4dc253dcdeb27de8ca4e6897eafe65571442588a571f9464c1d42f0c80fe4cf4

Analysis

user interaction
yes
max time kernel
689s
max time network
690s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
woof_dump.txt
Size 52KB
Sample260910-rfmk8svbnf
SHA256 4dc253dcdeb27de8ca4e6897eafe65571442588a571f9464c1d42f0c80fe4cf4
MD5 1da152c0cabe904b473fb7dbe7b005e9
SHA1 bb2467f9d632a4e2fafc5a3d575e799d3201ce29
SHA512 cf0f886ab2ae641cb5bd4738761d8b2fd912a98749836c9dfc8e53532a263e480aec46184b79f96e20926879b4943f17e1d5b360161ef78bf11ca7c13e215b06
SSDEEP 1536:N9bq9IDbDf+g3AiTFhZju7IsjQ/upwbiOz:NlrbDp3Ai5hs7pwbbz
TLSH
T12233CF392597CEBDDBD309C0F1210A73CD322D4FE6159361FA5D42346B943A0EBA6AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com
152	raw.githubusercontent.com
119	raw.githubusercontent.com
122	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335229147125507"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4800	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4692	vlc.exe
5360	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
6100	chrome.exe
6100	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4692	vlc.exe
5360	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
4692	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4692	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe
5360	vlc.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1076	1496	chrome.exe	88
PID 1496 wrote to memory of 824	1496	chrome.exe	91
PID 1496 wrote to memory of 5052	1496	chrome.exe	90
PID 1496 wrote to memory of 824	1496	chrome.exe	91
PID 1496 wrote to memory of 2276	1496	chrome.exe	93
PID 1496 wrote to memory of 2276	1496	chrome.exe	93
PID 1496 wrote to memory of 4012	1496	chrome.exe	94
PID 1496 wrote to memory of 3352	1496	chrome.exe	95
PID 1496 wrote to memory of 4012	1496	chrome.exe	94
PID 1496 wrote to memory of 3352	1496	chrome.exe	95
PID 1496 wrote to memory of 1200	1496	chrome.exe	96
PID 1496 wrote to memory of 1200	1496	chrome.exe	96
PID 1496 wrote to memory of 3068	1496	chrome.exe	97
PID 1496 wrote to memory of 3068	1496	chrome.exe	97
PID 1496 wrote to memory of 1860	1496	chrome.exe	100
PID 1496 wrote to memory of 1556	1496	chrome.exe	104
PID 1496 wrote to memory of 1556	1496	chrome.exe	104
PID 1496 wrote to memory of 4496	1496	chrome.exe	105
PID 1496 wrote to memory of 4496	1496	chrome.exe	105
PID 1496 wrote to memory of 1048	1496	chrome.exe	106
PID 1496 wrote to memory of 4404	1496	chrome.exe	107
PID 1496 wrote to memory of 4596	1496	chrome.exe	108
PID 1496 wrote to memory of 3396	1496	chrome.exe	109
PID 1496 wrote to memory of 3396	1496	chrome.exe	109
PID 1496 wrote to memory of 404	1496	chrome.exe	110
PID 1496 wrote to memory of 404	1496	chrome.exe	110
PID 1496 wrote to memory of 4196	1496	chrome.exe	111
PID 1496 wrote to memory of 4196	1496	chrome.exe	111
PID 1496 wrote to memory of 1828	1496	chrome.exe	112
PID 1496 wrote to memory of 1828	1496	chrome.exe	112
PID 1496 wrote to memory of 4720	1496	chrome.exe	113
PID 1496 wrote to memory of 4720	1496	chrome.exe	113
PID 1496 wrote to memory of 2600	1496	chrome.exe	119
PID 1496 wrote to memory of 4692	1496	chrome.exe	122
PID 1496 wrote to memory of 5272	1496	chrome.exe	128
PID 1496 wrote to memory of 5360	1496	chrome.exe	129
PID 1496 wrote to memory of 6100	1496	chrome.exe	131
PID 1496 wrote to memory of 3224	1496	chrome.exe	139
PID 1496 wrote to memory of 3224	1496	chrome.exe	139

