fdc5872724703f6e77e2d243772dfe59cbd17b8bd71842b6e562887e6a39a294

Analysis

user interaction
yes
max time kernel
269s
max time network
271s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/09/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mal_file_0460477be095abde898577bec5e7b97f88782ca3.svg.tar.zip
Size 4.2MB
Sample260908-tpaddathlb
SHA256 fdc5872724703f6e77e2d243772dfe59cbd17b8bd71842b6e562887e6a39a294
MD5 5d37eed5bd7eebbaed0112a59b7bb500
SHA1 9e6b32ef7a3c4ad234f972ed298b4c8f914a5192
SHA512 02a960beb1ebd41be61a5dc550246ac25a257675d93df94b50b33e971d17d7698da66f3580fdb99d5067f95b688b85c1a2463166ac73d282d5da789f0a961051
SSDEEP 98304:oMN0tJRJ5zCLakpvoOVEC1M70elVdPQGo1n5FocgXyrnL8+RJ36:d2tJVzgakoB0ydw1TonXyH8+Rc
TLSH
T1F226337DC91F486B97012C77693ADC052E512F6EF6D3BB861F3708CD82A142B9076E86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3824	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333577082786095"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3720	chrome.exe
3720	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 4040	3812	chrome.exe	85
PID 3812 wrote to memory of 4772	3812	chrome.exe	86
PID 3812 wrote to memory of 4772	3812	chrome.exe	86
PID 3812 wrote to memory of 1392	3812	chrome.exe	87
PID 3812 wrote to memory of 5096	3812	chrome.exe	88
PID 3812 wrote to memory of 5096	3812	chrome.exe	88
PID 3812 wrote to memory of 4008	3812	chrome.exe	90
PID 3812 wrote to memory of 2652	3812	chrome.exe	91
PID 3812 wrote to memory of 4008	3812	chrome.exe	90
PID 3812 wrote to memory of 2652	3812	chrome.exe	91
PID 3812 wrote to memory of 3792	3812	chrome.exe	92
PID 3812 wrote to memory of 3792	3812	chrome.exe	92
PID 3812 wrote to memory of 1576	3812	chrome.exe	94
PID 3812 wrote to memory of 1576	3812	chrome.exe	94
PID 3812 wrote to memory of 4752	3812	chrome.exe	95
PID 3812 wrote to memory of 4752	3812	chrome.exe	95
PID 3812 wrote to memory of 1432	3812	chrome.exe	96
PID 3812 wrote to memory of 1432	3812	chrome.exe	96
PID 3812 wrote to memory of 2344	3812	chrome.exe	97
PID 3812 wrote to memory of 2416	3812	chrome.exe	99
PID 3812 wrote to memory of 4676	3812	chrome.exe	100
PID 3812 wrote to memory of 4180	3812	chrome.exe	101
PID 3812 wrote to memory of 2128	3812	chrome.exe	102
PID 3812 wrote to memory of 2128	3812	chrome.exe	102
PID 3812 wrote to memory of 4708	3812	chrome.exe	103
PID 3812 wrote to memory of 4708	3812	chrome.exe	103
PID 3812 wrote to memory of 3788	3812	chrome.exe	104
PID 3812 wrote to memory of 3788	3812	chrome.exe	104
PID 3812 wrote to memory of 4196	3812	chrome.exe	105
PID 3812 wrote to memory of 4196	3812	chrome.exe	105
PID 3812 wrote to memory of 4012	3812	chrome.exe	106
PID 3812 wrote to memory of 4012	3812	chrome.exe	106
PID 3812 wrote to memory of 5084	3812	chrome.exe	107
PID 3812 wrote to memory of 5084	3812	chrome.exe	107
PID 3812 wrote to memory of 2896	3812	chrome.exe	108
PID 3812 wrote to memory of 2896	3812	chrome.exe	108
PID 3812 wrote to memory of 4676	3812	chrome.exe	109
PID 3812 wrote to memory of 4676	3812	chrome.exe	109
