hxxp://discord[.]gg/olemad

Analysis

user interaction
yes
max time kernel
600s
max time network
600s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://discord.gg/olemad
Sample261104-ysdx7aef25

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2512	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{EBFD4C2B-64E2-4B7F-80A5-132610FB637A}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
2072	chrome.exe
2072	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe
Token: SeShutdownPrivilege	1748	chrome.exe
Token: SeCreatePagefilePrivilege	1748	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4376	1748	chrome.exe	88
PID 1748 wrote to memory of 6104	1748	chrome.exe	90
PID 1748 wrote to memory of 2512	1748	chrome.exe	91
PID 1748 wrote to memory of 6104	1748	chrome.exe	90
PID 1748 wrote to memory of 2084	1748	chrome.exe	92
PID 1748 wrote to memory of 2084	1748	chrome.exe	92
PID 1748 wrote to memory of 1524	1748	chrome.exe	94
PID 1748 wrote to memory of 3796	1748	chrome.exe	95
PID 1748 wrote to memory of 1524	1748	chrome.exe	94
PID 1748 wrote to memory of 3796	1748	chrome.exe	95
PID 1748 wrote to memory of 4608	1748	chrome.exe	96
PID 1748 wrote to memory of 4608	1748	chrome.exe	96
PID 1748 wrote to memory of 5668	1748	chrome.exe	97
PID 1748 wrote to memory of 1588	1748	chrome.exe	98
PID 1748 wrote to memory of 1588	1748	chrome.exe	98
PID 1748 wrote to memory of 4648	1748	chrome.exe	99
PID 1748 wrote to memory of 2204	1748	chrome.exe	102
PID 1748 wrote to memory of 2576	1748	chrome.exe	101
PID 1748 wrote to memory of 2204	1748	chrome.exe	102
PID 1748 wrote to memory of 2576	1748	chrome.exe	101
PID 1748 wrote to memory of 5040	1748	chrome.exe	105
PID 1748 wrote to memory of 5040	1748	chrome.exe	105
PID 1748 wrote to memory of 4792	1748	chrome.exe	106
PID 1748 wrote to memory of 4792	1748	chrome.exe	106
PID 1748 wrote to memory of 4784	1748	chrome.exe	107
PID 1748 wrote to memory of 4784	1748	chrome.exe	107
PID 1748 wrote to memory of 2388	1748	chrome.exe	109
PID 1748 wrote to memory of 3044	1748	chrome.exe	108
PID 1748 wrote to memory of 2388	1748	chrome.exe	109
PID 1748 wrote to memory of 3044	1748	chrome.exe	108
PID 1748 wrote to memory of 3736	1748	chrome.exe	110
PID 1748 wrote to memory of 3736	1748	chrome.exe	110
PID 1748 wrote to memory of 6516	1748	chrome.exe	112
PID 1748 wrote to memory of 6524	1748	chrome.exe	113
PID 1748 wrote to memory of 6532	1748	chrome.exe	114
PID 1748 wrote to memory of 2308	1748	chrome.exe	115
PID 1748 wrote to memory of 2308	1748	chrome.exe	115
PID 1748 wrote to memory of 2072	1748	chrome.exe	116
PID 1748 wrote to memory of 900	1748	chrome.exe	117
PID 1748 wrote to memory of 900	1748	chrome.exe	117
PID 1748 wrote to memory of 1152	1748	chrome.exe	118
PID 1748 wrote to memory of 1152	1748	chrome.exe	118
PID 1748 wrote to memory of 3612	1748	chrome.exe	119
PID 1748 wrote to memory of 3612	1748	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://discord.gg/olemad
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff870e3c728,0x7ff870e3c734,0x7ff870e3c740
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,5422113797508891145,3825693448347458229,262144 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,12442473716388189117,2065368467069423930,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,4328481228748294761,17310114636905646051,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,6493243364486748968,14352108306331837863,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,15803537816543722332,4551314353901668275,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,4626441191561725836,17055454397739375844,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,5946850971807505218,15131934074749654699,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,9295167919607497245,14062596646965686740,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:12
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,16247986980043115951,9355788338137485528,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5916,i,17223538719581452199,4052634685350314165,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5888,i,4833414292257898830,2466844405155657750,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6236,i,7196604343931644601,10559755332167171737,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5272,i,9474334887193390473,5518698438476468749,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6260,i,15123301180270364251,70638667438530441,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6376,i,7098117106499383493,3346070687287932938,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5812,i,6056912281625954894,15296310542601034202,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6188,i,2496030717186228350,746864913064969822,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,2149312918491979610,7642215927643461220,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:6516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,12369463160519250731,2979652932576726159,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:6524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,9604274186692177350,17807104946432913459,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:6532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4748,i,3940589121841245102,17491935824662505987,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6136,i,16867022121340154729,13649526851650116802,262144 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1736,i,11377559596926211723,9244838498142453391,524288 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6408,i,8559171938870815792,13481002228382871605,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4792,i,15460088975351980171,3746731902024652305,2097152 --field-trial-handle=2000,i,1144825770732005481,1754163691454819908,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09b41fd8-accd-4906-acd6-48d23bf16da9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\09b41fd8-accd-4906-acd6-48d23bf16da9.tmp
Size 5KB
SHA256 3d41f38521f4e49870dd86783b44114f04c7f3e21465195306ec730614478285
MD5 ce3124dfcf9b72c8e2977a322d75b8f4
SHA1 5a6157415de8ac0801e477f826e2345731fe1954
SHA512 25d65a25b5f367b295a92cf22152244287763e833cddb4b4cff447643a22c42f7c513e8d717f1fa81b3e832c70924eb53b56f29142a2b5e68ae0eb357ef9bb66
SSDEEP 96:NbJ0d+qw+CWJKhPPf36vatMSl8h4otop52vYDtB6EGyvr7jAixwzFWUp2KQef0ja:Nt0h2WJiipiU2Kuz0qj9x7Up2K5fUY
TLSH
T17BC11B71A47C6C7796F7D641F4032D47CEB422AF96146E64EAD91E1900F71EC2782623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

