113a882f7c5d1e65874034ef2a955ce407819e9ec4f4a6d3348cc759943c3851

Resubmissions

16/09/2026, 18:14

260916-wvp25aca763

16/09/2026, 18:11

260916-ws2cdatejg3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Khalid_Olayan_Touchstone_1.1_Philosophical_Thinking.docx
Size 15KB
Sample260916-ws2cdatejg
SHA256 113a882f7c5d1e65874034ef2a955ce407819e9ec4f4a6d3348cc759943c3851
MD5 12c43cd22b3fb28878d7f0351c311524
SHA1 8e4f68dfdf480949201bf4372407ab078892cae1
SHA512 41b5df7d4574546acfff78ed14bd6f01259fe5fc2c096dcc1e2e7f5fc7233508aa3e94c4de9fcbf4fdf61772126533fc5933ee2a62dd6610a8061ff33890dd67
SSDEEP 384:aYkxyjzII82ILNY1LQUt1HU73C8Ey0ct6kU3QVrh:gP2ILu1LNnUzVEyZ6kUAT
TLSH
T1ED72BF2EC2C6A817D9035C7C98F513DBF44547D2B609A96F6862B6C8FA81047336FCD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3612	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340559216150815"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\Moniker = "cr.sb.xr3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1564618566-2075036687-2183292701-3772712905-356161540-1460609487-3404086268\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3320	WINWORD.EXE
3320	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5264	chrome.exe
5264	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3320	WINWORD.EXE
3320	WINWORD.EXE
3320	WINWORD.EXE
3320	WINWORD.EXE
3320	WINWORD.EXE
3320	WINWORD.EXE
3320	WINWORD.EXE
3320	WINWORD.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 5792	5760	chrome.exe	87
PID 5760 wrote to memory of 6044	5760	chrome.exe	88
PID 5760 wrote to memory of 6044	5760	chrome.exe	88
PID 5760 wrote to memory of 3612	5760	chrome.exe	89
PID 5760 wrote to memory of 4836	5760	chrome.exe	90
PID 5760 wrote to memory of 4836	5760	chrome.exe	90
PID 5760 wrote to memory of 6128	5760	chrome.exe	92
PID 5760 wrote to memory of 6128	5760	chrome.exe	92
PID 5760 wrote to memory of 1408	5760	chrome.exe	93
PID 5760 wrote to memory of 1408	5760	chrome.exe	93
PID 5760 wrote to memory of 1744	5760	chrome.exe	94
PID 5760 wrote to memory of 1744	5760	chrome.exe	94
PID 5760 wrote to memory of 1204	5760	chrome.exe	95
PID 5760 wrote to memory of 1204	5760	chrome.exe	95
PID 5760 wrote to memory of 2236	5760	chrome.exe	96
PID 5760 wrote to memory of 2288	5760	chrome.exe	103
PID 5760 wrote to memory of 2288	5760	chrome.exe	103
PID 5760 wrote to memory of 2160	5760	chrome.exe	107
PID 5760 wrote to memory of 2692	5760	chrome.exe	108
PID 5760 wrote to memory of 5356	5760	chrome.exe	109
PID 5760 wrote to memory of 4032	5760	chrome.exe	110
PID 5760 wrote to memory of 4032	5760	chrome.exe	110
PID 5760 wrote to memory of 4524	5760	chrome.exe	111
PID 5760 wrote to memory of 4524	5760	chrome.exe	111
PID 5760 wrote to memory of 4476	5760	chrome.exe	112
PID 5760 wrote to memory of 4476	5760	chrome.exe	112
PID 5760 wrote to memory of 420	5760	chrome.exe	113
PID 5760 wrote to memory of 420	5760	chrome.exe	113
PID 5760 wrote to memory of 6120	5760	chrome.exe	114
PID 5760 wrote to memory of 6120	5760	chrome.exe	114
PID 5760 wrote to memory of 864	5760	chrome.exe	115
PID 5760 wrote to memory of 864	5760	chrome.exe	115
PID 5760 wrote to memory of 5264	5760	chrome.exe	118
PID 5760 wrote to memory of 2872	5760	chrome.exe	119
PID 5760 wrote to memory of 2872	5760	chrome.exe	119
PID 5760 wrote to memory of 2856	5760	chrome.exe	120
PID 5760 wrote to memory of 2856	5760	chrome.exe	120
PID 5760 wrote to memory of 1856	5760	chrome.exe	122
PID 5760 wrote to memory of 1856	5760	chrome.exe	122
PID 5760 wrote to memory of 1448	5760	chrome.exe	123
PID 5760 wrote to memory of 1448	5760	chrome.exe	123
PID 5760 wrote to memory of 4160	5760	chrome.exe	124
PID 5760 wrote to memory of 4160	5760	chrome.exe	124
PID 5760 wrote to memory of 3580	5760	chrome.exe	125
PID 5760 wrote to memory of 3580	5760	chrome.exe	125

