d919fd8c8afc891d35186cd038fd9720cfbfb8f31b294512c38e69a672a32f70

Analysis

user interaction
yes
max time kernel
959s
max time network
955s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dsadsa.txt
Size 585B
Sample260916-18b5msgk3t
SHA256 d919fd8c8afc891d35186cd038fd9720cfbfb8f31b294512c38e69a672a32f70
MD5 d59b19d64b31fda5607cea555b24022d
SHA1 bf7ae3d16e8e5e231adaec8d87a2f52e230b3360
SHA512 2351b8bc963e52f45689db49b6c1267198c81224e4578d4b1c5a4e86d72c2b3e05ff5f99727413d8cee124c32d4f5dfa00cfd3d782ee332992fd82a9a56f5182
TLSH
T189F0E7F604E7709FB411B6D7A845E1447D6FC03CAF5E921778140DDD12F11385B2811C
MD5 SHA1 SHA512 TLSH

Score

5^/10

discovery execution ransomware

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2840	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2548	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340707465699521"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{FAB660E1-FB8D-4D12-80F7-C48FFC8EEC95}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3200	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
1448	chrome.exe
1448	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe
Token: SeShutdownPrivilege	5692	chrome.exe
Token: SeCreatePagefilePrivilege	5692	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe
5692	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3200	2840	cmd.exe	81
PID 5692 wrote to memory of 5096	5692	chrome.exe	84
PID 5692 wrote to memory of 5152	5692	chrome.exe	85
PID 5692 wrote to memory of 5152	5692	chrome.exe	85
PID 5692 wrote to memory of 2548	5692	chrome.exe	86
PID 5692 wrote to memory of 4196	5692	chrome.exe	87
PID 5692 wrote to memory of 4196	5692	chrome.exe	87
PID 5692 wrote to memory of 5628	5692	chrome.exe	88
PID 5692 wrote to memory of 1324	5692	chrome.exe	89
PID 5692 wrote to memory of 5628	5692	chrome.exe	88
PID 5692 wrote to memory of 1324	5692	chrome.exe	89
PID 5692 wrote to memory of 2816	5692	chrome.exe	91
PID 5692 wrote to memory of 2816	5692	chrome.exe	91
PID 5692 wrote to memory of 4460	5692	chrome.exe	93
PID 5692 wrote to memory of 4460	5692	chrome.exe	93
PID 5692 wrote to memory of 5092	5692	chrome.exe	94
PID 5692 wrote to memory of 4160	5692	chrome.exe	96
PID 5692 wrote to memory of 4160	5692	chrome.exe	96
PID 5692 wrote to memory of 4588	5692	chrome.exe	97
PID 5692 wrote to memory of 4588	5692	chrome.exe	97
PID 5692 wrote to memory of 1792	5692	chrome.exe	98
PID 5692 wrote to memory of 1792	5692	chrome.exe	98
PID 5692 wrote to memory of 3656	5692	chrome.exe	99
PID 5692 wrote to memory of 2072	5692	chrome.exe	100
PID 5692 wrote to memory of 3656	5692	chrome.exe	99
PID 5692 wrote to memory of 4012	5692	chrome.exe	101
PID 5692 wrote to memory of 2332	5692	chrome.exe	102
PID 5692 wrote to memory of 1136	5692	chrome.exe	103
PID 5692 wrote to memory of 1448	5692	chrome.exe	104
PID 5692 wrote to memory of 4876	5692	chrome.exe	105