PID 3812 wrote to memory of 3720	3812	chrome.exe	110
PID 3812 wrote to memory of 1632	3812	chrome.exe	111
PID 3812 wrote to memory of 1632	3812	chrome.exe	111
PID 3812 wrote to memory of 2888	3812	chrome.exe	112
PID 3812 wrote to memory of 2888	3812	chrome.exe	112

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\mal_file_0460477be095abde898577bec5e7b97f88782ca3.svg.tar.zip
1⤵
PID:2332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\JoinRepair.cmd" "
1⤵
- Executes a command shell one-liner
PID:3824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1becc728,0x7fff1becc734,0x7fff1becc740
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,6664164669688323020,5230588525766377543,262144 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,7827064754270934713,4227019691800294777,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,5063395398971862661,3680040407868895198,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,16305331169305379397,18398459628555186028,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16722472343411927627,8938871100265076829,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,4957161379637962099,3768668426761075668,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,7107382347162228668,18225625367591371608,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,9361447247518384609,9527549851633627156,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,3727401009160699748,13646273987526085693,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,324429462178374816,5242761953826031863,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,4970590521293947851,18133092527639397659,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,1682076655110545332,3838713472849158819,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,8093994654307218570,17424669953265355467,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4336,i,1062249821460365057,15575646388085250678,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3444,i,17275729714510377203,16532903048961194829,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3540,i,1966151711020400722,6999388760938441134,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5764,i,4596743419828179948,18282833424737627530,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5948,i,9502066597866332626,17194233740182525959,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6096,i,12630460241255511005,9449892281784473709,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6288,i,13981782443077162904,12154159799940698755,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6352,i,14123680704469060406,11514227830928600800,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6140,i,12994658332467761369,11007502195421609575,262144 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6192,i,11536555871410785213,5920286930953582917,2097152 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,2027908890225145134,11052281028840024238,524288 --field-trial-handle=1920,i,14137952642011516337,15653740024031809219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:2888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4b0c2faa179c00667b425cb12ac5d98d756893557f58664ffdac0ed6c12e2f2c
