acd7c23c1fae8c15a7719aa575ae43e94fdb1ec6bced6f9318154417e0feff87

user interaction
yes
max time kernel
117s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/09/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
delta-client-1.0.0 (2) (2) (2).jar
Size 8.3MB
Sample260910-wqeqlatdkf
SHA256 acd7c23c1fae8c15a7719aa575ae43e94fdb1ec6bced6f9318154417e0feff87
MD5 6e15ab109e09905b36668475c5b0be08
SHA1 136e9c8104d6af5faec8e5f0e3d91d1c9b2ac50d
SHA512 656337dbccccc06dee56c3c303f449c04e8b6ee0c4e6167da729728e5994d51d4070e8f189f2411dd96a9cccb1e670177efdc571c339393b4d898988377dadc6
SSDEEP 196608:vOdB+KhObNviaJKJ7D1wwkHX02cS9ZzIb7JlsgQsIMQDQ:CbhCN6aUJ9wwkE2cqZUbNpQds
TLSH
T18B963315BEA8C42ED01B58726101E1D3BE1CA3DE8501B42F46B4559F8AF2D9B072FBDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
150	raw.githubusercontent.com
149	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2376	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335372502757923"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4140	4104	chrome.exe	87
PID 4104 wrote to memory of 4588	4104	chrome.exe	88
PID 4104 wrote to memory of 4588	4104	chrome.exe	88
PID 4104 wrote to memory of 2376	4104	chrome.exe	89
PID 4104 wrote to memory of 5408	4104	chrome.exe	90
PID 4104 wrote to memory of 5408	4104	chrome.exe	90
PID 4104 wrote to memory of 3820	4104	chrome.exe	92
PID 4104 wrote to memory of 1960	4104	chrome.exe	93
PID 4104 wrote to memory of 3820	4104	chrome.exe	92
PID 4104 wrote to memory of 1960	4104	chrome.exe	93
PID 4104 wrote to memory of 5944	4104	chrome.exe	94
PID 4104 wrote to memory of 5944	4104	chrome.exe	94
PID 4104 wrote to memory of 3444	4104	chrome.exe	95
PID 4104 wrote to memory of 3444	4104	chrome.exe	95
PID 4104 wrote to memory of 5512	4104	chrome.exe	96
PID 4104 wrote to memory of 1480	4104	chrome.exe	99
PID 4104 wrote to memory of 1480	4104	chrome.exe	99
PID 4104 wrote to memory of 3328	4104	chrome.exe	103
PID 4104 wrote to memory of 3328	4104	chrome.exe	103
PID 4104 wrote to memory of 5244	4104	chrome.exe	104
PID 4104 wrote to memory of 5244	4104	chrome.exe	104
PID 4104 wrote to memory of 1628	4104	chrome.exe	106
PID 4104 wrote to memory of 1628	4104	chrome.exe	106
PID 4104 wrote to memory of 4404	4104	chrome.exe	109
PID 4104 wrote to memory of 5064	4104	chrome.exe	110
PID 4104 wrote to memory of 404	4104	chrome.exe	111
PID 4104 wrote to memory of 2748	4104	chrome.exe	112
PID 4104 wrote to memory of 2748	4104	chrome.exe	112
PID 4104 wrote to memory of 4600	4104	chrome.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\delta-client-1.0.0 (2) (2) (2).jar"
1⤵
PID:4732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff86500c728,0x7ff86500c734,0x7ff86500c740
