hxxps://vinhedo[.]balker[.]com[.]br/ords/vinhedo/f?p=2302[:]116[::]EMITENOTA[:]NO[:]116[:]P116_CODE,P116_CODET,P116_KEY,P116_KEYT[:]1298607,1400857,14008574VKZTFBXWO6US,624DQKJEQ6K2MHOXB2EGERQAISCKKU2H

Analysis

user interaction
yes
max time kernel
269s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vinhedo.balker.com.br/ords/vinhedo/f?p=2302:116::EMITENOTA:NO:116:P116_CODE,P116_CODET,P116_KEY,P116_KEYT:1298607,1400857,14008574VKZTFBXWO6US,624DQKJEQ6K2MHOXB2EGERQAISCKKU2H
Sample260930-awbegax18l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
432	chrome.exe
432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4248	1052	chrome.exe	86
PID 1052 wrote to memory of 4980	1052	chrome.exe	87
PID 1052 wrote to memory of 4980	1052	chrome.exe	87
PID 1052 wrote to memory of 4136	1052	chrome.exe	88
PID 1052 wrote to memory of 688	1052	chrome.exe	90
PID 1052 wrote to memory of 688	1052	chrome.exe	90
PID 1052 wrote to memory of 4368	1052	chrome.exe	91
PID 1052 wrote to memory of 4368	1052	chrome.exe	91
PID 1052 wrote to memory of 4516	1052	chrome.exe	92
PID 1052 wrote to memory of 4516	1052	chrome.exe	92
PID 1052 wrote to memory of 468	1052	chrome.exe	93
PID 1052 wrote to memory of 468	1052	chrome.exe	93
PID 1052 wrote to memory of 5012	1052	chrome.exe	98
PID 1052 wrote to memory of 5104	1052	chrome.exe	99
PID 1052 wrote to memory of 1160	1052	chrome.exe	111
PID 1052 wrote to memory of 1160	1052	chrome.exe	111
PID 1052 wrote to memory of 4076	1052	chrome.exe	112
PID 1052 wrote to memory of 4076	1052	chrome.exe	112
PID 1052 wrote to memory of 412	1052	chrome.exe	113
PID 1052 wrote to memory of 412	1052	chrome.exe	113
PID 1052 wrote to memory of 2788	1052	chrome.exe	115
PID 1052 wrote to memory of 2108	1052	chrome.exe	116
PID 1052 wrote to memory of 4200	1052	chrome.exe	117
PID 1052 wrote to memory of 432	1052	chrome.exe	125
PID 1052 wrote to memory of 1708	1052	chrome.exe	126
PID 1052 wrote to memory of 1708	1052	chrome.exe	126
PID 1052 wrote to memory of 3116	1052	chrome.exe	127
PID 1052 wrote to memory of 3116	1052	chrome.exe	127
PID 1052 wrote to memory of 2136	1052	chrome.exe	128
PID 1052 wrote to memory of 2136	1052	chrome.exe	128
PID 1052 wrote to memory of 1072	1052	chrome.exe	129
PID 1052 wrote to memory of 1072	1052	chrome.exe	129
PID 1052 wrote to memory of 3688	1052	chrome.exe	130
PID 1052 wrote to memory of 3688	1052	chrome.exe	130

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vinhedo.balker.com.br/ords/vinhedo/f?p=2302:116::EMITENOTA:NO:116:P116_CODE,P116_CODET,P116_KEY,P116_KEYT:1298607,1400857,14008574VKZTFBXWO6US,624DQKJEQ6K2MHOXB2EGERQAISCKKU2H
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffa3f7ac728,0x7ffa3f7ac734,0x7ffa3f7ac740