MD5 e9136aa5e7a7ae4779af0a3c74810093
SHA1 2f9ecba5226c019f02454c1232e03750798aa4e1
SHA512 c0e8ed8d08de7dc4cfc6aa0620d7b2727ea7aab8e92397eb39dbfcafbc9b7d066656fec718623d77a368db1c8ab245f4a608bca6243c7b357c5bb74cc02b2d94
TLSH
T105E02BB9C961ECAB2DFD075850254745D60023173641898B373DC10CCFB06379591C5D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 17d17846015eb88cde3ca01e70f0f3a2fb064bcd82b1c35dc03a3b5825e32ab2
MD5 d41001466f1f7e224c4735eb70175d49
SHA1 0be75d222ff8ea70c2dc5a212f6001ab326aa0bc
SHA512 ee7c345555e47a2a414ac712ae5c5b855da9d7b289c0b322cabb7b44394c2e80c8667e6fa65bea6efaa421746557d38827c78d15515945657c3d8b6aaf8c0b7d
TLSH
T1BD31CB92F8D1A430EF64277407E5CB2220AB9590785F5F9E411CFD50328B7B56327B41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 c78e773c8c4f857d0fe48ec6042978c843a3c32184265c59134ee1387cbff492
MD5 a470a9383b85c00ca012c77a4c0d1535
SHA1 accc17a1e5d88f11fd7aadbe6ab652409328c8db
SHA512 de060fe7c10d9e464003fd3d5f896ebd6aed1f9ae791daad2966211baab05119aaa2cb6e65ed5f20c8db5a6e4b10bda49d432758d7b408243eb78e3dc6bff8fa
TLSH
T132C02208F8CA0002CF3C3330020000CA32BC0800220282E282C0C3C0C82BFACC203AC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e2617d7cf9296ff28de8fa3feb3fda9aa988d08da5e9ca1f167009d29ca80b90
MD5 18bc997628a964ee20cb61e6a05befd2
SHA1 4125c10c7f9cde5c1b8785518e765876f42eed42
SHA512 6afb3d88c2ac622ea186ae181cd7c7c7ade4e6972281a241aa71e864d7cec879c55025b5e76f6e17927834f8d221249c1fbd1be463502af485dea73975d7c6b2
TLSH
T1D931E192F8D16030EF64777407D5CB1320AB9995B85F5F8E015CFDA4218B7B62313B45
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 483ea93a62fba4f4c7a0f03643de80942175075b0f57591907e059d500fbddc0
MD5 f6f7b055f320f404676fc6d114fd6a7c
SHA1 8a618c30bdfc23be4d11c7389ec72efdaa8e1b5f
SHA512 a207bb2f09f606aa148febe8f7a055afa0806af70ca1144b4fb9b4ec524ad81b3e259aa1f4f6911eb6875c591a8548cd1f61b39ff7dbd3222d31980cd84d965f
TLSH
T1AE71C0F3C7E4C96D891156F49B11AF2FCE2D0A24432D3C66C8D4AE5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 ed96c690ed4cfd4444a48b1e717bcfda1ccdf52777853bce6da300336f417c8a
MD5 5dbb3b66d09521e8da2ddf4691568fbe
SHA1 a91e78e7b0364eac16042e3cd9cad761806fc984
SHA512 60ada87e02a06804d672baf570198434df5b90bc5e405550754adf8f2750ad9ec29cf54f709a0a4c0b472bc12d1d6439e37771cfda1e8f3da2c35da26ec2bbc8
SSDEEP 384:Db+FnXc6Bjds0eyeDG4hEVJ4wJK72aIMihqxz2vaqaeYooN0rVAvls9z5Vk4yVVd:414LyTkhUNSLYUdaU
TLSH
T1B892BEF383E486BDC95252F49A14BE16CE6E0924535C3C96C4E8BF4FA3F1572E28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 737564221f0c665b87903a19598fc3b162f7ce0a2329b768bc663e8a0968d9b7
MD5 74d2a1ee7fa71f6703fc71af7bfb4b01
SHA1 2881901376152dfd9109047cbac60e1dd78a9b99
SHA512 788f8249f8e6185fb1ae0ff4576e7f937416f19db65884be0f97a333b5125fd7c6ba49667c1eaa267fb6598f8ff0087e97d61cba10a8859851e53cb517ce4cf7
SSDEEP 192:uRhT2RwWiFv7lpAPRp2O9+Hsb+WNnRW0C67Tokwca5VyIsnAUgtaJ:uRhTJ1RUXB0ws03E8af8
TLSH