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Khalid_Olayan_Touchstone_1.1_Philosophical_Thinking.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffef1f0c728,0x7ffef1f0c734,0x7ffef1f0c740
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,16264925408269311443,2532680700918839571,262144 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,3188272504184933602,6856632774905620000,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,66727167850862437,5617608515785216651,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,10224194159814657290,6045134952723566254,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,6880321251138318839,12108051328195417407,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,17861452463023908642,8089291830554502631,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,11940082053127982040,11884849181046812389,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,6248056131803325129,746764443783283558,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,6597547906883833560,12287180727347377385,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,7495099482275209350,2652867463892341882,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3316,i,14787898754234256028,11148835047614142691,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,1888344387003708113,5500460933080139847,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5904,i,5776618194649881375,14183401166999015721,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3120,i,13945996886916683506,11039013854799747470,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6060,i,15615248572920292975,6114405910915720744,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3344,i,9899061161342902940,13216590599733001867,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --lang=en-US --service-sandbox-type=xr_compositing --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,6240232864413397505,13660219688582385268,524288 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6164,i,17741876199803228807,4228655365151136505,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6540,i,5592136156037134553,7748916385297534138,262144 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5524,i,4661475391370398411,17765971653630531798,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6428,i,11336568154612174856,11022163776664100312,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6520,i,18057179327984217048,5611583310587586430,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6924,i,12340686459889936405,3668337580189538997,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6588,i,6135914184072002451,143594570533224781,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1268 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6676,i,11210157384227223477,11247482111289656561,2097152 --field-trial-handle=2020,i,5902098112573020049,14052557326272486215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2e13e5f0cf47cac3cbc3b9c1412da9a4cfcf3cbe84165e6932433b6b65bae4f5