468ca1c3-04ec-421a-b72c-292ec6f0a0de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\468ca1c3-04ec-421a-b72c-292ec6f0a0de.tmp
Size 4KB
SHA256 cd06200f1a609c9f42fd6c518268f5a56f05b8b8ea6ac95b2a984ac43ec6e250
MD5 53ca6e52cc5a9b208429982c55ac9e13
SHA1 b2e08891339cd10aab6db9cc310da8dd28dcd119
SHA512 8ca61a1c8ceedf4cb34b17b0bab09f167082049a581efe99a37cd438f929ebd81469a00e4b7f53e1ae8f41477241aeca8f4e034c889b674b7752bbba5246e96b
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok52vsDtB6WGyvr7w7Qesbm3v4a:9C0h2WJiiniDUDK6zaqw75sbC
TLSH
T11BA1F97294685C7B89B7CA85B8832A07CEB4226BA521BF50D5DD1E0C11F72EC1393A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

863ddf33-db48-4632-99ef-d7187a25819c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\863ddf33-db48-4632-99ef-d7187a25819c.tmp
Size 5KB
SHA256 3c43073498c2e72569980c1c273b8229f2f9d67dae53cf09641128029bacc53d
MD5 515c72e0a130d69cff9ca2edfdf4bd83
SHA1 c572dadf33d8114ff6c72add0a659d19b1e1927b
SHA512 472981b7640c5b443346e049fb11f3bbf48385aa6bac63bc8840095323050c47cfb313a977de0785b675b8c7f539a4f18fb1d4fa5d628487f9a4bc246f933ec0
SSDEEP 96:NC0d+qw+CWJKhPPf36vatMSl8h4otop52vYDtB6EGyvr7jAixwzFWUX2KQef0j9Y:NC0h2WJiipiU2Kuz0qj9x7UX2K5fUY
TLSH
T11EC11D71A87C6C7796F7D641F4032D47CEB422AF95147E64EAD91E1900F71EC2382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56822e6e-c232-483f-8aaa-ee62a81bdc52.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56822e6e-c232-483f-8aaa-ee62a81bdc52.tmp
Size 12KB
SHA256 0d2f0a644498872c2710f02a70161e69cdd7dae905fa5249cd1156532c28348a
MD5 52ef28bda377bdcd80f884612d31cc94
SHA1 122bcd78a721051518f50eeee86ff182a0b6f078
SHA512 ff459c5b11c542b64895a1aabbe523c711a7f9b9c20b364e5955590dcee7cd63da5c8ab653ee8aed3fc5869544b0f426e0fee2c05b9d506335e28e8071dd6975
SSDEEP 192:xBRwm6yA62v7uvdPRptY29JHsb+WNnMVlPPYbt2Ku9kwWVyIsnAUgE:xBRw89CStXVHwWxYZ2Ku9OE
TLSH
T10642C729ED50793BACDFC629F951BB57E6F5102221912F84EAFC892C24E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6de4b61f-0595-45e0-9019-ff7df7b22085.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6de4b61f-0595-45e0-9019-ff7df7b22085.tmp
Size 12KB
SHA256 539bb050f1b0b88060870cf3206d7f4ca0e81158b131f235f1a0c18306206f7f
MD5 641a4363b053b0cd3af51d8b4985195c
SHA1 31ec03ac8910de13ee2feb2b289d50ffbb194cf7