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\woof_dump.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8c83dc728,0x7ff8c83dc734,0x7ff8c83dc740
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,7544676775567307622,10688243238069661288,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,696260990643881648,12512732805340237718,262144 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,13044162356018981714,4632889915205048858,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,12802971767969430255,11437184528317830325,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,8519791067942171863,15769401687732491428,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,10866187311045450567,2367233298806711236,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,13416447910765823503,15592514720609415008,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,2925643389479335195,11767586029192017756,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4008,i,13502832386192921691,11172728084890923177,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4688,i,13083318112116025237,12510867810570021540,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,13343546165515527140,13386500143547719999,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=244,i,3647218136741051221,14555826291093745796,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,12914807585094058845,11799491910177643629,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4764,i,6552116557558793278,6840976774792060407,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6036,i,13713099829807160435,17436983148282189875,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6112,i,13013634262154375898,7574104476876911488,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4760,i,3365006359788717414,17940881300126082700,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6272,i,4225807908470190858,2968994877420566813,2097152 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,2088446320772991051,9884372291497785161,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=244 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\02 - Sport Funk.wav"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,17481523433810788123,16119214434854535607,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\2026-05-20_09-19-42.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1120,i,8333959578478108492,1908501717481577223,262144 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,7886388060208945325,13736670993617743149,524288 --field-trial-handle=2168,i,4734924807101222066,3648571913314953390,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:3224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 99ed01a4929590593be49ce8413149b51223fc620f49c0199e3895951f5ce299
MD5 6a684e6f76ed9a09a7ef38f169d59b69
SHA1 8783a605932470a43b2cc1cc4808611ce18726e2
SHA512 07abe2bbd69c9a50bc16dba83063cb1342752271467a28f6d5c25fe5f4716d55d74ac1d9bfd80b7ff5640df8116b5a27b2657dcfb8725c2dc2294ccf294a4ac8
TLSH
T15EE0616DC861EC3718FD075AA4542742D79423AB2A40C94F7B3DC51D8FB5E374A85D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f42ba1dd839dfa96ec5fd94afe7a5a8fe24cb50d330e62f03ec8807b47ab3260
MD5 3a4dea64fbdd0bf10b74f428c18b2706
SHA1 c120e6131597f7c353e12509d7e897e9cc91cb5f
SHA512 a6c200a07e3c399a0400416136318307b89214365678dfa2bd440d8db4b7d9cdfd32740cd4a69462687cc4203ac7954f718e07f4c7ffe187ce8d21e62a8ac2fa
TLSH
T10351C75185611708EBAA847235F010D3F1BD17CEBF6B5E2EDF54E1B48DE27C01823011
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 641a2cf5bb85ba20aafd5187aa87897249215a5312f7da33051fb2aad106a1ac
MD5 11266b70337046b87cf4d360d862df98
SHA1 281f22d621dd9e7070a3db6ba55216b7a4df2ee2