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1804,i,15504349869011505059,18036131945254553303,262144 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,10911657580555557080,1216032780772628871,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,15974195648649102694,3088434968423535867,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,16991823928514084087,13508956848043227322,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,591141570483468953,15529861915857308921,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,1277579066327870275,7872202444113883212,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,12690056369566001239,3048529895366307398,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,9358226997193129227,314200833832222659,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5456,i,11326934462180653166,1844455129927359347,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3452,i,8208799063686664532,10769019077984321706,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,14025723648924174078,1896418277743578153,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3536,i,5665820692559314634,901410550666212950,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,13113088456909793137,10166116224514467319,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,3792546401203007529,16039568648322767672,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,18204655442512091551,14644372405703584254,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6084,i,12976997552862031832,4156570003257965981,2097152 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,11060585371529177792,14737912585754964470,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6104,i,6854944958182332532,4200134399650881361,262144 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,3748759855860608158,15048204539612795384,524288 --field-trial-handle=2012,i,1828368804319044854,13854900773753698060,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3940
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  PID:5880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 adb7a3ba25815fcf34032219919e712c185dd07dce08ed84d2fd922dd4d64281
MD5 c7eafbce28a61430c22d23b517de7378
SHA1 0ddec7e5cfdd46412f59604f5f673a4caa8376b2
SHA512 078ae1d08e98ce341d78ce708a77203c2f242b3110c54c03f954ec7801da1372397b8dd4b672740d2ec32c78c5a8656378a7a454cf3cb553452fab6702b5d9e2
TLSH
T129E02BE9C972EC3B18FE4B2910544787EB5113476650854F3B3D810ECFF1A36454581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 1957e2537b1a6c9a85e71cfe3adf1566b7c396a4ecaf7742e13c088d355d28ba
MD5 552e75eec0166ce12b655fd3b5113994
SHA1 3325768641faf3dac95e153782b1e48dfc6d0241
SHA512 09bb5e0586f35bacda20a73f93b02e800881d480feb674a0f539e2d7341fe57b56fd0b97a5c8e316664c59c853577299cc89403f116193cacfea3be2269e9a3a
SSDEEP 96:vqD4Hc+UVFqTkD3mpaUVAaE3xSemnQlg70SyWWuDPRmpqnzumQDel4OxaQScdUdf:9UaIg7sriAma8lmD
TLSH
T172B10985D02986BDF7488C34D7F9C953F335E60709D3CF03174EEA76A549B629406189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e704e94a55c6fb1cda323ae2bb5a4c0fec8a2fad646d7c7412641275f4cce1ef
MD5 44a12e92f32f1d31be75193caa39b292
SHA1 5888624ea5e3d993fdffcb2dcc3581d1a38998c0
SHA512 12be6a2538f86b061b996284c6f9e7a690d631974337c59b5d33cbae256b7fdb03bc91aa8b928f666ba55fdf0e28137c65592679d7dead55d9c7cbb4b0f99e5f