SHA512 1e57c7bd81bc2df029bdabe19b31f87ff6044a9aa5e38289933513ff9f7900e75bc985c29a39d1b01a949773b01179d563b4f0cbe6383160572e9d254c931f85
SSDEEP 192:xBRwm6yA6bv7uvdPRptY29JHsb+WNnMVlyR2+t2Ku9kwWVyIsnAUgE:xBRw89jStXVHwW62y2Ku9OE
TLSH
T17942D62AED50793BACDEC619F951BB57E7F5102221912F44EAFC893C24E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 bb1ae0bbbd23fb1859cd882e4a345df211fb22e724db8ab5c2e93ee2b2bc1f37
MD5 40cea4c18065e8389a48f04806327472
SHA1 f9a9293fee48c3c10f96af97efa8ce4a513dd83a
SHA512 f0a15e2b2d346035c637c2f1318add9ac55359e2fa4a5f344be6f16de6633e01b6bc787b42bf1edb14d750742c035018b1f958713e5da0afc526a001e0255014
SSDEEP 96:k+Czm34Q0qLwXRBWc9hzDqMkvJIy2x8VUtO2Pz+DSiulB:k1M4YwBBXhzeMkviy2xZ1zbii
TLSH
T1A3E15D1888BE1575C70862BC43D13B49733E6ADCD0B70F3B327016F90926B819B6E5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 2f065d085437c57521f6214bed13195155f011a8d0f3a59066ab35c11393e410
MD5 66b4e71baa3e39c8ecd67cd8c510201d
SHA1 b92cdc6d10f8a0dda294b520184afea86fdd4cef
SHA512 5408ba714cb331cda804dfaf1462c4f3fe0870d6c422f8f4c2a8d32152f7ed850736085eb679eea683b399f1e600c6bbe351cde01a1f807e83c87141ffb58bb6
SSDEEP 96:vCzm34Q0qLwXRBWc9hzDqMkvJIy2x8VUtO2Pz+DSiuld:KM4YwBBXhzeMkviy2xZ1zbii
TLSH
T11EE15C1888BE15B5CB4862BC43D13B49733E6ADCD0B70F37327016F90926B819B6E4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 c5493d72545dc4febee4a6757ccf80b9a51e6951f863fd9e79814a176b4f88c2
MD5 73228c56e1bdc9743b6ed8cf3d57d6d8
SHA1 491fcddad35efaa9a4af6522de1439381f070770
SHA512 7f17824dd348905ef7a08abf67db877873a1356c3e53cf654fe942157b7a24745990097620dc9b3e279971d71c9ff93405a33a19619096388654a055b54c3c29
SSDEEP 96:PCzm34Q0aLwXRBF9hzpMkvJIy2OUJ2PzaSiulz:qM4wwBBjhzpMkviy2JKzhiE
TLSH
T126D15C5884BE64B5C74962BC43D13B49733D6ADCD0B70F3B32B016F90926B819B6E4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2442c111-86ee-443e-96b1-8b5958d7c418.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2442c111-86ee-443e-96b1-8b5958d7c418.tmp
Size 2KB
SHA256 7c0d4d1853c8683be04d6aad7dbba77f79a34382f7de7e1d2d4a0681cbb6eff6
MD5 fffce972c11f17566a6e5a731adbdb20
SHA1 ab1ad4af0cfadca22e1a09ce9f1dace898d7b208
SHA512 a24bbe65f5e225ba3ac51459dc08f7edafcbaeb68a4096f2106b9db4bef47d9e697c2956a138783e486008b45655be6f7cd021e4df8aef90b8dc2a0f7105bc62
TLSH
T1C4519BF787E88A2DCA1152F49B156E1FCE291924431C3C76C8D4AE5F97E2572E28078F
MD5 SHA1 SHA512 TLSH