SHA512 bbcbbb8930357cd8dd896821a385587bcb62d021a0311ec0f9fff7aa09c9cf2041b4021e834c2353a4b4640ec7b4fd77061bf4554090b163f103a0769bf9f306
SSDEEP 96:DBex1mdtaIqXcpMlh0mmmO+mcjhnmDmZmDZgBmH:DBex1mdtaIqXcpMl2mmmzmcjhnmDmZmB
TLSH
T18391C0F7C7E58A6D8A1156F0EB14AE1FCE290928531C3C66C8E4AE4B93E2872D14175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 7472f96674ec9e803e9ff089848ee3329cda49d4e6f2927dc6b78648be6c0826
MD5 50a731faf538ed8d60032d312fb012c8
SHA1 0d9b0490d77e2cb508d5382f0fa6dadeb81f68f1
SHA512 d77c1e7b0a87bd5d83fda925338ee26156371cdad1b0e06f4e4b2a18d82e17ef6f7a78bcea78107cf05c6e972e59c3758483264ad7e9cd6e67a0c470a75616ef
TLSH
T19D31779796BEB42B006948B71E04BC052AB9AC340251A8F6CBD7C33CA0C90E71E23472
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3c8ac56f585391c5a0a8e55647a916b634f659528a8d5dc74191361d419e5d5c
MD5 30314c9c2ea52040ae433651e10708eb
SHA1 b7c962b7c9dcdb7c83f1ac7ad159d03fa231bd58
SHA512 aa2dbcc137eaa2a99b3f37a4570829d73f8d59848fd88737996669832390112065580ed70e4bf313d005160a9d472e6ad0b64fd2e61ce43254722095d3075a24
SSDEEP 192:bRKlnOvMoVFVyv70IiPRpDd4iEe9+HsqMb+WNnu9+cTY9Zeds2kSO5VyIsnAUgr3:bRKlOT7egXX38AQJYAs2kSOfT
TLSH
T15562C66EAA502D7B5DDBC22AFD517B17D3F1602264901E80E6FC8E2C16D7ACC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f7a6f8aec20c694e5b2704ceb1de5a4eed4e6717121892d89ba7df2ecaccf6fa
MD5 7ff01ab924b1f54199e31adb5d4f531c
SHA1 d8de95b6cac92104ceb6c64bd0e48fd3fe278154
SHA512 651da05f777ae8a03b99326b8ec5f89fcf80c5c67a4a37aae19a81cb6eaf78717a0e0461f93e0a9ededfb56a4cd753f3b9b8b132b48b94b97e921d3e15a12cfc
SSDEEP 192:bRKdIOvMoVFV1v70IAPRp2d4iEe9+HsqMb+WNnu9+5G27Zeds2kSODVyIsnAUgrK:bRKdBT7FgJXq8AQd2Os2kSOle
TLSH
T16152B62EAA506D7B6DDFD22AFD517717D3F2202265911E80E6FC8E2C16D7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2b717d9a84c2c5d460c05237b28a6f17d11a3c589a72019812064815448020bd
MD5 c8b36a47997cffc1a70b65ad32110c88
SHA1 f91bae41d7b699fd1577ef64bd99779f6428362d
SHA512 a65db003eb3f8ee12b2bd4d299a9fc25965cbc1c9640fdf72f9fc1d9b0b4b7733102e7698625e9642d1f8eaf453f427fd73b657902db4e0c78299d706d9ec3f6
SSDEEP 192:bRKdnOvMoVFV1v70IAPRp2d4iEe9+HsqMb+WNnu9+5G27Zeds2kSODVyIsnAUgrK:bRKdOT7FgJXq8AQd2Os2kSOle
TLSH
T1FE52B62DAA506D7B6DDBD22AFD517717D3F2202265911E80E6FC8E2C16D7ACC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 457cef4c35312e4f7e72927ba6d984bcaa654a05ba37a74ecfc73efab7075117
MD5 f1fd774846d57b1e3af894ac6079b5b1
SHA1 2017f49cb5f8b8475a560e84b0a8eb290bc349a5
SHA512 1d2bade44fe54f670e461cd2c96082bedcc4ebb50c9524cde94cc567ca0898786d6e8f5b381e40ab6bb6401afbfd3b0f8be27f3d9b9f19c425f6bac19c4a7366
SSDEEP 192:bRKlnOvMoVFV1v70IiPRpDd4iEe9+HsqMb+WNnu9+5G2IZeds2kSO5VyIsnAUgrK:bRKlOT7FgXX38AQd2vs2kSOfe
TLSH
T1D362B56EAA502D7B5CDBC22AFD517B17D3F1602265901E80E7FC8E2C16D7ACC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 25cce68ea2edd4041feb0f7ab841ea92e418f3a18f43c55fa53908ed4d6936f2
MD5 aadde73b836cab1f99cf646be768951d
SHA1 453d928e42947e3d9f62e524e5a20402c092e7b3
SHA512 e01d46429b8d25098ce260130447a9dd8cf09d0dff50b157f91f6520c9eb8146a62ad037e9b0d08b9825407e51fb058f5e68e3499d9389333af0c27b02e5edfe
SSDEEP 192:SRKdIOvMoVF71v70hAPRp2dj9+Hsb+WNnOd0FaZeds2kSOTVyIsnAUgtaJ:SRKdBTxFg8X68wM0F5s2kSO18
TLSH
T18F42B72DAA50697B6CDFC22AFD617B57D7F6102221951E40E6FC8E2C16D79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5abf6294fb70a798477c215352f1e5188bcf1f5ef1831b655fe2b70ea0d6a33f
MD5 b5f6b8e9ebead03830959981b4d02bfe
SHA1 7af2e9ba80a6430ba11e95a9c552beffe42ecaa2
SHA512 084cd622e2782432d32908206a9a51be161a022e26f2cd06253623a746765e11f2e7830942d4e0ea14aff985d37767909bcb2e9bc4d7b45d0fcdede921748a80
SSDEEP 192:bRKdIOvMoVFJ1v70IAPRp2d069+HcUb+WNnu9nMZeds2kSODVyIsnAUgraJ:bRKdBTjFgJXo8HQnDs2kSOle
TLSH