MD5 aacf2261b2f1f560e3dae0064cd601d4
SHA1 2c93cc7643eb582e741a96a3288aa429606628ac
SHA512 e1a12a1bb66ea36dfa998add0b7b803a389bf4026061b1e55d567c3255532b1865ca75fdcbd73d3e66d7ab266f91ac2f31585edbb3a7a4ebbe58d3ae74725e21
TLSH
T17AE02BE6C8119C374CFF076921558A45FB60232B6B408D4B363D91288FB01368B99D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 21KB
SHA256 51d851bea13c4641203d62016519c1a2248c5ab8686bf5ef4a73e1440823d944
MD5 ed49bbdc79baa7cee160d52cbf560abe
SHA1 542685ad37fcb5ed376ff75faa50c2eea4c6ea16
SHA512 68963f3147e679a138ab32c09d994a51070a4a5d142a5b11a165e5fd260c206b60d7c80e902b54b318804f9903eb0347e58f9706922985b7914fc61e49e5c636
SSDEEP 384:hyq0beAxD++IuMHNDPs8/7ASCPQJH8fa0bOnBtk4wau/YZmCzLauF5DFB0qC4OIM:hL0bvxDn78/7DZcfagOfk49GsJaKWqCv
TLSH
T1D3A2F1D9D2E63832706167B4D06A1EAE08D8D7997C720E6A907E29C109F5C756B3F402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 1024KB
SHA256 99a0b2af58d5e20f2f15de0fcbbf2c92c8112ac53cb8cd8be900a240953d4300
MD5 74886b079cd7f6459954917c97c31de9
SHA1 e2c2ac661261873d1ffc0889904ac1b37ef54d59
SHA512 be571745c415f921ac5d3ac2ad5ef5defbae796750b55cc559f11d37fd7683554987b11cd4993ae855b03979a676da571319c42b8002a240db68b8e4e1976db4
SSDEEP 24576:KjIlvuvbnKmeat+Q1dNrIR7zMG1hNKmPuLy/uTH79:KjIlWGm1t+Q17r2zMaKt2/uF
TLSH
T1912533014FB51186D6220771D771AE7F9B0CA7DA7A4F22B5FB420FB4E7C0A9EB658402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043
Size 1024KB
SHA256 6c5446d2b495ed4ffb4d056bb43246cbb9aa235e15261bacccbe88e609565c61
MD5 b4dc432d9c5e9d64d9363b4a9b8938af
SHA1 deb52c79a5a1e6a565678ff014f65c7d22f47cb4
SHA512 0d7ee117c6158bbf72ff8ed1bdea001929360eb59a484e85b5c6b8215da11a4e43b6afa18dd5887b8f2c6abbee7ed6f2453cdb027835be409447d55e5395c5a6
SSDEEP 24576:LB66QL/7R1qp0edADTOlfj1t/TM+eMOg4bm4SVSpaP4oU8Ze3:LHQnfqa7PSb1t/T1L4b9SwaP4oU53
TLSH
T1E32533F2F27575AF9F20A154488101B2572EDDD8E05C1D87872D292A2BE9BD43CCEF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 346KB
SHA256 25cc9227e0bfac1c7856bdae00fb105bffdc10e1acf3d4fcd529c36e3573d4ba
MD5 fb4e9e321ef94c39491e1e196f894b28
SHA1 38d1b1135d65798cbb8ecc7a4e3de5a8b0440be7
SHA512 7052634273c61f6ad09665730dec67e3ec3aacbb1878cff6a20cfdade89e1a28f63b01e9d7ad00a5d4abf6b2e7167b43b37731e24472ee8e97b7c22fd7746672
SSDEEP 6144:SnNdemwBOxLMlowyKCg5cmSyrZNQU1yYHIr21I1fBkZZVYbt+pO4aSwAIWWY/NDv:SbwBEQlowzTcm/mYClijYbmlwAIzYVz/
TLSH
T1187423A4F7A566A9CE64D934A4409B29727D8201D073529F8BCCEC7CFBD93C10CD6C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
Size 1024KB
SHA256 2301a34774e3b8af109a3498fed443a0223cef4f1061a3e1c8cd0485b0566b7f
MD5 f878e3ae2f3fc97e0d1681e085bf3559