TLSH
T115C0920658911526EB1582B029A69CA4376A3A2305A1474288B5E68A78B7AB15222AA6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 80KB
SHA256 3a074082866143dcc7c3fe1108c554bdfad331b9ba9610ed419fce5897cbb349
MD5 ac9825a894c26c3ecd88cad106c9f0d7
SHA1 2155425204ffad915f4ed3205f1cf453149d70bd
SHA512 fe08bc5a3d94af93e9c6eb2b6fa171dec7f3f544c2699b1d2ef9fc17fdd801c8935535a490dfefa6056c73201e1bf24c7af9dfc2b188f1143c599202c6370145
SSDEEP 384:+JS3foCHtedjO4fOuDjnzhbY7VEL5r8ifb+ODypJUj9LWSwVoNFsic0NUmG+prlA:Lkja+KhlbIFCiVxjKd
TLSH
T130831F98B6FF1426DBBE4B1D7CFE31A4C8B3B6131C58C84930524CAD0576792982FB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 ae7d48e97d6be7a35e92285108b291358d247f6143ceac12d921fb125fabc408
MD5 c83d6efdd0bc2b068870524c9095f54e
SHA1 d495c8c60b3d57db7f5dde968817d1e45e8135f7
SHA512 f7570134eeea2ed3904c07cd6d5f75143b98250e6648e686e48d8148f8be423ab97c5326781607b872e9e049a928b80a0f028b61550429534c72048247dbf1ec
TLSH
T12DE0C05841C98D5F1145807755307B0FCEEA270CE7CCBD894F42E41470C680844AD321
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 0a32eeb0603ff8fa6199eef9ce4cb19849dfe704bc677029f48ba983cb7e55ed
MD5 edc97fcb066f4b36f0cc22e5e1fef3a3
SHA1 f653cb9a2e8cab10cabfa8f10e4963b834107c6b
SHA512 cab018f58a2738428c28ff7091caf561792ff7ed9a20d68bc950d2dda11370478a35bea740c7f34c591d8be34f7af9cfe5a6c898f5503e911625528a7a87a632
SSDEEP 192:D4Pe73SkEmbmWNaIMrbvoGQzyI1NPhWOm9JL7gmDm3HmtmgmDme:D4Pe73SkEmbmWNaIMrbvoGQzyI1N5WOF
TLSH
T1EA02DFF7C3E5862DC91256F59B25AF1FCE290A24531C3C66C8D8BE4B93E2872D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 da16a790fa613077d99f20b7558c8b5420434a313a1daaf93d94d296900b74d3
MD5 47a2196b2b4d2c482b0194f1855d391c
SHA1 bbc9f70d8d38749e132ef259f6af9f597ff53977
SHA512 affd86ab0e7427917dd47b769d2fa8ee1227967ded35fe65be4900c8cfd5d04262d556a2c3a31e5a15694a42daefb9cf58fdad13d53bbadaa7978bf950feefed
SSDEEP 192:D4Pe73SkEmbmeaIMrbvYeGQzyI1NPhWOm9SmgmzmNmu:D4Pe73SkEmbmeaIMrbvYeGQzyI1N5WOT
TLSH
T144E1CCF7C3E9862DC91256F4AB15AF1FCE290A24531C3C66C8D8BE5B93E2871D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 97030473b7f29462dafa4490eae9cf0c1bd7ce834ca6412372000e28ead8e8a9
MD5 90ec0690ba1bb5ed39096205b318904b
SHA1 1ed3ab517a67808401a5d39f120139e9a80c7852
SHA512 8b46179ec9048c07ba742554af48d9f1834f2441ae53bac268b8db1226c0a3b0a70d76422661ef1f8a04444b617470d9af2632839245996ceeeaf6d13fafb722
SSDEEP 384:qoRUjCmh5SfKsn69rGZOI0JXzeO9Zpv+xwGtNeLIArGrE3vVw6e:7mhAS61xw/A
TLSH
T1A562B62AF950297B5CDBD22AF9217BA7D7F6102131A82E84EBFC892C15E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 de0b135edd6a435d20bdb34ce5c764aa2254e08e940840f5a0befb7563ff6325
MD5 d520f53f7043ed0420a6ceab26e6f87c
SHA1 64748127cbe4467e5e124330fe2a36b52a0b9378
SHA512 c02a90a15839ab51905ee01a3657c38176a5aef62218af77573511cf2cff6cf73597da07719d5bf7ac1c2af0e54bf41d9c08454f942dfa139e4e206da0c280b8
SSDEEP 384:qoRUjy5SVKsn69rGZOIUXmrPxwU3MJ2b231VM78:n8S6zxw7r
TLSH
T17252E82EF910653B5CDBD21AF9217BA7D7F6102131A92E84E7FC892C19DB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a71a7690ec86419fb765610f298a8295202948ecb1d51beda72bcf41dae6ee17
MD5 64020ced4212e670cf10b5a18ab48354
SHA1 84c403e39cc5cf88644a2fb25a7e28e041146955
SHA512 b285cade10cca3e277aaac4cee96af4c8ec2ba2737f9fd5bc972503a02603a7dd50fd1a736ab260dfadef5e5dc39dd419a163d0a3da4e07994c99f5756d2e38f
SSDEEP 384:qoRUjCmh5SVKsn69rGZOI8XcO9ZpB+xwGtNeSGrE3IVM7e:7mh8S6Hxwoe
TLSH
T12852C72AF950297B5CDBD21AF9217BA7D7F6102130E92E84EBFC892C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a3d343348b14aaf57f7be3aebf0061f4f81bceeb0e24488e362ead6013d31379
MD5 a82db9d835fb51b2f9b4566a63584cdf
SHA1 f7a73e4c8ea9cb10872dc6b8096006e9bda8574f
SHA512 96c71f612619325b8db7af203db4ea05db3ee9c02e20e0a53b2f54e91742b88c00fabda439b444a25d800238d3619ac54da3ec7e3d4f90d41034851861a7953c
SSDEEP 384:qoRUjy5SVKsn69rGZOI8Xmpfxw+iNeSJKW3KVM78:n8S61xwBK
TLSH
T15E52E82EA910257B5CDBD22AF9217BA7D7F6102131E92E84FBFC892C15DB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 802e9731416dfdde734a8c32f9b3498a8e31bd2c38f48aa230a91669dda7d98d
MD5 474334982331e518f7838e3a6ac4dd31
SHA1 1973b89cc10dd3526936b57957d19ff668a8cc0a
SHA512 39ef8891d0bd7543d4dbbbc01474f26a7f3bbad22fdf03d701305ec2f04cb21fa591f772d4ae9b084aca0d6fde9bdf11aaee5e34a3049fcca670bc167fbba07d
SSDEEP 384:97j3e7KxkXqKf/pUZNCgVLH2Hfgsl3z7pLuLcSjJ0XOD3a+ErU3klHGu6p2gAR:933e7KxkXqKf/pUZNCgVLH2Hfgs9z7ph
TLSH
T1EA72E8677C4C9A770F94C9CCD826BB4FADB6014A65DDD85883FA982503D6BCB01061F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6fcf48a7ab533bb6ee88e32c1b3534967b2e6ffb1dd1b9750d7aa61a0328e876
MD5 9cc53cc0df9c9f57d2cf6ee67a402386
SHA1 6dcc16a80b08147079dae80f969a02853e39b953
SHA512 26eccf20c01dde0072476304e7f9c6fbfdaa2e865c2db829bd1f693eb52f8d5c692a85b6c99b7dd7c74c9a06a9c1b8729167252d2a0916b5774acb4aea2896e5
TLSH
T177B01200C0039121C04602B0174614C872145F10960A2B0763E4B933FC39262C018091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58913f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58913f.TMP
Size 96B
SHA256 43b41513c0cce99e066d9a3bb1a68b086e395232dbb68f2bb65796fe07828ba1
MD5 0e974c75570a49773257976ab2c7cacd
SHA1 eddee8fb7441f7046340239a683ef36e604d2749
SHA512 5b31233d1eff98c5e5739a4a339c3e7e32b40a848d0fa0aae9c24debcdf07e7ded26d849c0bd140f60aa2802e80f3b904570dc876618695e5e88a674c131094c
TLSH
T1A6B02200C002E332C02203B0E080A0C83230CF20C28F0303C2E02E22CC3823000280B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8317e7facdf725f5eb3199976160b2d6aac416d92cf98bc65c64cf2a1d66a6dd
MD5 cfd3a84369f79039e23b7187fcd4650b
SHA1 095d9807c86015362695f4b97d09074bce93df80
SHA512 8230c8e74b55cecfcd28b9dbb4128f130d1c9e4ab2b734b102cad05cfa07c5dad5d12c04129c05024b5c3f5702a2325f2c9ab5955b00a8b00beb219957211a4e
TLSH
T107A002A295845251D1010271E39141F1B310BE6143930F8180D64488DD95987920A200
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 0d0f979d132bb6e2f958cb5213aec8d1777551c05173f6b2d95666422e0d5615
MD5 6fb6c398ebc09de77cd6ca339a713680
SHA1 db888fb66b4718dfc3eb8e4b352a6d132898c969
SHA512 9149c801804cd7391003550d2af31350feecad38b42c57dcec058b7630bb8e3c33687a1350c2de70665fdccfc9d667e072690c7c769c55ccd21c9bb64b0f0cd5
SSDEEP 6144:sOYAs0GZu+ZZAKvP7MH3LfqBZqenbyyVEd1cB1s:EblZAK37GLCVDuens
TLSH
T1D8341222E866EF1BD2B9DA3B700E751A0EE069E794D0E7CC515C2758F0DB388CE62D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 60c0e526bbb0a3cfe6c7bb773121b55c488b259e0559a9e9fe9f7d7cc02e430d
MD5 c29e40cd9d25a9b7a2023a3167a368e1
SHA1 56e60168ad0189a113ca113726f98a1023275403
SHA512 16cfd94d7dfe8b0389dd65a3837fe055b21ba07c55235b65e38b064670cd8c2b7fbabca37d8cf794ebc3330d46ffa73d5a970c49dd8de07dbadd62a9ba7721bb
SSDEEP 1536:XlwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+y:Vw3LffUnBKU/F8enCW3iyVEXGey0cB1i
TLSH
T119B31331E596FE6BA369562AB40F93281CE249FB44E1B788447C3F19F0C6288EF59C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 8ec1c381c0173819ea8d716f88ffcce2d030c5c817c100f9ae303fa2ff30f4fa
MD5 6f40b94525745b6b7a49e3d05259f5e3
SHA1 e9d95ce53eb72a30147a9ac33050032305ff12f5
SHA512 55642195dddc5b0bda6ac53b92ec8d5002317b3ac12e681267006861059f7e8883b029e96eff44a794289dda09c2cea01454ecfed507bfface1386cfbaa56108
SSDEEP 6144:iYAs0GZu+ZZAKvP7MH3LfqBZqenbyyVEd1cB1s:VblZAK37GLCVDuens
TLSH
T1EC341222E966EF0FD2B8DA77704EAA1E1EA068E754D0E7CC415C1758B1D7388CF62E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 34f20415d0898ac11a82b64c335ac54eb2f453017e6fcc79e9cf137cea40fda5
MD5 8b1707506b4354ca0f2b5417c530103d
SHA1 7060069312b7e5f5c43f4eee8fea42d3dd3f3f0b
SHA512 1fd1a64725426fbe3a55bb42d8c842222d472cf3abd99463d19e108b47fbcf262341ad85a21875a0f763cddb2a67b4a56d169b21a8068d179d9b474a9bdd1936
SSDEEP 6144:/YAs0GZu+ZZAKvP7MH3LfqBZqenbyyVEd1cB1s:QblZAK37GLCVDuens
TLSH
T1C5341222E966EF0FD2B8DA77704EAA1E1EA068E754D0E7CC415C1758B1D7388CF62E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f.zip

Path C:\Users\Admin\Downloads\86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f.zip
Size 277KB
SHA256 c3ae24dd6b0e570611ea13b4f24e3b50ce0c6906c9ce3ba72105e4c91a660b1c
MD5 57b74cedb501ecda4ffa647d051ed167
SHA1 f04fd9bfb224664060245934305bec4ce2d26ce7
SHA512 eaaea014ca91d459a89a6f1544617f3cf3801521187fe757b08144125fe02ecd880e03726b28e32139bb752dbd52ec4133f707bb8c84e8a9ad26da54353a4d6f
SSDEEP 6144:0I4mxYxI2OJ61mAYUeC5AfWy/QMmAM8tC5Hwku1kinfuiDNWWbIWm:0InaHc41AfWy4MmA+5QkSVnWiZWKIWm
TLSH
T1575423582AD926406399F721B3E37AED8CE12EE0A7D588142553D1BE970035F6C2FF4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoldenEye.exe

Path C:\Users\Admin\Downloads\GoldenEye.exe
Size 254KB
SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
MD5 e3b7d39be5e821b59636d0fe7c2944cc
SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
TLSH
T122448B0D7990E92EC4B222719A38E7D2FD3B79314F24919FB7C4695DACE08C19938B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4732-2-0x00000201EE3A0000-0x00000201EE610000-memory.dmp

Download

memory/4732-11-0x00000201EE380000-0x00000201EE381000-memory.dmp

Download

memory/4732-12-0x00000201EE3A0000-0x00000201EE610000-memory.dmp

Download