T10652B72DAA506D7B6CDFD21AFD617B53D3F6202225951E40E6FC8E2C16D79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8501dffccb8b3e3458ee5d461a0c85b2965c930679c78931add1aa71827f091c
MD5 e8d7af2160dc4138d661609ef0681d0f
SHA1 4015caff024d5aad6bdabfd5dcaf3b9c5ee15554
SHA512 57d39f1d062d16e7d08e15b5b61a192da572cc7a22904e665189841ecfcc88a5c460d2dc6566d963f0b37d5cafb5bd2b32c5638e8e6384f95f545d0daec31a5d
TLSH
T1F5B01240C1025262C41A02F411621488B3149F10964E170943F0E9B28839551851E050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f95f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f95f.TMP
Size 96B
SHA256 cdb15b16e8fb99c7453aad8b9d57cbdc78646e3d0d52330e3d79309842f42fcf
MD5 8ab0415a16ddc25974e3adaa440feb42
SHA1 74af8d7a5e026ec61bcb9c5f14409909e14ff110
SHA512 3b73dbc8221a1fa4cb44b5e55373854824fa6472012dc85de287bae7f0118dea086e9f58c70acd75341870626af8006d66210f855c7d7a81028bd4ca11350f03
TLSH
T1A2B0220AC3022202C00203B0A8A0C0CCB020CF20CE03022BA3E00A3ACC222A00822020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 3d0c3458022a71d231a6e263721dbdf69ac00a85171846ee656d39fcec1dde5d
MD5 1afb0e46790a4fe71582859d44d6772c
SHA1 7b9b81d1e8874ba75b630a6a6a34574a3456158b
SHA512 8635ef67097b340120fba82ede3f51f771370e32ad72886b5866821307e03708d550c9fdcd2a0a0fae5f37311eb9dbf0cd222e9110e9bcf4982804ffb002b69b
SSDEEP 3072:WmkwvQ5HJzS1Mm5ARb8nR9euTf7MQjzrXj8O6LNokqfd7NtZL8cHQRZEQ6SpsM:hQ5tTbRIn7e2f7vwO6NqZ/ZLW3ExM
TLSH
T1FB341276AFC05F3759E78F7CB9570F9BAAF354C1E060C340AA643B8BD842A41A847D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 b8ed9dbeb1ee6a13d32b898a6e2c1cf92881ddd8f74512257d23ff70531afd81
MD5 eb89982f14efaad6c1c92cb4b132034a
SHA1 3a1ecb623192ef04bc62214240d8e760e4f2cddc
SHA512 70aa28857106529ddf7e9c4aa145c5434c9c21c7bc7ba1d09e16a6d4df4574c2dfb84f5dacbd5f2b4b41b14169db6918fbca748a8ce96c07752b09e2edb47b98
SSDEEP 3072:d3kwvQ5HJzS1Mm5ARb8nR9euTf7MQjzrXj8O6LNokqfd7NtZL8cHQRZEQ6SpsM:dNQ5tTbRIn7e2f7vwO6NqZ/ZLW3ExM
TLSH
T10E341277AFC05E375AE38FB8B9070F9B9EF354C6D520D344AD643B8B9842A41A843D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e78ed63eb451f09702f3c44e38aef183826307c37596e5b8ca0494c8e1b4f0f2
MD5 f1dc4916cb918bd6bce3b89a14ca2852
SHA1 68f6fcad1c2b7476e821ba523072c13ee4e00ed9
SHA512 4f0792c5b2a45675c967cfb63c2a523e8bbae9ce175d5bd9cf359c2d7014d41874f9da4fc6b85df65fe956384e207303998b36ef6023f0f63169a7a710350f74
SSDEEP 1536:bmLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Cqfd7NtZL8cHQRZEQ6Sps3
TLSH
T151C30237ABC21F339D93CB64B9530FDA57B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 46aa995e5d878c777e2b9b3a53a1bec4d6c1a265d8d26f10bdb289c8cf2a7e50
MD5 3aa004ac42b1c45054846d8213bc30a6
SHA1 e0873a224b3853f9286e0bd985b24ee396d177e3
SHA512 a227b03151e70ed9854e8ef78b09917d0f0cc57d72ed80ccca017217807d0759d77c3f8c3d271893dd4faf5ee92e5edeb5031a69cd6365736bb9b6ca0f7c02c0
SSDEEP 3072:h3kwvQ5HJzS1Mm5ARb8nR9euTf7MQjzrXj8O6LNokqfd7NtZL8cHQRZEQ6SpsM:hNQ5tTbRIn7e2f7vwO6NqZ/ZLW3ExM
TLSH
T142341277AFC05E375AE38FB8B9070F9B9EF354C6D520D344AD643B8B9842A41A843D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2d1624a-d2da-4634-9ac3-2759fe2ac82b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a2d1624a-d2da-4634-9ac3-2759fe2ac82b.tmp
Size 242KB
SHA256 5cbc2380b248f1d850cdc6d079403e2df094ad81eca68d8891b2f109941be187
MD5 48030ea26376c1ac6cb120bf64b1b627
SHA1 4e04c7e697b856efc8986fda0064adbef8c04e05
SHA512 10c6efdb2f8f97d1d11d7709b09431b2e443cec7176dca5b28952946e7d9ad04992a798bde19fdaac1a3aaef4c663ea2df0778edabcb776f07edff3b147140e3
SSDEEP 3072:8mkwvQ5HJzS1Mm5ARb8nR9euTf7MQjzrXj8O6LNokqfd7NtZL8cHQRZEQ6SpsM:jQ5tTbRIn7e2f7vwO6NqZ/ZLW3ExM
TLSH
T1AD341276AFC05F3759E78F7CB9570F9BAAF354C1E060C340AA643B8BD842A41A847D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.xspf