SHA1 628c27645795746c9550c7f7058e749f172cf547
SHA512 1c70358c13ac2af0a3ba66d6dcc6796d68e744e6205cd157c82bb9129a90652fb4e3ab83edfcc37dfff3ac5668fa8a44f80abbf7cc4b4ac3c957c1f517baf554
SSDEEP 24576:dWRcgHpvU/Zim01509oCCr1eaNNYmYtEaCsGyV31uy:iLFU/503vDmCje1j
TLSH
T17225334A1B2678887C20D0D52F6CD75C6FEC13E21CD881EE64650D9BAAD4B5F213B0FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056
Size 65KB
SHA256 5eb25466f57fe1bec2a9200beeba984f45b3e63ae57fa38fb3cd3ef07aba3aa8
MD5 e8efedf4c181f10bdecb24e2bfef3394
SHA1 81557ac845656c7a0ed69358b315911d1c4fc90f
SHA512 a9be81b8f61c5528080fb0f87d0f2e86c5915407625eeaf675af1d867e9c92e8b4a1a358e2e5d10a49a732a308d52d02612dd810937e0baf82b1bb3ecde68a94
SSDEEP 1536:aE8b9xD+jeRVZOcDb54zNEjMsxAH7QBVENgk1r5MkPYtYvKzb+4:aNbfiEV4+b5wNEjMEAHUrEBMkPYAu+4
TLSH
T18763D048E7721665C95294328CD343253B7CC579658B176F83E0F87EFC6B3AA9C4B0A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000083
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 a809ba9d7691d62cd0ab3e8246e2267264d99c888f6c0761e74dbf1eba69247c
MD5 db45a2d6af485ac0186f157ad264981c
SHA1 372f62040d4261384642b2aff99697921121a1bd
SHA512 8b76abd987e3ff1aa9e7a0d68dceb6bbf473a16b2caaae1b1090b8049a2aaf4e0d1474d6f4999b7cb9b629eac7018892909bc244a528280a3069bff18d46494a
TLSH
T1F7C092746147AA01FF2422B02D8E9F6430A0281C20822799D2E2945CA96B6AA8A82D86
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 d60c13806371dcbd22ac00af2d3176bdce07497b09319dfd6829cad3d52fface
MD5 db856b7568e74cd2bb7ca7be41fc2e0e
SHA1 f86c9029a17763e0d0deda9c62e0105d991dc53b
SHA512 856b11dec4826b0023051f7bcd4ea1b2e8652ac57f9d0d2d1f941af3e8dcfb3a86632fd8911eddbae916b14b32cbe9d6f0621172245660e0168978f61415bb5a
SSDEEP 384:DBBzvfMqe8dJNJvLcTpKqRZTQrtpQSY8+Yac6fTNNNiVj5k1Up8NEqJiXCTKiIaO:dnIpRagX4
TLSH
T13742BFF7C7E4962DC91252F8E7156F1FCE291A24532C3C26C8D5AF5BA3E28B1D14064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5fee6a34fe8a15901c71c7566794ada75cc06858a463bac8244e6cc651449a2a
MD5 04a504ebcf010a94bb09b06d60a26a37
SHA1 f68e5675455a951301c2214a847e1753f17e1033
SHA512 e3d8924f1910508df12c05401c87da13188df823c60da1d23f5f8a266ea7bd57c7604b10b82e63d4933f621331b15647ef3e1eac91d8ee107486c79e89446597
SSDEEP 48:YALlqwqWqWhNhZhxsjRsRXLsHbfoKsigmzs+fseosgKspqzsdftsNcsX+snla:DBBzvf6KqRZTQrROLdE
TLSH
T185916BB3C7D8866DC80166F49B256E2FCE6D0A18522D3C66C8D8EE5B93E2472D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cd17d9b9ce19fcf40c1f387d1ac756edbf16a94b37e258bb5d59409f6e22e7e3
MD5 0e64d0515305c3bea679262132c719de
SHA1 6720bf7e7adff4c774130313a950b5df1c74d0dc
SHA512 7a96263af9a5ccaa57f9004a4ef0ad1a611fb186dd24e4002d942a36c8225fe5b14f54e680debdbcacd77bf5a68d583e8df05a071f889b308138d9caea15e172
SSDEEP 192:qRAdOTT8gHIFLv78hAPRp2b9THsb+WNnUz0eFSnesViVyIsnAUgtaJ:qRAdyodz48XwJwc0ez8
TLSH