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,11523153405518685932,10044693268577011340,262144 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,10899852396679451399,13880393873342336298,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,11067677130376383052,5052512702585375183,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,6793228699019625858,13130081195860562023,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,3345756725531341889,17247624559682284325,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,9617642952085798857,1378290971831922252,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,904130198130050824,7150444014062689747,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,4276477404645631510,12495912087694770860,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5872,i,11060893889359274784,15029631758804298425,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5936,i,7403085289961971283,2579746212976859973,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6140 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,13840128510908858422,17168117188969661371,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,15106908302257489257,3485044851287368589,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,3633841878284515171,10630560968235214133,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,7287165514402750984,5851857534741603430,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4476,i,16204917064470593702,17366134332353240387,262144 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,14840306130078990335,3263754604141453564,524288 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6352,i,4915768553789311105,8996370042916809348,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4504,i,899495598292358867,14258047184986005766,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6536,i,3794084438002325632,8899022773256223973,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6192,i,11662531461918713066,7978698969563657441,2097152 --field-trial-handle=1976,i,8479083693622012201,3684312779964302091,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 52a562f4461a938642d6a7570ea26f799315d16c054d7e25282fdb3dff585ea4
MD5 806cad72acff3d6271172bf567a63d5d
SHA1 80535259f026370961b4c0012b636515e921140d
SHA512 2c2018595468defad1565773bfc591604f2b04f622ed0bd60c325e834fe81d09f98d3d9ce1d36c65c471e448d432c58fa812e63a9ad753957ba918d7c2135471
TLSH
T15FF02DF5C932FC3718FD0B5960A50B4AE75113672A41498F3B3D811C8FB1637468582C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 df8d0e6e8c30e8181bfbeb31aff2efd529190d4e45dca1792c3563aa93093f29
MD5 f62703c204a70e5021a0f41360c624ad
SHA1 0137453a29cdd0c41a0a4c25f45495ef7e46c56d
SHA512 bc3d0563fca34a3894b80c2f3573f94d39d6d32d77ee58feae5183ee1b42b52aff05a9bc2e3e817b228dbe8ceae2dfa48eed99ec0492acb231cfaea0c101cdd2
TLSH
T15BC012C26CC08213EF813CFB90832D2162862B90029107A3A1C813987DD3AE96438302
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 af0ba4dff76925ea7c8c45de29761d8953564e4d596df69220ba167f167dae5c
MD5 1b7543fc6ed1dd4518f812dc651b6c9d
SHA1 d2f5b470be2abe1a694acbd0224dc570c799c463
SHA512 82a13e3c3cc6237a670377b32efb1d7f525e3e3fa73b7c2d11cd847a5d19c77c3ac54b76991f28a640f1c3cbc5f505db7114cd2fb9c64343379149befe746250
TLSH
T1FC516DF7C3E4967DC90156F4AB256F2BCE690A14532C3C56C8D8AE1F57E28B2D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 12a4e0a36ad6caa64212700b41de7bd58957031a37694f7a91acb5073d6eef59