PID 5692 wrote to memory of 4876	5692	chrome.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dsadsa.txt
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\dsadsa.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff8e582c728,0x7ff8e582c734,0x7ff8e582c740
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=596,i,16878260492932341783,11606296580600918697,262144 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,11106761698265575663,9012887348837073218,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,7260705765400354580,16373363950030039351,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,16518294710537236850,18097041720300474953,2097152 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,2194575252456916559,15958898566217453021,2097152 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,4374191140550143521,11162945203360726845,2097152 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,6545502202265726514,1923732922749262798,2097152 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,7654693535698005749,2766808931896831744,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5912,i,6227618459432209589,15529896039016849017,2097152 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,17444578345689605219,18055726556198737728,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6232,i,13020560165498132532,8601222347332751688,2097152 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,8417136751786760552,12794848547893077671,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6416 /prefetch:12
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,9177561695131261870,10000590970506906113,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6828,i,18246681796555140961,10880235500654628422,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,11660702034372573471,7288462943716579934,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,5632394136678008413,6932861656414127560,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5684,i,1873419649576542075,689376849313927211,262144 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5996 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4348,i,3721917599594284550,14644968292002173216,524288 --field-trial-handle=1948,i,2495394936932864212,7889957561206021605,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:4876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dd397b76b56e4e107d7df8fbf211bf930dd88b63a2ca79b8c7f7076360845c09
MD5 25c1c4f1c50794644f232b6a9d12c656
SHA1 487643d11e5144f017131fbf6bf9b00427485970
SHA512 3c8faab8c138ff790e2491edc4f360bf9dd30968ee10a98ca36df27eeb3cb7eb745594c4f6305076cd1f5c60d04a1f090c540dcd6900dc3d875ce6d3b8175b85
TLSH
T10BE02B69C824FC3708FE075C60544789DA4063172751459F3A3DC21D8FB163757D9C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 1359255efa7768a839ca231a65b7550b4b79c4731332f99065cee33c88cb1ced