T12C42C57EAD10753BACDAD229FA257753D7F9102121942E84EBFC892C14D7ACC221B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 849ed6cee094694a1fa5124e29972345ca39101fb455ca535ac46afb3cec6779
MD5 ab9eb0411136f179261a1091d8e58013
SHA1 8676b70e7749a82ad58f8abb45e8d9ec1515d1f2
SHA512 59673afacdbbffe6f1c5c612f02a7ba2389d5932fb8b0bbb0b010cf3d8cf1f3dc1f939913a49bb411381c0c42ed0b1ae6261b63d1b993ba4cd7d8415c5eb075b
SSDEEP 192:uRhT2RwWIfv7lhAPRp2cB9+Hsb+WNnRW4mt2t67TokwcaUVyIsnAUgraJ:uRhTd3R8Xl0ws324E8aQe
TLSH
T1EE52D67EAD10753BACDBD229FA157717E7F8202120946E84EBFC892C14E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b2d187f6b378b5c4ef22947a4cff810473da2d977fa8fe4e2deb77ce4c4339e1
MD5 7d34d25d89c3fa451cc2dc489c3d13a4
SHA1 f351e1f7568d2e1b7fee3ff547b2831e8c898c2e
SHA512 f98e31c8dd85c3c986ae0c22289861511f763cc5ec6d1d206586ffd8fc13a9d45b3703209e509c0126e05e4a9a4782ce0bc5f0397df6af5bb262805f848348db
SSDEEP 192:uRdcBzT2RwWWMv7lhlPRp1/IF9+Hsb+WNnRW4Dcc067TokwcaYVyIsnAUgraJ:uRdmzTtYRrXq0wslcZE8a8e
TLSH
T1E952D76EAD20753BBCDAD22DFA157B57D7F5202121942E84EBFC892C14E7ACC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f59b15128d312e2ae5074a6de652fb040815f4860bda63b432ca9cc7f8d7b747
MD5 dbe7abc25ec39735e9451e974502f3e9
SHA1 575fda88e7cf6c34cb25b624e5c4ada2d64ed266
SHA512 8076de7e8b4100fc0a3bc58f3172949c02f97fb63c6d0598d1f9cbafa4b819a0073dc432d1e1ac9d5f24b2d387130dd5b4a015b49736f196ec406c9297fae1b9
SSDEEP 192:uRdcBzT2RwWOMv7lhlPRp1/ICy9+Hsb+WNNmRW42Dex67TokwcaYVyIsnAUgraJ:uRdmzT1YRrXI0wv9esE8a8e
TLSH
T18D52C66EAD20697BACD6D229FA157B17D7F4202121946E84EBFC8D2C14E7ACC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7446260bf242e7845b3a6d84b0017db2356c950b90fb821698dbff976b334037
MD5 b7c52d093f3e5a53305460255ddacdb3
SHA1 c054d6195b1c9b8d9bc87a882bbf2f572e3c05c4
SHA512 e0d7c178d2dbbd37185422a9f29a3d6baff539b3f6b2f81299fc1ca42b77742d0b1879520dca345e2c79d12790acce2c7ac19b7dba4b2a8993513293d6d96b66
SSDEEP 192:uRdcBzT2RwWOvv7lhlPRp1/ICy9+Hsb+WNNmRWWrDM2Des67TokwcaYVyIsnAUge:uRdmzT1nRrXI0wvKReRE8a8e
TLSH
T10962E66EAD20397BACD6D229FA167B17D7F5202161D01E84EBFC8D2C14D7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7c9506326793df366f11da5363a21fcb8dd180f3db1636eacc307020f4fe7000
MD5 5af8bbf8bb0d62c74329320e1831dbbf
SHA1 7fec463a86329f66a6d01d5ce264e0d45620d578
SHA512 79a271974494d21d702bf37b89c335cf91c8eeea76961295af14ec0dca2ff30d6bf399c67d53a1d6b0be57593a179a2394d5b47adb79b0dafa44b2ed7c0ff952
TLSH
T195B0128080415601C08202F4118654CDB118EF20960B370283E1A962882515081191A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f524.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f524.TMP
Size 96B
SHA256 31d86b32f75838e1b82c61879b03be7c83c3c618f1008794c3b7ac075b98d5e4
MD5 f5b30882146f0b8f7cd86062b2027644
SHA1 87ad3192dd762657d27e8a4166dbdaff7ba51f53
SHA512 9db24be21fd8547dcadbe5d057c71b8dfa33aa4d01c8495e96e1d1d6f02f7706d979e8d26cae8f00ba59ef2fca7bdc0335d97eec8e6977634074fdd77d060370
TLSH
T1C2B02202C0C22222C00203F02CA2C0C83020CF28C203230B82F00F22EC20B208CA3C32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 69309ea7051bf0bc3c4880067434fbc689857224f05878d9751729f5bfe5c22e
