f6fc21ea2ab00983f13ae597dd1942d04188861f05e9cec0a25d5c139c9536aef312912bf067c93f1
SSDEEP 384:/DuGGYyI/z/OXV17UPmt1SSdto+laUW6YrouZynsHgq3ba61M1Djk:/DRGYTqD7Smtjdto+laJXrou4nfsQ1DA
TLSH
T1A2A2E1F003DE9F6342365F1B71A359BB2F697C06DE0C8F51868932D8F4AA18A8F04395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 17KB
SHA256 360ddaae6c352d62c72a4fa83f25cf2eddf60a460dbc6526e92b3fbfedfdae6c
MD5 b817eb7df83875a7d103d91add484f68
SHA1 21830e75571996d307b2dc6a174a5cdb6d65c2b2
SHA512 0f5d7e3b596172c5176eebbbe97d98f16a4d4e7117b1fab28d92b44642dd4e8be3bfc5b9ba85214c22ed7c1fbbfd2579a68c69f8645cfb96ee86b447883c4150
SSDEEP 384:54dUDoLOJGTOnXWDTkeFQaHqs5tVKJ7N+XRkA3I+bQgY0jnV:54dSoLrynIFs8VK7+yMIe9nV
TLSH
T11282D098719B2A021308D7470685E3C57C56C02D6BFFA289DD79ADBFEED84E2314DE02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94b8e9d2e1d4c98a_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\94b8e9d2e1d4c98a_0
Size 3KB
SHA256 313b0dbd4b940a596f9c3403e0710ab0f3b046b12198f92d52c0c8f6104e05f5
MD5 3728ff350284b562b0fbd5a307f6ce1f
SHA1 361b4a702197b39e65fc3bc547e89bf3464eabd1
SHA512 6aa1297a54e619004e518a940583c80ff27bbae660437844fe7ee8bb5c3a7002102a6618b270f7839f13952c686876e6e6825bd968b4abc9a08b5b3c586eb2fd
TLSH
T14F71759D96408A2ACB3243FD1693895A333A80147FD7D33324E59BB91C443F77A69D4E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b8f9b95a03ed06edb531ff16de255705ba99ca0d5ac5407e87154dfb038b3f6c
MD5 5f13ab4011870999ac2468ed9df1515d
SHA1 a2b3851540b28bd3865e7aa92266015fb28ec40e
SHA512 57d7908153bc700d5d5aac360761db79dcc4dabcd15a3f74ae29d723e9f41e69581d9ddda8785639741342f74a2a6b731fb813118b59907ba73e12460dbf7827
TLSH
T16651FE0E02D47D75DB2CD7FEA7DA098E94364D08054A4FCBA66C8EBC90C277CDC21648
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 22c4df51af18230614778a55c401db7eff7959973fdf1b8b327f6a8b12424ede
MD5 f115ac3b07f0178d40fa09e94ea2d7b2
SHA1 cae342edfa269fff13057d624a82d14bac24cdad
SHA512 15c8e639c38226e9349ee9e946907f40f135643ce1e71d85c262c9a9f4634d6293904612c714fbfd2b374bce75286da3a2eaf8a2e2ec2dc41bc1b38559a6c0f8
SSDEEP 384:DESE5YjrBBoeJMyJBrJsampIxHYDtjkN38JVaICpq75xaM9I+xhcqMfhNql7Vs9u:R/yE/Tzjbca6M+
TLSH
T1DB62ADF7C3F8C66DC81152F4AB256E1FDD190A15422C3D1AC8E9AE4BD3F1871E251A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0dfa002ffe37d188daadc28d316153b491a9af3f26c63d2ea27130fdfc075d75
MD5 988fb460e56389e26bb298a0d7cd53e7
SHA1 643b43336f7a5d85d8480b959b47a032d845a519
SHA512 67bce7f36da52cae6baebc1abeeff1e6f34b882776832bf9fae8bfc1f88558ca0585a88f6f71de454ad30cf3814fd0de0f736376cf80f56840f923a41eb66763
SSDEEP 384:xARvHSmhGuBsmoDrPmjC0PTXY8wlWLLYnO2dvacie:7mhvEys8wjO2Uo
TLSH
T1FA52C83ABE502A7B6DDEC229F9517717D3F6212125912E44EBFC8A1C15E75CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b3376115f1d116704104f93cc6d425cc9936901007da41305a86cc2c83e07919