MD5 98b1b08957da24e575136176adc609d2
SHA1 50bf9e5a56c937d697696191320fee87eec7fd31
SHA512 2ba24c45d0b727b3c32cb0ce18a214a0e0497246da964f1e056d77373d32d892c03d821a2cb89fae1617c62f1c9777db35df9221d2c12bb1a55b2448471c5e1d
TLSH
T183014C88E6C02640DBAF3176E4A358DC7D35548C0A661F5FE94B04FCEC1FFA1D921866
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 7f5bdec0ca34565b8274cba269228f678e297904a0a52503fdacf24867e73863
MD5 5ffed4ae3b785ffaf6631d20ee56c7ea
SHA1 1e3130ddc1395a095429735a6a2d4cbcc41b6066
SHA512 c6befe1345f8269b4e34addfc753611604230b0dfd79e22a416a88204d137198f791cb64ff80a201e331e2eda75168bea4876ee5eed8e3c6873ba5854800c907
TLSH
T171017D8896C01640DB6F3136D0A314DC7D34908C0A521F9FE95B04B9EC1FFA2D9618A6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e081e963e0eaefc898d286680cc708be8112d1ccf6aa1e784bfb48d938ee8c1f
MD5 572dd23cf09ca07bf615990162ff39fd
SHA1 43f8f29465351d3c9eabe0d6ebf4c32db25be27a
SHA512 57181bc2d9b35ae9aa933a4e7dd3520735cefb411837b6e5a6ef297df9375b713aa483c7ad9455821de163a7a6642cfa491d2976d1ac2c3871ae941a399304d4
SSDEEP 192:DfWu6WMBKSd9LeCs5RgQsebVt59QmNL/zf/E/K:DfWu6WMBKSd9LeCs5RgQsebVt59QuL/1
TLSH
T1D4E1CCF3C6D9872DDC1116F56B283E1BCD2D0D5852193D168CD5AF8F93E28B2D25068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 99c95eb5a892181cb1ad6eac796952e0b816b9f150b9fb3840c2e03942ec9e63
MD5 c68ed9fa81344de789c7bee8d90a24e6
SHA1 643086b817303ec27b54f86851f5a4b2886a61c3
SHA512 ab0f1248aeba662e1897bbda3132158aff3c7ba49b4dcaa2223ed8befb999fc68b6db8a8f6bbeeba31547f9f650994ec5a96d1d4d07d2b2dd6a9615fe46a6300
SSDEEP 96:DBh1krz7pvZdEQLLezusiENdsfmbVdNslZMbPAVFjhN9K:DBh1krz75ZdEQLLeCsiENdsebVdNsXMl
TLSH
T102C19AF7C7E5C76E981156F4AB187E1BCE2D0928432C3D268CD5AE4B93E2572D24078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2d56c9aa2a3313c34e4706fc51681e139652dfca2b51d8cf09bef300d09a4ad1
MD5 57ef8782de6be425cfdd06b0cde9e613
SHA1 59682a051cb436409b404ae8c0a9a9fb8758a8f8
SHA512 3802b860f0a8dc57e3ce895129cb284673cbb4e2724ffb8d0b338dc6a847ccdaf6909baa2defa5596ab1b78fdea24977b483f29bc1371c9964cade08b6864d02
SSDEEP 192:DBh1Hkrz75ZdSaLeCsiENdsebVdNsXCbP1nFjhNX:DBh1Hkrz75ZdSaLeCsiENdsebVdNsXCH
TLSH
T14CD1ABF7C7E5C76E9C0156F4AB187E1BCD2D0928422C3D268CD5AE4B93E2572D24078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d577928389b55f90d7d0059c58b3d493bc49adcfbed255ef17688c0f2d0622de
MD5 4fa4471c3c8c38a433c4f73cf39f1532
SHA1 20bfbdc84453dbfaa22a1768949a766da2c23bdb
SHA512 98b4a593aa3dbcdf7b202b942cd69eec3f02b94498ccb34a60d0ec60d16fc43d0d3f49005197dbf33cd3db7c655f2c7ded972c9670051c4319152f2c4094a762
SSDEEP 192:DfWu6WMBKSdGSaLeCs5RgQsebVd9C1vkCGUPiK:DfWu6WMBKSdGSaLeCs5RgQsebVd9avkY
TLSH
T187F1DDF3C6D9872DDC1116F5AB283E1BCD2D0D5842293D168CD5AF8F93E28B2D25068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 30ac7923955aeef877c08ceab3d06dd76b53ec1fcfffe059bc6727a69c5e4cdf
MD5 643664c259429e45c35959276c686538