Path C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
Size 304B
SHA256 81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d
MD5 781602441469750c3219c8c38b515ed4
SHA1 e885acd1cbd0b897ebcedbb145bef1c330f80595
SHA512 2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461
TLSH
T135E0CDAC3084DC1147D1E513BBFAC0447775A0495AE95985E7E326B385411F4B631254
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 554B
SHA256 7a970699a9d6d2005ba6ef50c6e2f91d4cf24c8838e926c6bd1b6abadedd8c15
MD5 5b10d9c7dd98abc283dd62eb7b8126eb
SHA1 52785ed1d0f57492c8b52eaa8d9255afc40bb510
SHA512 5dc6adf75ad2be4037cb9cb3fd46cdeac88adec234b97af1ad49b35349f595b1a4c69c61606815c20fcc0d3a0af184369f10249e33d1b03ded0b68b52f398bd8
TLSH
T13BF00E610429407CC1C45F0A29FFE387B937E640BD223306F4142524750D5EBA9CBCEE
MD5 SHA1 SHA512 TLSH

Submit Download

02 - Sport Funk.wav.crdownload

Path C:\Users\Admin\Downloads\02 - Sport Funk.wav.crdownload
Size 11.1MB
SHA256 bd1ed97f6a42afa16bbc52673693948609fd1c8e19b8a46318b5fd16fdc82312
MD5 ad2d6cf5f5ce9c7e8fd8b1efee496b7b
SHA1 d984d4a42597d6b21f5fe4b81c8c6f74ab9988ba
SHA512 5c1784ce60563d92351a9950d8c2a87783f3a01a2d2318d5f3495cb90e53362dd9f016f0c690ac9a7498210e095c6817594f28867d01829cf4725501f16a6eb5
SSDEEP 196608:ncvqr7AWP91DFBzDhRnU7XBIsZMhVEx7wuyBb5p5mIFUJ4if7+fnM8EQUtFKmXrs:n/r7NBTh67XBIuMhix7wN95XpKtqPMD0
TLSH
T183C6125AE233B34429BD86029DC09D081740F65E1D228D7FA63EC791F2233577EA676E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-20_09-19-42.mp4.crdownload