T1E542932DAD54763B4CDBD22AEA61BE57D7F9103120D42E88EAFC8A3C24D75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f4fba7d0d38a84d177baff1d14dd76b2e4115406bf1a6cffda0411aebd7a1d26
MD5 7df5eb70c8c01b29203e9fe4fd0e0055
SHA1 7f2c847a3926d241bc8860ccd240bc0d22207c2e
SHA512 6309361997be846e56044d7f4d61d22d71baa9008402b23baa4f4aae326c65a93a2f16e9b431a2d921fef2c8443764907d0b6fcff8d7fa5a0ea72a1c65a308ba
SSDEEP 192:qRAdOTT8gHIVLv78hAPRp2Yai9THsb+WNnUz4PE2esSnesViVyIsnAUgtaJ:qRAdyo9z48XPJwcL2ea8
TLSH
T18242832DAD54763B4CDBD22AF961BA57D7F9103120D42E88EAFC8A3C24D75CC621781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5866ff4b99ca950e89cd65868e8f6519ea7fe247a8922eda40aae3bad226dff9
MD5 3d03d7331c5e81f6d98004b407535b99
SHA1 f2580039a3e58b5a0067aafcef6d219476c5483e
SHA512 3164d54da7ca3d913b7e192a75441f85c5dee675c02b6396a0e8fe1d7ede152a699fb830ed1129bea759692a9de2df1ff1cdc55a5bf4f7eaa0737e25b9541247
SSDEEP 192:qRocBzdOTT8gHIvLv78hCPRpgYK6cGb9THsb+WNHvUzEDJ+J2EeVSnesVIVyIsnB:qRomzdyoXz4OXDJwEWJEebe
TLSH
T17D52821EB950763B4CDBD22AF961BE66E7F9103160D41E88EAFC8A3D24D75CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 48737bd99fa55d071340e5b6d9091ff7d1e70a9fe3fd9bf942b30d6895f963d2
MD5 725bc81d8a6de6b3ebab53d03685bf5a
SHA1 a6987085588979bb92e0a0e413ad93819f116b3d
SHA512 f26d5040838867c5836923bfa7a986632475d858f20e95c7c0da888451d9554def9cbd39d78e684a9c0dcd24dbcfd225540b20414b04d214b754d6f305590719
SSDEEP 192:qRocBzdOTT8gHIVLv78hCPRpgYK9b9THsb+WNnUz4J2EeTSnesVIVyIsnAUgraJ:qRomzdyo9z4OXUJwcjEeRe
TLSH
T13952932EA950753B4CDBD26AF961BE67D7F9103120D42E88EAFC8A3C24E75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c351db33dd77157da48490cbc4af34418f48cb27aff478f46f5545c199f8b8da
MD5 de53ecd9d14c48bb3f06ea11c5e6c5bd
SHA1 7e3489b1bd487c5e952041bf9119e78955be252c
SHA512 7d13639355728cd08fb19874d7a3520c18a48e5332dce91e46294aae0c0ccab8b6cdfd55f6637911a16daca1eb09a86c4071261511b753541fd20b014770431b
SSDEEP 192:qRocBhdOTT8gHIvLv78hCPRpgYucGQ9THsb+WN0IvUzEDJ+uN+eESnesVIVyIsnB:qRomhdyoXz4OXHJw0Wl+e8e
TLSH
T19E52842EB850653B4CDBD22AF961BF66D7F9103160D41E88AAFC8A3D24D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cc98a18d935458fe417c607e386e1b36462ef99f29dd3e0a5c6edefb00e0cfd5
MD5 82cf2a4a5ff99df0f2e2ef1cdf90d300
SHA1 50d4389cfcbf9dabe152cc1009c639d187dcf08d
SHA512 aaaa717e442bb1920d3b3bdfa4f24ea6858900fcc364778cf64544a8d82b8c0e1ef65a6c19c0b669cb1387220485aa2f4bba7149713ea8d41518341b3d809065
SSDEEP 192:qRocBhdOTT8gHIqLv78hCPRpgBmucwlVQ9THsb+WN0ECUzEDJ+uN+eESnesVIVyr:qRomhdyoyz4OXpJwFWl+e8e
TLSH
T12652956EB850263B4CDBD22AF961BF67E7F5103160D41E88A6FC8A3D24D76CC6217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 989a99a090c5a8f963956a69909588d47db29e4a867f6245cd4b3c1d07e83d46
MD5 7e537ccc020de5a57384d385beb07fa7
SHA1 651431b441562dcebdb4407f58e752a3a9dc1949
SHA512 a7ca39cb4e1374722ffc1780bebc53e6746e6dcd68868f6daf843debedcb5a90976fc9978005443eabbffc7dadb9607eea7a88422c429bdea517ded08c97f588
TLSH
T10EB01225D4423302C841037012A8D06533608F38D112138681E05D11D833160401F158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58efe9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58efe9.TMP
Size 96B
SHA256 9a7b54663720e63130956f0bdd9f9e846221381b96c98cc5e9444334cdc83472
MD5 4e5c598c4c38d74b699f299e8215528e
SHA1 c7f2954441e5bfb67ceb39a1350a00bd0b26386d
SHA512 43a5ed39bff3ddd65eff0306d7c7a2ae8cb1a43d9acda4cd47b08d98673b59f831eb656985f4439dabfcca1ec55b5bf385315b84d76b4efae320b350feaf3b36
TLSH
T115B00269C103A356D44303B0A995D5E8B361FF2AC743225292E09AB6DC257BA45251B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2e6a2623c3b66d8fd5d9cc987bea98f1e84c7fc390c6d515cc85de7d9f09ce61
MD5 73fe709c742eb86b7e6617f42cfb2057
SHA1 7b24a16fd29bbe81953c3acf1609ff36d306aef9
SHA512 d770e90f37c780586902fd13befbccacfe50cf7ced1f9ba4025db8b7eae66740d6d9cfc78cbee0628c1b1f362447d7ace96f05e20532803f608eda7cc43b0735
TLSH
T166B0126430021DC1C91A47B080D06141321369151EC200434DD40420860214102C5101
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4976f0a50d239e098736cec5ac866775ffefdf4ed39d055382185cc3d5753e81
MD5 a0ff45c47dc173cd550b132f53a0b4f1
SHA1 3ac8977f49bceb3474eed29964b1c3f2f76fdd51
SHA512 97538e6d58097e946ef7c67c68ed4b5a396206212f9f6719cbf28b0ca67405825603d70325fff9c0667173b727f6a79799929a3aef8935f09bfb861998c35a43
SSDEEP 3072:d+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:d+hFD+7t56OD9ZfSAppry
TLSH
T126D31232AA91C8BBC9BC6541B257A300DE766CED41DE3A09444A5F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 f163c4904371fec94d5e137d1674519d12a28052befef93003e40d8177e2881e
MD5 5f84e470479d87a9e7acbcdd1b677db1
SHA1 fc9ec8c9e70de84b15f4995ca046cbb795f50304
SHA512 676dbe0c357bf33e7a529eea25516c35690e13163393ce5de4947b2dce4dac7f214816d9ca8ceb7dae179619dd794562c37bd98d739c3fabb14d44ca2f5b6dd6
SSDEEP 6144:NZpOohkHNMCmxEsz40t+hFD+7t56OD9ZfSApprA:DpLgDBsLtyFSXD9ZfS4u
TLSH
T15744233259009DF7CEF96986B04E3300CDE6BEFF528F694D9496AB86E0CF5540A32D61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 212f209888848f8bd26141962ab87e006146c5ca99508d83a2a9c9b27eea02fc
MD5 3e81667664e174cf1b335708d475864c
SHA1 1c567fd5b71bd0b1ad1a00e5c15070627046f216
SHA512 b6a9e0030723f9b878d9ce7accdd678a1290eecdaf71ace482a281172bcb70de21884c1e88761c51312afc09fe964f80bac9c05942df95d74618bf7ea2c48f4c
SSDEEP 6144:0ZpOohkHNMCmxEsz40t+hFD+7t56OD9ZfSApprA:KpLgDBsLtyFSXD9ZfS4u
TLSH
T16444233259009DF7CEF96986B04E3300CDE6BEFF528F694D94969B86D0CF5540A32D61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 25ec2b2697649ff25ed0b797342b5e365ceccb15056f6aff1ea17f949152b9bb
MD5 bfb77ac04e3f5eaafcf11e48a97b75c4
SHA1 3dd2e2ac089112a84cec57aa4c0855a8d1fbf658
SHA512 dd3912c9cee09c70cc85631cd5016bf9ea7c526e9e4694020b60f3200be13793596b1ec86a5e3b2c08bff665380d049b81bebad23062e9ca273241a55369adaa
SSDEEP 6144:/ZpOohkHNMCmxEsz40t+hFD+7t56OD9ZfSApprA:BpLgDBsLtyFSXD9ZfS4u
TLSH
T1B544233259009DF7CEF96986B04E3300CDE6BEFF528F694D9496AB86E0CF5540A32D61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 c8667822426db33069136d904746ec7514d72a80fb8d1c7401db8c3cb63d7073
MD5 de94993f7ee2fd412ab6aafcacf28ea8
SHA1 e4199bcdc73b536bc42afb654f0e075e50f67098
SHA512 32403f888ecdf1514468ecd1b2c60453ef694871448f3c51746be576a1df703204d2745804ed6d62367c1ad8c157566f221e175ff5ad2911b6c807a804890258
SSDEEP 6144:+pOohkHNMCmxEsz40t+hFD+7t56OD9ZfSApprA:+pLgDBsLtyFSXD9ZfS4u
TLSH
T1DC44233259049DF7CEB96582B14E7700CDE6BDFB12CF795984A69B8AD0CB5480732E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 c600371bf433c50935365747cca011454d7cf2d4f1701cb3fe8242b224e9108c
MD5 34cd9fa7ab9a1ea7b122658d4800db35
SHA1 7e2572302fd092376fd4779772a194bf03d9b0bc
SHA512 a4ac385b5a05a9b66de27fe314020f139f48799d8fad653979c88d3d38e716e920ed807b40a36070720d2a482e5c6a77e46345cf2981b9a53726e532d6d50445
SSDEEP 6144:npOohkHNMCmxEsz40t+hFD+7t56OD9ZfSApprA:npLgDBsLtyFSXD9ZfS4u
TLSH
T14E44233259049DF7CEB96582B14E7700CDE6BDFB12CF795984A69B8AD0CB5480732E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDDD9A.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 d9b9ed1084c0775107ec10a86474f15c47ef4be695fe271ba81f072ead0d49e7
MD5 9807b036b1f0bf61842dca8464adca41
SHA1 e773c9ef4eda9cc215540f6e1a9b548bc02aacef
SHA512 7b926ede142c60348fd4003f2c1576132d459a3910d15d6ff870a87e8c4f73a0047dbb527510bf2ac25bebbe6096ad101942f823ae615ae444b2dc1922af3055
TLSH
T175213746A5DF2F93F0C2063155668305FBB0B806D300561FAA44605F6C69E408B6C7A7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3320-14-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-11-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-15-0x00007FFED5340000-0x00007FFED5350000-memory.dmp

Download

memory/3320-6-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-12-0x00007FFED5340000-0x00007FFED5350000-memory.dmp

Download

memory/3320-13-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-1-0x00007FFED7970000-0x00007FFED7980000-memory.dmp

Download

memory/3320-7-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-10-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-70-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-9-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-8-0x00007FFF178F0000-0x00007FFF17AE5000-memory.dmp

Download

memory/3320-0-0x00007FFED7970000-0x00007FFED7980000-memory.dmp

Download

memory/3320-5-0x00007FFED7970000-0x00007FFED7980000-memory.dmp

Download

memory/3320-2-0x00007FFED7970000-0x00007FFED7980000-memory.dmp

Download

memory/3320-4-0x00007FFED7970000-0x00007FFED7980000-memory.dmp

Download

memory/3320-3-0x00007FFF1798D000-0x00007FFF1798E000-memory.dmp

Download