MD5 38bb27cfa6793c2af19e01d103f03c4c
SHA1 eb17507734ac544b295db44291eb5adfd1d59814
SHA512 b4f41bd6019c8c684772a38bca74f09b6e8235e43c677ab8fa2d827110a4dbb8334cc9d37080fc34da036ad2b467f5b9d2cce492fc8320b9254521ac29b83843
TLSH
T1D6B0127154C10D25E80807B4E7D683D037025E3443035243409984C448430E32117278
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 9852154cb1ac150132863699e80bd1115550f01dc2d27efabe286ae1057dac3c
MD5 e4dab47677b6359b7328565ed7cdc303
SHA1 33522d245176a6a41c8fd4620d2545beedf3520a
SHA512 e6b1dc314dacf76614f8bf376676064def7a82cb6899bb7c8ac78421b80cec59581a025d310fbcb1c6d291253a2055dc73275442dfc71f1874f4ba4d504fe747
SSDEEP 3072:WCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquh0Gm7D5Lk17ox1tIpud63Uc:WCZqyXOplXaHl3m7Rkm1tYpBeh2BAop
TLSH
T1393423336D5DF4768CBEE76A604E4F5D5EF0CAB681249945C9CABB8063E7BCA0905C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 24ef53b625d2bafc9bd7cfee6669910c0433f313b3ac2fdeec7fa70400f1ade5
MD5 cf043ae5fe0ccbe476548b65372e77a0
SHA1 9f831e5df103fe765e127d90e16506cad89f434c
SHA512 b33d1edba7f35cb74e1171fc8f7c7c7d0069404cf5173208b578194224e349f9628a0c4db1ff4dfd648630e27fad6184fb3468f8aad07865172063b590a2691c
SSDEEP 3072:3+CZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquh0Gm7D5Lk17ox1tIpud63V:3+CZqyXOplXaHl3m7Rkm1tYpBeh2BAop
TLSH
T1C13423336D5DB4B58CBEA79A604E4F5D1DF0C9BBC624A909C8C9BF8067977DA0906C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 c17be3508a17fc010a06b01c441b36be193627fbdc593269c21e081dd560bbc1
MD5 1493d85f890a833fe439837deb6c2e23
SHA1 aa7450d44e8b7afefb0ff70499fea4f1b630e6d6
SHA512 f1570f9ba59db0b0e23b915617d6479d67e25c405858a5b1f0d55a34d10ee2ac2a02dcdd3b02d75727103996b5aa58e60830fc50260f8016708002b921422852
SSDEEP 3072:TCZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquh0Gm7D5Lk17ox1tIpud63Uc:TCZqyXOplXaHl3m7Rkm1tYpBeh2BAop
TLSH
T1C03423332D5DF4768CBEE76A604E4F5D5EF0CAB681249945C9CAAB8063E7BCA0905C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 253e5dca6184944e1ff75695dfbcb6ba5471302f4f1cde1339cbbdd23278b107
MD5 ccd408fb496a536690b0fba0c517d431
SHA1 621904e54000733ce823543330efa4913b255f2e
SHA512 893d3128202ed2823198cf2c357070639b3223b03dc6b33b3dcffb354cf1039652867d7c77e874edde0c53a6457975a63a4db35fe798586aa5627ac27c1aa8a0
SSDEEP 3072:lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:sm7Rkm1tYpBeh2BAoa
TLSH
T15CC312375E71A9775979BB4EB08E0B1F1EF149A2D920DE42C8D85B0437F97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 2fac20590f7e29539d0018427c16588b4b09ef79362758e164bf4a2f4b8610fb
MD5 e283f84dd5689c5692b365942cf2cdb2
SHA1 4768aaab433048da01fae834adfcf8fd74789c2a
SHA512 a66bfc4ab73e7f970354d0cb7ef71d62d5d7d251307c5c5b4847e275c6eecb1de5b1a20b904f22ecbf2084115aa11a77e682fc86e18fd0aa664f5069121ccda8
SSDEEP 3072:/+CZ7cF73Pr5yXOGehznopOGW1aUP3a9oY7VaSkEquh0Gm7D5Lk17ox1tIpud63V:/+CZqyXOplXaHl3m7Rkm1tYpBeh2BAop
TLSH
T1D03423336D5DB4B58CBEA79A604E4F5D1DF0C9BBC624A909C8C9BF8067977DA0906C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download