Path C:\Users\Admin\Downloads\2026-05-20_09-19-42.mp4.crdownload
Size 13.7MB
SHA256 05eb4112695e1694f56be68986f3bbc9f27454ef10832738a1c593f93266c2e2
MD5 fb0b92978001273297ab7cd7412c5b22
SHA1 26c57d98d6c60f8c839a62528a8135bd6e1bd2d7
SHA512 058123f8fea95ca40026fde7c1e554b3fec9a507ff31b72eb8094778b355654937a00b0e799ebfa0daa6b740ec22a74b2082e0e6ce0146055f8e227c667ae253
SSDEEP 393216:xVYTwYmTaZuxywsvbLbVwNjxFGHm7D4458R:L9Ymkc9sj3iNGG7k4WR
TLSH
T1D2E6333A69E8E0B3CDB02E3D5C37923531A97E540A6D97C32CDA338AD5F56D88CE6501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4692-333-0x00007FF8C7EE0000-0x00007FF8C7F06000-memory.dmp

Download

memory/4692-335-0x00007FF8D39E0000-0x00007FF8D39FA000-memory.dmp

Download

memory/4692-323-0x00007FF8C1D40000-0x00007FF8C20D0000-memory.dmp

Download

memory/4692-326-0x00007FF8C7F40000-0x00007FF8C8012000-memory.dmp

Download

memory/4692-328-0x00007FF8C7A20000-0x00007FF8C7B08000-memory.dmp

Download

memory/4692-337-0x00007FF8CDB50000-0x00007FF8CDB61000-memory.dmp

Download

memory/4692-336-0x00007FF8CF470000-0x00007FF8CF481000-memory.dmp

Download

memory/4692-341-0x00007FF8C78D0000-0x00007FF8C78F5000-memory.dmp

Download

memory/4692-346-0x00007FF8B65C0000-0x00007FF8B6805000-memory.dmp

Download

memory/4692-345-0x0000029E940A0000-0x0000029E94430000-memory.dmp

Download

memory/4692-344-0x00007FF8C2DF0000-0x00007FF8C2E02000-memory.dmp

Download

memory/4692-343-0x00007FF8C7EC0000-0x00007FF8C7EDB000-memory.dmp

Download

memory/4692-342-0x00007FF8C19A0000-0x00007FF8C1A4B000-memory.dmp

Download

memory/4692-324-0x00007FF8DD180000-0x00007FF8DD194000-memory.dmp

Download

memory/4692-340-0x00007FF8C1A50000-0x00007FF8C1A9F000-memory.dmp

Download

memory/4692-339-0x00007FF8C2E10000-0x00007FF8C2EA8000-memory.dmp

Download

memory/4692-338-0x00007FF8C2A20000-0x00007FF8C2C2B000-memory.dmp

Download

memory/4692-320-0x00007FF8DD1D0000-0x00007FF8DD1E9000-memory.dmp

Download

memory/4692-334-0x00007FF8C7900000-0x00007FF8C792D000-memory.dmp

Download

memory/4692-325-0x00007FF8D5580000-0x00007FF8D5591000-memory.dmp

Download

memory/4692-332-0x00007FF8D54D0000-0x00007FF8D54E8000-memory.dmp

Download

memory/4692-331-0x00007FF8C7F10000-0x00007FF8C7F3F000-memory.dmp

Download

memory/4692-330-0x00007FF8CDB70000-0x00007FF8CDBB1000-memory.dmp

Download

memory/4692-329-0x00007FF8C7930000-0x00007FF8C7A13000-memory.dmp

Download

memory/4692-319-0x00007FF8DD1F0000-0x00007FF8DD201000-memory.dmp

Download

memory/4692-367-0x00007FF8DD240000-0x00007FF8DD274000-memory.dmp

Download

memory/4692-366-0x00007FF73D940000-0x00007FF73DA38000-memory.dmp

Download

memory/4692-368-0x0000029E91F80000-0x0000029E92236000-memory.dmp

Download