SHA1 4d26ea7b987d17884c13f0119b485beb391324db
SHA512 c7c9aed3c2e6993dcd92ea9be5475d830b4bb6728d659a721a109dfe5f3e9c09a80574e57fdead52c830ffb130ece5320b06460cbd93bade32191890f111d6be
SSDEEP 96:DBh1Hkrz7pvZdEbLezusiENdsfmbVdNslZMbPAVFjhNWK:DBh1Hkrz75ZdEbLeCsiENdsebVdNsXME
TLSH
T11FC1AAF7C7E5C76D981156F4AB187E1BCE2D0928432C3D268CD5AE4B93E2572D24078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c7c6bc75f3b507ec726e4232b973b7070d4d873a7b19b7e7320fbdcbe3bfc4de
MD5 d542aa6d60ea7ffa2c0d9e4e2426af0b
SHA1 3f9f610f1f2658ea2697b52b43dfbc514f6ddd87
SHA512 20b4ed6f13e300adf80a7aad17ff7569b598d082b5456ca958c459ebaa0e34fa33164e18d474539683d094fd76d28e93b5a0325844d011dfa886b2a19fe249e0
TLSH
T1F531AF63577EB85B707E49AB1D54790A2D7AAC34018365F4DE6A823CF0816F71713027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f3e140bfa00a68353f5506addb79f05ebf63b8cbcb9c8603d49f0a214f94cefb
MD5 1ecd5e5f112e618d232401cceda4d1b6
SHA1 802ff5802d1bfe09f384a84cb4e220bd1f8c3f9d
SHA512 b81cafc43141559fc96313e6b5f4c184714fb698517e2306efa7f9db3415ba5255d6ace9249f89b63d3486e0f98d36fac6c240c2df8ea6ca3ab37fe338485dc2
SSDEEP 192:CRMwcOXsWWhv7bpAPRp2X8lj9/Hsb+WNnmcrfd2DJeOVyIsnAUgtaJ:CRMwcOmxPUX+etwJB278
TLSH
T1DF42B32DFD18BA7B5CDBD229FA25BB57D3F5102160D42E84EAF8892C10E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 285ff8000252d4ddd67306cc409447dcb20bbbcc95652c13e3bfcb0cf5f7b688
MD5 1d61b1f559d01d737ee83b1a3f72af4b
SHA1 2662e3618e35752a609f7a538331c569754f5ef1
SHA512 911ca5c1307e449f694f6c439d2c290ba2dc9e9cdb00e8f7e8e77013e5c93c48a6e7130c30f647d1bd4e3709666f869a79e486a314b4c84af54f08c7bbc3f240
SSDEEP 192:CRMwcOXsWWNv7jpXPRpTX8lj9/Hsb+WNnmcrEYO9Jem8yIsnAUgraJ:CRMwcOmtHFXjetwJ7O2e
TLSH
T10C42B42DF914AA7B5CDBD22DFA65BF56D3F5102161D02E84EAFC892C10E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aff4a6c607d31ad1c10e9d54118f835907693924bbd276be8001c49a18e9ab79
MD5 8581de69aec8980680cd7cca6fff402e
SHA1 806a3cb3d2a14c6a54ab052c4aef4b1b6d12d8ac
SHA512 eba03b0096cb5fa5ab483b3ee42a8842531d48aaf5b144efe13548574ee3bd456f778b3c35d3485e2c78c6de6524fa67af562957d961528a2a6a7f40aee95e44
SSDEEP 192:CRMwcOXsWWlFv7jpXPRpTX8lj9/Hsb+WNnmcriSyvJem8yIsnAUgraJ:CRMwcOmHHFXjetwJzy4e
TLSH
T11B42B32DB914AA7B5CDBD22DFA25BF57E3F5102161D02E84EAFC892C10E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69b43a8895b90ccc3e0e9ce91c104a9fb0207a741afdfeb7118e959c5baf4d1b
MD5 f6d705a3e1a63db8b343e343b21c9247
SHA1 98803c10fb86151e8a444fc86730dc5ca2c0a856
SHA512 585982ca60b3a3760b9bf611df49a6be12e9be304c7a4ab56003cc04244786ac61d58d01fddde1f87f94e4060c3d31507a8ac8c33ee66f7b3882d33efbd0e3b8
SSDEEP 192:CRMwc+7XsWWXv7jpXPRpTX8lj9/Hsb+WNnmcriSyvJem8yIsnAUgraJ:CRMwcqm/HFXjetwJzy4e
TLSH
T13E42B41DB914AA7B5CDBD22DFA25BF57D3F5102161D02E84EAFC8A2C10E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 095cf63c5b1f44d4bd7c2f428946ffe3e49e629dc73ad39862674b3ab40db23b