MD5 1e23f7458d763e69a5a1310bd77d9fbf
SHA1 9794d5e08fd16dd178024992638deb608e7a4aa6
SHA512 92d4c20a7ad98a57fafed12ae9eec153fc63d4fa4de3445897c90c5e99a9f649582012251242b95f71e86f4c83f810d8d22a44497beff8f43f7e3d37104d1303
SSDEEP 384:xARvHTmzGuxsmoDrPmjC0P8X58wvWLn2iO2dvabi8:QmzTEya8wvn2UN
TLSH
T18652D73EBE507A3B6DDAC229F9617717D3F6112120952E84EAFC8A1C15E75CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cd72c88b7722ff4937ee06afaa0a30bcd80f258ed50b081de296d9aff68545a7
MD5 e800b8ff4d15cf5cb2b955787558f9cd
SHA1 4a7c845490cbf499a8e32f232426e463efe1f33e
SHA512 655b7763b607c7ee883591242a295ac1c76d88043ec1ed6f01b269b8f76df6f02f794d7e3952155890a799e77bb8c7a80633888ff926174d9b57ee93181c8845
SSDEEP 384:xARvHTmhGuxsmoDrPmjC0P8XZ8wvWL7ecO2dvauie:QmhTEym8wPV2Uy
TLSH
T1BC52D73EBE503A7B6DDAC219F9617717D3F6102124912E84EAFC8A2C15E75CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c3c0f1011cd69bdf70bbc98ea909974e16ad6dd7375dfab9a4039b41bdf50b78
MD5 7072ee61dc0cd30f1b36323f22c4c3bd
SHA1 55bb78d4ae27176816703d168519f9fc9f6993ec
SHA512 4d1d368e5e5665dcd9256a512c7bc3d15c9b075878ddc8cdd209873f09df795f6ba48c99e6ecf184679b47e976021994fa6eccd1ce05d58330e058e3be6ce419
SSDEEP 384:xARvHTmzGuxsmoDrPmjC0g8X58wvWLn2iO2dvabi8:QmzTEla8wvn2UN
TLSH
T12252D73EBE506A3B6DDAC229F9617717D7F6102120952E84EBFC8A1C15E75CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 59c3965784bf8f7834c30acacfc582a917de61eb363fc2cbe635be9366a3a2fb
MD5 2d4d6e9ee6ca76eac7582036acf7a3b1
SHA1 4238aea3ed42cd0d9c8bcca8dd5b89024e263713
SHA512 64ea4059158146662dc13c54eb716cab71bd3e6010f06d1227ad5d9e02b436d177bcdaf57f3ffdbbe83f1fc4420e82a11235a927dd2e92d2e2b172239aee3ddf
TLSH
T1E6B0128080019A01C40303F8118655887124DF149A0A170143E4797B98351509418162
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5880c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880c4.TMP
Size 96B
SHA256 a5be5c709839976f4408178b948a2a0479028bba994436367b290e247f4db36b
MD5 f97b519224ae924d22be54a1a03d6807
SHA1 2de50be59cfb932101fd124da12556a84a65b9dc
SHA512 284110139219410003546fdcef6b3da66b9d6b5f2e36a3a94c2e0dd884acd6269cd425d1784acc9123aa0fd091cf49fd10f5c1ccea7bea8cce90193535e64ec3
TLSH
T1F5B022EAC002A302C00303F03E8088E83030FF20C203022AC3F00E23CC222E20A20020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ed273b868edca99f6dec0fe2bc4c5d9290a0ce034e99fc56d4559e9ad27e5d90
MD5 99abfbb253273d9f2197b10122069de9
SHA1 009a2a2225f1a192607a4be2c9cc103ea2108b33
SHA512 7675f63806b247e3ff6a9855ee8abb11ccc4165d5e0cbe284786237c34fb038f46f7ca7fd242f1de318de1a37b4168a438bc3255aec921144257e1ed7741a5a6
TLSH
T16CA0029507459666C49483B2E3C206E4A3A0AA6423431B01E190055A98B664E761B734