memory/4692-318-0x0000029E91F80000-0x0000029E92236000-memory.dmp

Download

memory/4692-321-0x00007FF8DD1A0000-0x00007FF8DD1C2000-memory.dmp

Download

memory/4692-322-0x00007FF8DCAD0000-0x00007FF8DCAFB000-memory.dmp

Download

memory/4692-327-0x00007FF8C1AA0000-0x00007FF8C1D36000-memory.dmp

Download

memory/4692-316-0x00007FF73D940000-0x00007FF73DA38000-memory.dmp

Download

memory/4692-317-0x00007FF8DD240000-0x00007FF8DD274000-memory.dmp

Download

memory/5360-394-0x00007FF73D940000-0x00007FF73DA38000-memory.dmp

Download

memory/5360-422-0x00007FF8C2DF0000-0x00007FF8C2E02000-memory.dmp

Download

memory/5360-421-0x00007FF8C7EC0000-0x00007FF8C7EDB000-memory.dmp

Download

memory/5360-420-0x00007FF8C17E0000-0x00007FF8C188B000-memory.dmp

Download

memory/5360-419-0x00007FF8C78D0000-0x00007FF8C78F5000-memory.dmp

Download

memory/5360-416-0x00007FF8C1890000-0x00007FF8C1A9B000-memory.dmp

Download

memory/5360-417-0x00007FF8C2E10000-0x00007FF8C2EA8000-memory.dmp

Download

memory/5360-412-0x00007FF8C7EE0000-0x00007FF8C7F0D000-memory.dmp

Download

memory/5360-415-0x00007FF8CDB50000-0x00007FF8CDB61000-memory.dmp

Download

memory/5360-414-0x00007FF8CF470000-0x00007FF8CF481000-memory.dmp

Download

memory/5360-413-0x00007FF8D39E0000-0x00007FF8D39FA000-memory.dmp

Download

memory/5360-411-0x00007FF8C7F10000-0x00007FF8C7F36000-memory.dmp

Download

memory/5360-410-0x00007FF8D54D0000-0x00007FF8D54E8000-memory.dmp

Download

memory/5360-409-0x00007FF8D5570000-0x00007FF8D559F000-memory.dmp

Download

memory/5360-408-0x00007FF8CDB70000-0x00007FF8CDBB1000-memory.dmp

Download

memory/5360-404-0x00007FF8C7F40000-0x00007FF8C8012000-memory.dmp

Download

memory/5360-403-0x00007FF8DCAE0000-0x00007FF8DCAF1000-memory.dmp

Download

memory/5360-402-0x00007FF8DD190000-0x00007FF8DD1A4000-memory.dmp

Download

memory/5360-401-0x00007FF8C1D40000-0x00007FF8C20D0000-memory.dmp

Download

memory/5360-400-0x00007FF8DD1B0000-0x00007FF8DD1DB000-memory.dmp

Download

memory/5360-399-0x00007FF8DD1E0000-0x00007FF8DD202000-memory.dmp

Download

memory/5360-398-0x00007FF8DD250000-0x00007FF8DD269000-memory.dmp

Download

memory/5360-397-0x00007FF8DD270000-0x00007FF8DD281000-memory.dmp

Download

memory/5360-396-0x000001FEF69B0000-0x000001FEF6C66000-memory.dmp

Download

memory/5360-395-0x00007FF8DD290000-0x00007FF8DD2C4000-memory.dmp

Download

memory/5360-418-0x00007FF8C2A00000-0x00007FF8C2A4F000-memory.dmp

Download

memory/5360-406-0x00007FF8C2B40000-0x00007FF8C2C28000-memory.dmp

Download

memory/5360-423-0x000001FEF8AD0000-0x000001FEF8B7D000-memory.dmp

Download

memory/5360-405-0x00007FF8C1AA0000-0x00007FF8C1D36000-memory.dmp

Download

memory/5360-407-0x00007FF8C2A50000-0x00007FF8C2B33000-memory.dmp

Download