MD5 91cce342990b296edaca2b73c04b15da
SHA1 1a2ed3b2b891810b4fbe618eda8e07b56b4afeaf
SHA512 36d2105f5380f5b4f7a620b1840ad2f73c251be9ea5c4d88f8780043ea216f96ca20abf1138186495ee1a535cc7ac427f0cfabad6fbff48621a37e187fc0c063
SSDEEP 192:CRMwcOXsWWhv7jpAPRp2X8lj9/Hsb+WNnmcrBPe7JeO8yIsnAUgtaJ:CRMwcOmxHUX+etwJ1ey8
TLSH
T19342A42DFD18AA7B4CDBD229FA65BB57D3F5102160D42E84EEF8892C10E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 de13521758ef1bfcb2d2450b3cf0a7a99cd0970c06b92340bd4289551bfc2ad6
MD5 b0928f3b5aacd381a50cb79484995d2d
SHA1 ba2f982a9d1dd6c557ee7a37adadea8daab8b737
SHA512 af3e8c9148f12d0e4fb4988464bd2a8f2df2e47ea7c5f1cab56fe717533c7f2da51919aeb6a09e6a8b95119e5735947b80bbd19844feb7e8ffa58cbd1ddf81e1
SSDEEP 384:Q2j8z7KxkXqKf/pUZNCgVLH2HfgslO07pLuLceSe/XOD8P+ErU3fKHGFwjj9B:Q28z7KxkXqKf/pUZNCgVLH2HfgsI07p+
TLSH
T1E47209676C4C997B0F98CACCCC267A4FADB5024B65E9886443FA5C2903D4ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e15a5d477fa539a7034184cfb67c29716ec4724d5feea2cfa3be0ec30f29a92a
MD5 a96662dde111633eef53fde26dc4d5c0
SHA1 c0b42d0d15c43be0f5cb8e63f42974c92572050e
SHA512 4f3a9f01da7f89996fd54a221f00516f7ac4f52d674f70e9490ccb9c82d6d69d5689f07278e30b4842a1b06d72cce28981c93d5bef60bc89cb77599e17e57eef
TLSH
T192B0120980512301C04603B12190A45837709F38F62253D542E00D4298315504017188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f807.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f807.TMP
Size 96B
SHA256 4ccbd9b2dcb8ad16cd24b86d11a7bd6a46dc23f7a0e7d34daf1107613a627b78
MD5 0c178d77188164b530dbd6836d21a46b
SHA1 c92c552a0e74217b9cb2df26ca9431bdfbcfd530
SHA512 6ea392c8df7918d08e0a5c94dbb4198783214d5e0365f3026dbdc769428a0830f57d3c773d87f052b3e40360ccaafe7c107ea2b31ed931164de7e551b7870747
TLSH
T1DBB02208CB03A303C00303B8288A82CC3020CF28C303020283E00A2BCC303A002308B8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\3a583ef7-e2b0-41fe-b3d3-283755421781\index-dir\temp-index
Size 72B
SHA256 abb71d9dc1e0d9473ccaa77a69512e5d91cb41826e163361058c85f2f11925c3
MD5 1eac2f7d4e3e030bd56827433047cc7d
SHA1 2f2eb611e826c71088ed1fe1d1dcfb3201ee4333
SHA512 c7b5aff54eec8ead385ccfc5cc169570d552f8dd0c0c91d41990a11249c205047a655e8860e17498429c373d6490740d4d3bef55be3e2bc53022e583b359a452
TLSH
T123A0025083CE3094E018157860455BA16B00CD5414005703C491018C9C911C4595121A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt
Size 95B
SHA256 6e1585392925d5190186652c5b936894d8ffc5f451f09931a6cdb1e96fedb94c
MD5 6d7ae8786f01835640a72f8336b9378c
SHA1 02bfe035bf9583a64f6ed551dce00286ba5148c4
SHA512 58bfa68172700f4367b02862da3bb868edb920255984eed92f632ef595dee88a71d72bbb9792faa86c66a2b112f2aa5a5c739f84dd662b0a8fbea6abb3e1b930
TLSH
T1AEB002BB0481A5C66FB139F7046573DDD57332DC5D81EF4D8576109536514BE1005C24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d23f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt~RFe58d23f.TMP
Size 182B
SHA256 2f9bd1681bd62887544c149c2fb976d91222a130a733323be361f44154389f62
MD5 eb75d5d6783af7ad644bb57d212c12fa
SHA1 cfead72dc6bcc80daf3ca36dca3c4e41a3ac5fb6
SHA512 45d3275dcb6837ad5315b6461c4489ba6c0ef68e233e72a53a8b4903306e9d915905822a29d47e1d4ae6fe8d85864247e31ec9ecf38e97157289362a260cd82d
TLSH
T172C0127710C0D6852F6428E65422B3D9C5363FF86DC0BB4C44257045217587A1019514
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 f64fd1e5430e53c93baacdfcde8df8d2009cf20b744c57d256e5266c6db5f319
MD5 0c0cafc1b99218bad50bd800716f1570
SHA1 11ec14fd7f7c569d6d20fb69ba2ba81386d4b62a
SHA512 761967a1914a9a8d66f189447d91a50bb2d9a0412220992e240ab5bb017a07a54029e1a30d773d58029b6b9171910895f119ddc19a517f048fc04885ffdcef05
SSDEEP 6144:hawwlVfVmx4YayJDOt4fLJ0L6nGJxi3bzqapJjv:TwXVdFNWXUx8zvpJL
TLSH
T1154423F198A05C528BB7AE4E45BA3F140EF1DACBD9C4ED6809ED4D4A05CAB404F17E93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 6ba58bc8bc3ec66b57ee9ba6e6d2655ab90433c4dd34a62a09cf7cb5b200f664
MD5 172293f8b1052b88fe56cb033cdca6f9
SHA1 cfe6b51c8f394ca32f61dd459a7d398e393e0fdc
SHA512 e2637e0b679f082c47f50b2e9cb7d53066ab477e1184bfcae3f490be8d452a30e5a385fe2d98303a6e7fe95f8fefd48c70476b371004743344af00788509d9fe
SSDEEP 3072:2H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:2t4fLJ0L6nGJxi3bzqapJjk
TLSH
T15DD312F0D6A06C7ACBFBEE4105756E948F71D5C289CDBE2409F98C0816CEA354A13E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 2b50827ee818659aefef2fceaf3221f52c251d55b76971071da5d9ef80b39c0c
MD5 8e395794b1bc792230182f3e1bae2f5d
SHA1 176f244b87e98174f5f76db7317f59e30eab9c31
SHA512 c34feb541bb808c2c97d46b0fd4ab1525ce875f4bf2b3b362fbad97c32380b6b72a9ee1daeae72d6e7af98f178453c93a627e0b83f042cb7c012e0af0e551fe4
SSDEEP 6144:D6wwlVfVmx4YayJDOt4fLJ0L6nGJxi3bzqapJjv:DRwXVdFNWXUx8zvpJL
TLSH
T1FC4423F099A05C528BB7AE4E45B62F140FB1DBCBE9C5DD6409EE4D4E01C6A804B27F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 a4d6c5d4b2b2c46af6987b5214dec888892e705e583ec69eac3ad170e51fd809
MD5 1f0827b41c15e910c4d220fd5139ba78
SHA1 04ff1374d8ad8b89e5e1cad022dc17de45a72d9c
SHA512 7d5b00d8c3bbbe9cac309e1479315319e5788656b1195b344804a3c7327a78c681899bf9c543bc69637e53d45346b8ffa94fef891585baf769980a9847c84db0
SSDEEP 6144:BawwlVfVmx4YayJDOt4fLJ0L6nGJxi3bzqapJjv:zwXVdFNWXUx8zvpJL
TLSH
T1524423F198A05C528BB7AE4E45BA3F140EF1DACBD9C4ED6809ED4D4A05CAB404F17E93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 58171b429bf95182e15f74958428bd40d188ee093357af7c74a1f2e77fdd0603
MD5 0d58ac7d37df9f83c5bf0aed5165ee9d
SHA1 50c28849b187a34d5ad5cfc333b038d64bc6a892
SHA512 d783ee98c765eb6ccb279da6fa9d99bc5eed5475ecb75b86b27df21f44b0d2dbc4bcd90b026cc26b4cd5499f283169b2eaaa0f8c6be080ac169a6df0c320b77b
SSDEEP 6144:c6wwlVfVmx4YayJDOt4fLJ0L6nGJxi3bzqapJjv:cRwXVdFNWXUx8zvpJL
TLSH
T1C44423F099A05C528BB7AE4E45B62F140FB1DBCBE5C5DD640AEE4D4E01C6A804B27F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download