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 35ed192859120487675b8c69b21d3c66c92511743abab8f2ba2e35861bb19bbb
MD5 678fb79cccf74c1dfeac0a52bde12062
SHA1 00dea47aeb1acbd02547663205388a16c3c3608f
SHA512 9ebda36c47bebbb483a57b112d7a574602569f958e3fab00def87d55b9d9f48897f73def9d523965b312156f634b7c121760ef3a19d86a0aed77dc1ad9a83ba1
SSDEEP 3072:bqtMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgAqfd7NtZL8cHQRZEQ6Spsj:bP0mAIpUNVS6AqZ/ZLW3Exj
TLSH
T1C5341237EED31E372B879FE0B9421FB525B644E6D424830899A57A9B7CC76513803CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 35d3f99167b13652d36276bc7e6914690fd68ed8b81f8d4175fe0924c3ccb6fc
MD5 e6e74cd81f4c316fa144f430c587f809
SHA1 5c28bcdc00453af85bdb722d9a88cb6340edafb1
SHA512 dc1ad8ba87f7b57b9ad5be3cdef5390ec1c2c5e5e4ed62a0344099dce99d8b5e7c8be28657ab918469078f5cd86147f08944767e239b1df7bbd00b79ece3599d
SSDEEP 3072:3U9tMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgAqfd7NtZL8cHQRZEQ6Spsj:l0mAIpUNVS6AqZ/ZLW3Exj
TLSH
T1A9341237EED31E3B2BC79BA0B9421FB9617244E5D02483049AA57ADB7DC76553803CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1fc0465d1bbe8566299fc400e93e14e51dd374288bdeea60d49a46ef3b2ec6c6
MD5 e31bcc9c1ac5609b9dc749347883f21f
SHA1 0d405b9238547779c8c68361f32f41bd14f94d4c
SHA512 9d9f53229d77d6817f192c101673685f293739b70b2cb50a16abe3dbf10638d029101a014bd62cf161e2c8223d67b86b5a5480d8ea85695fc5b68713221f3035
SSDEEP 1536:bRLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:7qfd7NtZL8cHQRZEQ6Sps3
TLSH
T1EEC30237ABC21F379E92CF64B9130FD6A7B644A99030D301AAAD37FB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 c0912d5834e813252e0bc1d1f1674fa5863f2b09cc1cc9c8aa8282bd04606ae9
MD5 ce8d76b2499350077fd38aa8f8d96140
SHA1 28e535592b2c721734499f053097057431dca35b
SHA512 abfca8dd162c07f2704778d1408b7771395a8507e3b6a9345085ce403f7b33929d206d4117de42830495854750d66ee8ffae771486068e75759c854191cd856f
SSDEEP 3072:WU9tMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgAqfd7NtZL8cHQRZEQ6Spsj:i0mAIpUNVS6AqZ/ZLW3Exj
TLSH
T14D341237EED31E372BC79BA0B9421FB9617244E5D02483049AA57ADB7DC7A553803CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Valorant Bedava Hile İndir.zip.crdownload

Path C:\Users\Admin\Downloads\Valorant Bedava Hile İndir.zip.crdownload
Size 759KB
SHA256 c133e6c0921731fcfabc3ddbd4cc10336e795d6d7053fb56136690566b0ec394
MD5 d5ea45307ba9231f028d5013f0fd32c2
SHA1 8af466424a061df4498981c5d005accf16c9e99f
SHA512 23086308beca30f0078abcd9233aaa3f61ed4d45c5cadf3b639d2ed294a07c6b6bcf272ae45e6146586886a6efffac8faf494740f82c038a426485dc80f3bb05
SSDEEP 12288:wyf0FWne7mmR5v3Hk/uAU5ujfPG5Gzzwx9dxAalHfoIGHEhypzuK6dnYaltw6r:wc0J7mmRX0LPMGQx7xAalHfoXHEhyluZ
TLSH
T1EBF423AEC19D3432EB5E813CDDD059A18543EED4A1A8336155234EB9E0E68E31C71AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads