ef081f6c1fd2041a31ec4258960b4e871817f8544beaa82a565615c5b9947e60

Resubmissions

22/09/2026, 17:10

260922-vp2nasbb853

22/09/2026, 15:38

260922-s21knasz6r7

Analysis

user interaction
yes
max time kernel
575s
max time network
578s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/09/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ndot55-Regular.otf
Size 75KB
Sample260922-vp2nasbb85
SHA256 ef081f6c1fd2041a31ec4258960b4e871817f8544beaa82a565615c5b9947e60
MD5 ad368adf862d51bdb5870617a14e486d
SHA1 c80bebfdaf324ee0500fef517f8f0f3750314bb8
SHA512 bcc3482a8120a041efa3a4139a05aa4ed037eb388a464d6832689e96dac01eef2e3080114abdd8ac0a89fda5570ee8cc532ab4726ff464491d4f626aaee1e4cb
SSDEEP 192:SgMKzovcC7764zy4zTOCsQ5l2PXlHLNNQ2Rj:9opOa5lqXlPv
TLSH
T1C473FF7A6D0A38AB7E60C6D4834B99D34F3D599D6E1CD680860180D6E50BF928E3FDC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4864	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345707298659881"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
440	chrome.exe
440	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4360	4864	cmd.exe	81
PID 4540 wrote to memory of 2616	4540	chrome.exe	83
PID 4540 wrote to memory of 3464	4540	chrome.exe	84
PID 4540 wrote to memory of 3464	4540	chrome.exe	84
PID 4540 wrote to memory of 4480	4540	chrome.exe	85
PID 4540 wrote to memory of 4928	4540	chrome.exe	86
PID 4540 wrote to memory of 4928	4540	chrome.exe	86
PID 4540 wrote to memory of 4700	4540	chrome.exe	88
PID 4540 wrote to memory of 1392	4540	chrome.exe	87
PID 4540 wrote to memory of 4700	4540	chrome.exe	88
PID 4540 wrote to memory of 1392	4540	chrome.exe	87
PID 4540 wrote to memory of 4768	4540	chrome.exe	91
PID 4540 wrote to memory of 4768	4540	chrome.exe	91
PID 4540 wrote to memory of 2724	4540	chrome.exe	92
PID 4540 wrote to memory of 2724	4540	chrome.exe	92
PID 4540 wrote to memory of 4372	4540	chrome.exe	93
PID 4540 wrote to memory of 4372	4540	chrome.exe	93
PID 4540 wrote to memory of 2276	4540	chrome.exe	94
PID 4540 wrote to memory of 3172	4540	chrome.exe	96
PID 4540 wrote to memory of 780	4540	chrome.exe	97
PID 4540 wrote to memory of 3172	4540	chrome.exe	96
PID 4540 wrote to memory of 780	4540	chrome.exe	97
PID 4540 wrote to memory of 384	4540	chrome.exe	98
PID 4540 wrote to memory of 384	4540	chrome.exe	98
PID 4540 wrote to memory of 4820	4540	chrome.exe	99
PID 4540 wrote to memory of 4820	4540	chrome.exe	99
PID 4540 wrote to memory of 2652	4540	chrome.exe	100
PID 4540 wrote to memory of 2652	4540	chrome.exe	100
PID 4540 wrote to memory of 2124	4540	chrome.exe	101
PID 4540 wrote to memory of 2124	4540	chrome.exe	101
PID 4540 wrote to memory of 236	4540	chrome.exe	102
PID 4540 wrote to memory of 236	4540	chrome.exe	102
PID 4540 wrote to memory of 740	4540	chrome.exe	103
PID 4540 wrote to memory of 1004	4540	chrome.exe	104
PID 4540 wrote to memory of 2276	4540	chrome.exe	105
PID 4540 wrote to memory of 2220	4540	chrome.exe	106
PID 4540 wrote to memory of 2220	4540	chrome.exe	106
PID 4540 wrote to memory of 1568	4540	chrome.exe	107
PID 4540 wrote to memory of 1568	4540	chrome.exe	107
PID 4540 wrote to memory of 440	4540	chrome.exe	108
PID 4540 wrote to memory of 2124	4540	chrome.exe	110
PID 4540 wrote to memory of 2124	4540	chrome.exe	110
PID 4540 wrote to memory of 2620	4540	chrome.exe	112
PID 4540 wrote to memory of 2620	4540	chrome.exe	112
PID 4540 wrote to memory of 4024	4540	chrome.exe	113
PID 4540 wrote to memory of 4024	4540	chrome.exe	113
PID 4540 wrote to memory of 4016	4540	chrome.exe	114
PID 4540 wrote to memory of 4016	4540	chrome.exe	114
PID 4540 wrote to memory of 4932	4540	chrome.exe	115
PID 4540 wrote to memory of 4932	4540	chrome.exe	115
PID 4540 wrote to memory of 2084	4540	chrome.exe	116
PID 4540 wrote to memory of 2084	4540	chrome.exe	116

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ndot55-Regular.otf
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Ndot55-Regular.otf
  2⤵
  PID:4360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9821bc728,0x7ff9821bc734,0x7ff9821bc740
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,13177361072784293817,17227070098461807299,262144 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,1948619913810871930,1191034241553269214,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,12816206472189827983,1406380225331488467,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,2666442551103820582,5533435606485186518,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,13055340346168782637,9811113084221888792,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,86385215414682946,4218992803887315089,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4352 /prefetch:9
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,11640082809457130188,6743074074093098838,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4956,i,15567770343127381149,2508889869216306112,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,4065491222029643327,7819679306437374195,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4968,i,11587489240665072980,7459228688858103693,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5968,i,9509803881780172457,3855327702033176580,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4044,i,6306208026264255234,4912733766796703381,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,17651225557986553760,3845024608487957322,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5812,i,16400293615392764122,1904726176081830530,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6220,i,5502951176918656930,1246244333693661250,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6152,i,2894626852427966452,16012498373348439181,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6768,i,4884816040202118061,10895094856054082812,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6772,i,14344939342561604410,147387261977032700,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6776,i,1497574803267888604,8715864341945783125,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4456,i,6090185692950628993,17270193409964681008,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1140 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6664,i,14173480536290296357,1112087192245988071,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6244,i,5533797172941015600,1907727357473989505,262144 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4960 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4404,i,4917526778991515038,11819834856113302123,524288 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6672,i,14857838300763498923,879295791207453602,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6716,i,15161313134364736139,2659630452414243615,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6680,i,5455999418349453003,7889194891686510119,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4452,i,8422978263435666024,7818843684822073292,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6976,i,15864680002699047532,11845547840011791604,2097152 --field-trial-handle=1956,i,218796761299031086,6235211568981521522,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:2084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c1c45b4f12443ed9d580a751dff87ad6caaa027b65e1f09fe16524d8e1988fa4
MD5 d894d22a61269a3f9dc19ee4739858ab
SHA1 1d5885a0ceb1310d9a9011909852bcc10328439d
SHA512 78422ffacccdff0d5907c1dcb955164f4081744a39a1afe06c048dc552c819f6116cd1c562cf5fedc4420b438e691b81acd8b6e7784a0b7b366b36c745f9937f
TLSH
T180F078B6D821FC2B18FC1B1D20954B46FB50132B2B40894F3B3C920D8FB5A3B459591C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 9794fa815bf2b5da07a7b0f33323faa3561a156f87f296089fff30f7d9e6e686
MD5 e370f70780324569cf7c2aa8bf82ded2
SHA1 21497e5ee4de5a298ce53c08514fea19c827c66d
SHA512 04b0a9c35ec69e1f2fda940d02c5802bb231ae92a5f2a05dace40725837ad37e868f333c73e5097d76f7a9463fbf2006b089a63e660c81699bb33950da9d7949
TLSH
T1C1D0C9062901E0D4FB9F37B78F8109E3751C5ECD7515DF9B40E4B5844C8269D5151545
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 522d18d7393c977d7022eeb6ce68a945bff8138ecc2a3def056d9992cc0f6871
MD5 c3f18ef788727e6c6b6407e31b6a9ea6
SHA1 558745820e545b1479f0854e7c3a50bef5b73642
SHA512 10069f032da5e7af3cae6c5a45b2060c795460c0dd927c9daf9070e3f2c99f75feccb1e6c04d51733459a8cb061049f0b3c300db1b49f5519d2443be58e6a420
TLSH
T169817CF7C3D4DA7DC811A6E49B256E1EDD6D0E24122C3C16C8D8EE4B53E28B2D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 920ddbba11ef4365d6f7069aaf52c4cf7d4c71774be993b27d869244894b2e3a
MD5 9c1e542706e31bca792fb3410fb1e08b
SHA1 9d2e5b4ecbb9a12996e06c1657d7aeb7edfe297b
SHA512 42b1d4d40f07a791d5cdcff84af2489cd401a8df7fee62cf954655c055533f777bea2ef969a6dcc641d96fb90904faa4f9aa4467dacccc0cc03e8fd61e61c600
SSDEEP 48:YALlqKqRq5hSassRsrXLsNvfoKsYgmzsA4sDosFYKshIysN8Fs0qs7fsBRjhhnOg:DvGgvIevDLDWjIbWJaRjhgK
TLSH
T184817EF7C3D4DA7DC81196F49B256E1EDD6D0A28122C3C56C8D8DE5F53E28B2D20068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e6c79bf0cdcd482a30cc010bba3e373eb343ab9f04fe50fbd693149c38bb0419
MD5 ddd3ab1604135c9794f38d394db1c83a
SHA1 f110a17b42acbf608d05b4ff5fb08c289ab55a34
SHA512 13bb3e7eca74abddf09a44f8bb437accb365e4bc81033c88a2e6f296a0ffcf6b2a9e12a2f8ccb9ed9d0a61c590add1310415c5b71c3fc619e380f42432c93e2f
TLSH
T1EC718FF7C3E4DA7DC91196F49A256E1EDD6D0A24122C3C62C8D8AE5B53E19B2D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4604f6d6d671c5947f90413709ce90be665140cf3eb94c3f7d909cecb861c8e0
MD5 87f4323a17731b5da4f3e37f3ae656cf
SHA1 486018067308b24769ea9f9823fc311913be1ac8
SHA512 2b7a46ea09a7f629b655d19f4f4f3e0a7ae5573548d65f8272cd99e6090d250e91d1e1d472d6cfea2b1b44817580ed90e654147a92264efae9d3fbf39ae9a152
SSDEEP 192:IR/ij53aO7hv7fpAPRp2G9UHsb+WNnaQ0TL/58q2neuRfVyIsnAUgtaJ:IR/i1zxjUXBWwp0TLZ2X8
TLSH
T18142951EED10753B5CDBC32AF9267A63E7F6102560942E84EAFC893C15E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5de912261e29d7c1117437ab8bb9044935f972bb9695f1cdb8abba8dc912d8be
MD5 a712a10e3c637240c6381a4cf87e5d2f
SHA1 ac04f8a6fd3655962acec17e165acdd3f36b0efb
SHA512 3059d622c7a5a76a56423becbb0206fca0bc3c5bac87ef0816ad85a6d4180b6827a49099d1afa7b4f95959d1c14b075bddd0e656375e44f60997e2a7708b77e6
SSDEEP 192:IR/ij53aO7Pv7fpFPRpFG9UHsb+WNnaQ02/5nq2neuRS8yIsnAUgraJ:IR/i1zHj7XAWwp0Io23e
TLSH
T1F152941EAD10757B6CDBC72AF9227B63E7F6102520942E84E6FC893C15EB5CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 895b1a14e49a158eb643cef0368f430b71ecd1ce9e8608ea067705fe2d98f5a9
MD5 3d06177db8723075a153530ea8169c66
SHA1 bf12f3233501d5ab09c8064935b39b0c53d07c89
SHA512 4b082fe1bdfd1ac3c75ced6b89d3f4513a68dd5d0d60afec1dbe7cfa9e59ef99bb7772ac0de0a9ed42897ac95755da7c055559e626ce4a86427bdf3d98c1f2e2
SSDEEP 192:IR/ii53aO7/v7fpFPRpFG9UHsb+WNnaQ02/5nq2neuRS8yIsnAUgraJ:IR/iOzXj7XAWwp0Io23e
TLSH
T18F52941EAD10757B6CDBC72AF926BB63E7F6102520942E84E6FC893C15EB5CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
MD5 4c845b2618eefdd47280df258df1e5fa
SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
TLSH
T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ec6b531c7c0bff1552c5389fdd62497c2325eafd7a2d49e70a857c1e72a6150b
MD5 e6d47a62a4316cb86b44e877b1f81ad2
SHA1 66786e410de1f5eb06a708eba2367cd5e7c6d50b
SHA512 a4eaf84351440337ba265fb011afd95265ccdc74e86725a677070c936c453e25298db2a9122ac44211a178f3d3ecdc95dc7ae2691799f66a540db101e502b0cc
TLSH
T1E6B0121590652701CC0103B01151905837608F3DD122139591E04D118C311504097508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c70f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c70f.TMP
Size 96B
SHA256 5fa0d7bc07243caf346a6a2ce3e1ee601b7dce4c419c2d4f46befc4be4c3e8e6
MD5 452d18ad5961bfca749bb6f24e3a6efe
SHA1 f719130fe8f86c2d925dab63c25978c3c7be941b
SHA512 d99a591af14f84ab563e41494375cae8417c995b888333eb541aa831ec8a1bcc197a90f53e6d5b1e05e9dfe7bccce95cdd96396a719307eadc9c09ead83c3b13
TLSH
T166B02280C0022302C08203B028A2ECE830A0CF2ACE032303C2EC0A22CC2A32088208A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 fdc030c6629af5d11793edfcca2aab21ab32cacb52b35678357edca0d8103bf8
MD5 b2a84ba25dba571fd22e51b29d996aec
SHA1 941beda0f42651bcbc30f52c48178a77ee16ba33
SHA512 97b60a6edcc4a9d9bbe88be961ef2737ac37020c641f5724f1eaccac3741dcaff4c400bbbaa71e5704757c6f1a7b18fa3c163d07e8be5f0f4136c1b3e3e4e2a7
SSDEEP 6144:SUww1BlfCGz1AMqEiRSM33uVt4fLJ0L6nGJxi3bzqapJjL:SeBfzcRJ3uVWXUx8zvpJH
TLSH
T1174423F1EFF09E7AC7B2DF4244354E242D72D9C3448AED5420EAD9094BCE6290A13E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 59a44ff0975f94acc15c23760a8768d5098e5c895404facc0357b066145ae1c2
MD5 e0196fd38455b1a75a61e98465a74b8e
SHA1 dc29f3ea00168c4835b02de5cabf22b16a8cd8d6
SHA512 f3f23b2ae8021e4ddab22698e34c84987c036004a897ca93d7483b59423221300bfa1db8a512f7f72281410d041b5230e3e418186821f02f1d37f3d593699f4c
SSDEEP 3072:mCH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:mSt4fLJ0L6nGJxi3bzqapJjP
TLSH
T1CCD312F1D1A0AC7ACBF7EE4145755E948E72D5C689CDBE2408ED8C1816CEA344E13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 29bce8414e517bb51b94bf9184ee44fd6095422ce16ff453431f513e4f1b9286
MD5 7ca4c110e19490c44aeb9e06896b4c67
SHA1 0516a9a2d1854e0ab74e77e4a1f0f3f9c9bd3d3d
SHA512 b7d046bec00b2a929e65a94cbb386777ea4f60095960f1d79c6dcf2470cad2fc6c372929eb22e783e484c11a35a488924837373c12a99bb1a38e7a8dbf148e9f
SSDEEP 6144:mcYw1BlfCGz1AMqEiRSM33uVt4fLJ0L6nGJxi3bzqapJjL:FBfzcRJ3uVWXUx8zvpJH
TLSH
T1F44412F1EFE09DBACBB2DF4544355E242DB2D9D3498AFD1434E5D9090ACE6290A03E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 31d743a88008f22542a9bc7f1a91241c679a6adf1083eb467ff81a345ee88f61
MD5 9c722c5ee4a9b7071cabb7133e6f0a4b
SHA1 82c48cd7dcd53a1bd19dd2c1b16f34f34cf96c4c
SHA512 1b8dda3f2e123844536ac5785a7e99ab16ceaab15b2f7762406b4a2478c3fea584250cd540bc4b86f9f12ea43c58d81012d35017f2c0fbcf6b362398dcb28f44
SSDEEP 6144:HcYw1BlfCGz1AMqEiRSM33uVt4fLJ0L6nGJxi3bzqapJjL:MBfzcRJ3uVWXUx8zvpJH
TLSH
T11E4412F1EFE09DBACBB2DF4144355E242DB2D9C3498AFD1434E5D9090ACE6290A03E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 bd4e96c273813a538156ea742955e90f4d333da8284626b6debd56b7f6f42efe
MD5 7503676f6f1207bcb1638299a00a72a1
SHA1 713014d0e04924368dce8d8f38b9db9e59c5923f
SHA512 e0755b74c4edd6db156a1a7ce64c5c331938c8245b909b4881f167769fa68cc06b0f64b7eeea9114697a431a16bdd6373d811365610a0ff632c7fcc0298bd5bc
SSDEEP 6144:LUww1BlfCGz1AMqEiRSM33uVt4fLJ0L6nGJxi3bzqapJjL:LeBfzcRJ3uVWXUx8zvpJH
TLSH
T1914423F1EFF09E7AC7B2DF4244355E242D72D9C3448AED5420EAD9094BCE6290A13E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 41aa33e3fa3b52c5fded5c4f04661a27206a39fd3906aa97eb9e59b65475a76b
MD5 d2ac2fcd79ba234ab384c0f7fe92bcd7
SHA1 4644208e9bcc32de7ec64c9a6a2135b63ef9285c
SHA512 9e95123a58c574f5a1ab6d1fd62793934ac54be4f8451b715923159a22af4f92156736dd0581ba419c93f0009addd16ac15539fb1cfbb02bf2bec3aee0d5de81
SSDEEP 6144:2cYw1BlfCGz1AMqEiRSM33uVt4fLJ0L6nGJxi3bzqapJjL:1BfzcRJ3uVWXUx8zvpJH
TLSH
T1CB4412F1AFE09DBACBB2DF4144355E242DB2D9C3498AFD1434E5D9490ACE6290A13E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download