MD5 f2ba4c5830476f5fc43987a43645c18a
SHA1 4052b50f7228fc9b07470ca215439ad8fd8cc1ce
SHA512 7738a71701dd6b2f0acb98a3ebf656b6429e833bb6227a0dba0c01e8217177eb6b69fa47dc70447f6eeaf918fa38d3c2ebe6404c0a7951659babcb9ccee3f3f0
SSDEEP 192:eRlh1Qv2WJMv7+pAPRp2if9THsb+WNn18PGQea2KWybtVyIsnAUgE:eRlhCv/YaUXP9wePr2/M7E
TLSH
T1BB42A42DBA10797B6CDBD229FA627B67E7F5103220942E44EAFC893C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b38430eee9749c178d9022c5a5e9890425b4f3eff471e2bacce4dd5b212f239
MD5 67791d06aa6e5eb98ac85320e23a1d8b
SHA1 22c56dfd0bfd7913eddc41f27aef66908ff08174
SHA512 97649a065feac57a8d4719bf24e0e7ca9e7bb886ac8d26b408fd8d546684401b599a52b8dc99b6857d6ed0b164f37b2ea17b638241e8089567825afce89e1ec1
SSDEEP 192:eRlh1Qv2WJZv7+pAPRp289THsb+WNn18PVQea2KWybOVyIsnAUge:eRlhCv/5aUX79wePC2/MGe
TLSH
T1CC42A42DBE10757B5CDBD229EA627B57D7F6103220942E44EAFC893C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f3c1394461d22330b86f4b7de9b3632a0605d224822e844b84153a8b2fdb80ed
MD5 c759a85290d918ddf7d31191e8b2c059
SHA1 1e8cce16d40d25dd9ddfa0cb649325f1fad63f1f
SHA512 a93815245e7233b699e12700060eb79d51a6baf170b0b271f7871a0eb5ce80cb6d2172ef33f7f47b13b1c2ba56e08956f2cd0a3dd58e7d7eb1bc08a8eb56594d
SSDEEP 192:eRlh1Qv2WJmv7+pKPRpQif9THsb+WNn18P0Qea2KWybbVyIsnAUgE:eRlhCv/SaCXF9weP52/MdE
TLSH
T1A742B529BD10797B9CDBD229FA667B63E7F5103220942E44EAFC893C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 14ea5ed197ef4b647e6f0cdff05206151e3b1b19028c8180e399e1a82039dcd7
MD5 b59e757b691bf02bfadb5756c512a0c0
SHA1 b1aa1a7b6404a030eafdc66de2c18307129425cc
SHA512 7b2419f4ad04446d58b0e3ccb415e899d62fb25b77d0f5daf5d98f75cfc4fbc1c7826d6edca1c8098a6fdb0b7d0ce12409718da632241b0ed269ec96cdee0d7f
SSDEEP 192:MRlh1Qv2Wrmv7+pKPRpQhi3+9THsb+WNnG04XN2UQea2KWybbVyIsnAUgE:MRlhCvFSaCXi9wta2Z2/MdE
TLSH
T16252C71AB960797B5CDBD269FA62BB67E7F1103220941E44FAFC893C11E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3098b13b832bf388d56ec75104f836e50fc2573e833538d08fca171c7c3ef8e6
MD5 ddad09458ebd46c2b4af8eb999ceadc6
SHA1 fc0118adc077c2132208674f6f2fe40bd11302a2
SHA512 06bbc13ea5dd999c7d8c86b2434cb4098083966c97cbf464703c08e0aad3eef476714dc9ef83b3b6d9f2de22ba93f9924afbddfb00c6bffc72f592277dfc4b12
SSDEEP 192:MRZcBzh1Qv2Wimv7+pKPRpQhB3M9THsb+WNnG04A587W3xQea2KWybbVyIsnAUgE:MRZmzhCvwSaCX59wtji7W3e2/MdE
TLSH
T1D252C81AB960797B5CDBD269FA62BB67E7F1103220941E84FAFC893C11E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 05542ff792001461ddafb1339e5467075be055524460ad09fcd8d1bb3a35652e
MD5 8b5b8b5e9ecf316465dcf094c1df900b
SHA1 fe4f5854557bcec0e66f236bd5c760581e9096cd
SHA512 45423a35c2da2e7777288a7e06a7f761cf7abbd248764801c9c2468aef7d7a9482a7c7737ac0021e4a942fff6779d99e195fa71718701fec31ef53bcc2271994
SSDEEP 192:MRlh1Qv2Wimv7+pKPRpQhi3AV9THsb+WNnG04A587W3xQea2KWybbVyIsnAUgE:MRlhCvwSaCXcV9wtji7W3e2/MdE
TLSH
T1D652C71AB960797B5CDBD269FA62BB67E7F1103220941E84FAFC893C11E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49e198041f8ef8afb9a60de38189374909038716bb202bca268c004818956926
MD5 0245326a05e9143f8c51f52a7aa39977
SHA1 c727bcd4ed35e54816f362bbae7140c613f7f083
SHA512 c8fe5f7a1ff6987bfece155db66de1a2729369d69a2d165c591bca8432b8da1b9d32d4725e2b8f4a149ab6449809365a96d87aba4bb824217740390b63f12bf3
SSDEEP 192:eRlh1Qv2WJ5v7+pAPRp2if9THsb+WNn18PVQea2KWybOVyIsnAUge:eRlhCv/ZaUXP9wePC2/MGe
TLSH
T17042A42DBE10797B5CDBD229EA627B67D7F6103220942E84EAFC893C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e897b83a771c802d5332f83765cb7c8184aed3cc5a24dff90468d43114e6ba3d
MD5 1043851dd781769c51261393335a2ba0
SHA1 d7ec145370a39880d4112723406974fbf015b828
SHA512 e456c6f86c1d4b855d27fe2ad9c8785e070bc639471ed735f8e7e323c12038474961f148e791329e200063fcbb93136e077d8dbabc1c1d6f977a458ab04818dc
SSDEEP 192:eRlh1Qv2WJZv7+pKPRpQif9THsb+WNn18P0Qea2KWybbVyIsnAUgE:eRlhCv/5aCXF9weP52/MdE
TLSH
T12E42B529BD10797B9CEBD229FA667B63E7F5103220902E44EAFC893C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9b71abd74505f71e885e57b7fef51eeeb8604f119d14ca3858306620db42b46b
MD5 364c08c74e8feba486955330187c8318
SHA1 9949f1e5185b463c3e6f3c94330adfe43a6b9593
SHA512 c5a81b25d145748c0e2dbe120d69d43e9809c086c0e29831fb00950ff18e270ec9f0433bb5bc943e43c55ed69ec3e57271a7315cfad336c8e079c28c200b4a7f
TLSH
T1B2B0125480415741C50602F45651349C3154DF21E606270152F00E12A839EA2C01B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590ff4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590ff4.TMP
Size 96B
SHA256 2eb8a64a98889382e7c214ba5650112da063e0c3c3c9e1be3f79830769c97dfa
MD5 c98b3c00ca6d1e8e651b7eb38cd5d7e8
SHA1 4603675b0b4742a9fbfeeec78b62da0e96a0ba06
SHA512 0853b3c0263aa8f7ec628e6b5bf1db441ea328b1e17bfd1c2f4290e2b36c3584eb77b327c62a081072b86497025bf76ac0edd6786d88cbeba1871e79b9bbe663
TLSH
T1E9B02222C2032223C00203F02A82C0C8B030CF3CC20302038AF00A22EC322208C20020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 df44a2d4b9c96e93b2223c130a9db811fdd59952e383f470300dab30afa27f87
MD5 8092014b2c6f784a4522ee7068c36a9e
SHA1 5116deefb17074664658d5f7faffc741a57a2806
SHA512 2c44d08b6f3f2e027ba83457245d1dc7051163319ea15d58500806e144ce4161b69a4646385659b240582ae086b2b008ed4425d18caf323bb22ed56ee8f42d7a
TLSH
T15FB022E002802C03EAA023FC22C200C03330AE0223C3C08280E8C200BC03B038AC2300
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 90c5324a4e583eb1ad79053aecd479f717bb7d0393231271385a4b66c66a9449
MD5 7188e6b912b62dd5e0887f211f698d50
SHA1 08432276dd8a27f0eba56fd77e00dc5f2adf7614
SHA512 f20bdff2969a42020e231e50f275b64551e15ba335cb856e3d2e17ec54ed50b14da010e8f2d9abbc2832940b0e0e46a42decb854f90b4dc09a5241167c15d354
SSDEEP 3072:Z4+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:Z4+hFD+7t56OD9ZfSAppr2
TLSH
T11ED31232AA95DCBB8AFD6541F157A300DE72ACED41DE3A0984465F8AD09FC4D0763A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 35a7dab082dc6c4cfe55b69dfc175c4f44a815c8472d294015512de484d0f6b3
MD5 545d1fcc409058bcaadf044f89e7e137
SHA1 186491101efba69ee10f3555660f122b3fd7c78f
SHA512 cce6c49e1242219f25bfa50d7a8b9094f58ccfcffb621a763e3431322362e157434c247d27c3d444406523ab9e81da8b6a9efbcc9dc70bae2bce2d17b5a14364
SSDEEP 3072:O4+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:O4+hFD+7t56OD9ZfSAppr2
TLSH
T1E5D31232AA95D8BB8AFD6541F157A300DE72ACED41DE3A0984465F8AD09FC4D0763A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 ae817770f30ea1c468c8e0fdf30a03e7a35affe7003c5c37339f92cd0432a80d
MD5 249ebd0d73ef35127b560d88945e1b10
SHA1 d3bc040b0fb4ec50ea89a3898dddef00396f0c17
SHA512 7e5f33638b41dd2837e47aee2a05b30dadb38fd764c620929cc9b83e84083b680169a739dbecf9e27a72bd037c983254c981572c22e94f27005e46c87271c063
SSDEEP 3072:B9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:B9+hFD+7t56OD9ZfSAppr2
TLSH
T12ED30232A995D8BB89FD7541F147A304DE766CEE81DE3A09844A5F8A909FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 051d8b08b2d4dd155b327f16ea92e6dff942e02630f255f0739a1f8aeee123d8
MD5 c8a913d4840014537aef6f98aa01f77e
SHA1 9a0c107aaa1b867168038b52d23297e725f459b7
SHA512 fb6bd16969560815e693a6fdaba1313e5e2eff80f9a963a5fa808437e3ee54998dcb461af2511f63307dfcc5bb97b0777c1b93b24de62c5c1cb4ab5ebdf4608d
SSDEEP 3072:S+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:S+hFD+7t56OD9ZfSAppr2
TLSH
T1AED31232AA91D8BB89BC6541F157A304DE726CED81DE3A09444A5F8ED09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 dfa92eda11ef981275f339eaa50532b1e8024fe8adef42da187a66520ad3e878
MD5 6fffe7f59bed07ac4c0cc6ab8fc38f24
SHA1 334e12135eb3c99936b10dc53cb509f311995c99
SHA512 321a557465d3a0fd0b24b2e69d9c4b4d8eb050839ef9c23ddacd10c6d26f2ca61846467a10202e52ab13c14b22d8c24f4355191132221a3d56db1b2b28ae8d00
SSDEEP 3072:e9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:e9+hFD+7t56OD9ZfSAppr2
TLSH
T137D30232A995D8BBC9FD7541F147A304DE726CEE81DE3A0984495F8A909F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 81c06f9c5e748cb8dcdeed954a2cd2e1bf752c38962e17a97b399d25efc86a3f
MD5 babb66b776d4881a674bac1cc5802180
SHA1 8dd0695b9c3a835bb2ea670df0e4a3a2ca7935bd
SHA512 4dbf1ab81d87cf7171db7bfc00ceb12283a9cae4424006d870c3a429e7ebcae39710a7e7ac0c20bceec24ad59f7b50f130a3b3cb16c60a411e51aef9cf0e25ed
SSDEEP 3072:a4+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:a4+hFD+7t56OD9ZfSAppr2
TLSH
T190D30232AA95D8BB8AFD6541F157A300DE72ACED41DE3A0984465F8ED09FC4D0763A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 c3bf23b9933c24a1774dc4788c3c4f9d3a0df8d70e2586efbf16701ab8141bbb
MD5 64c1ee8b2f81b8d2fcb72ec9f538acaa
SHA1 d8ff57371698fce8f392fd465b46a13f66fecf94
SHA512 eb9c727398466986d3427d90fe392a5dc4c407afd12ffaee8e9f64912a611197bbcb79a80848e249ad54bec781112839e78910256d9b1f8e0e573ddc66b19c28
SSDEEP 3072:x9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:x9+hFD+7t56OD9ZfSAppr2
TLSH
T12ED30232A995D8BBC9FD7541F147A304DE726CEE81DE3A09844A5F8A909F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rf00026_nfe.pdf

Path C:\Users\Admin\Downloads\rf00026_nfe.pdf
Size 77KB
SHA256 b7203db524cdb755b3b0733005f2b4d84628376f981d59693f459773db7257e3
MD5 c327d98f83f3f036f7a8d65100305af2
SHA1 38f0791ced7fae2a5ffe3fc2fe506695be399b76
SHA512 f0844a11923c5243072e873cce64ca235cdea56181adcdd7ea886dfbe0e14954d710bc35109fe1eb1bb99cbade588ef0e4fe70617bd2260462c14128b937f34d
SSDEEP 1536:I0placxCkP2T1/d2LhQcimvoJxW/wbIgDAIzWW0c:RnCkP28eDUobzAI/l
TLSH
T1D9730116CEEAEBFCFC5AA50B117479D48894FB3147DC28C002AE059E419DD893E634AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download