Submit Download

6c13bc8a-db36-4aed-84de-73469c3e391d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6c13bc8a-db36-4aed-84de-73469c3e391d.tmp
Size 6KB
SHA256 5b1d02dafe0075cd8b48d5dec2b61d746ebf16d4ec0fe336827e5c47197adb00
MD5 6ae6dce2f1d0c156d46238051295486e
SHA1 57728ebf4293d792f7189da2eb26fabdd33ca789
SHA512 f4190d6d950b71d1b5b50eb54dc2109936ed21659fcf8ba48f485ad54e3a0d0fa4ffc79e80f71d7ef55e90c4532299526f4f4a3853dd04f87867d4a8ce70bd6e
SSDEEP 192:DjKfLNfQHtEaIaEd7SWrFcKKhPqlgLHWAKLF:DjKfLNfQHtEaIaEd7SWrFcKKhPqlgLHE
TLSH
T1A8D17BB7C7E8C72DD91156F49B147E1ECE29292483183C3AC8D59E4F93E25B1F28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a55a212-fb6c-4632-a979-c01563f5f6b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7a55a212-fb6c-4632-a979-c01563f5f6b6.tmp
Size 5KB
SHA256 0223fcc90a88eeea8fc567ed57532b0c009879ee08d38e32b9da86f3996ba3c4
MD5 7c2d0f8fd5ce5f2fb7fbae85da89fcc3
SHA1 2081e99dad0b7d51611744c209d2ac6051a6530d
SHA512 00cc05702c8fb8bb3d954ce4f4e8e57ac0d7b5a4a324137e3ecdc3510374bc74a66e8b6cab8e2dda5b2ff78bc1d7bb5db7c5df081e65e247cccadef81608a64a
SSDEEP 96:DuquAmuQuiu0upuwtEaIaEd7SNueFuiubuDuquCZuzLHWiLXK:DrTmNLNy9tEaIaEd7SNrFd88TngLHWie
TLSH
T1D2B188B787E8C76DD91156F49B146E1FCE281824431C3C3AC8D5AE4B93E25B2F18178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac41179c-f1bd-4c21-ad24-dc1e9b805afe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ac41179c-f1bd-4c21-ad24-dc1e9b805afe.tmp
Size 4KB
SHA256 d5fe6e51abd9f5bf0ef6ef8ed0847ba042610924385dadd565b69e177c8d5d6a
MD5 b6ef174de25081b4a0e6ddec419c7ff5
SHA1 01b9bdf0adb421e537874276da54baf6f9dacdb7
SHA512 d0ef55f7c723bfe9bee3265f448bf39f6b0eb4dd2d1b12dfd561f7c7d049e36320ec98754fa943ff767cd3104d7c2fc04eab385de22bb2ed2a98b3fdc3eb115b
SSDEEP 96:DuCu1fu+uku+unuaaIaEd7SWueFubu9uFu83/uC/Pwu5uM:DjKfLNfQ7aIaEd7SWrFcKKFv9Pwwx
TLSH
T1ABA189B387E8872DD91156F49B147E2FCE292924431C3C3AC8D59E4F97E2572F28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd01109a-da69-470b-bb42-ef4a0999eb6c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cd01109a-da69-470b-bb42-ef4a0999eb6c.tmp
Size 1KB
SHA256 6bb60f2c52f1e6135f84ba8ecac25452e21174da379bd5e3ec34412c161abcf3
MD5 a58a25cfd5083d7e29c6ba413d080563
SHA1 d0a0c442bb60cc125c134c1669fd26f52751b356
SHA512 eea0ca838588d8d158d1b381b6818dbabc299ec4acbbae80c9a10d162e70e8b914c7d5d630785de5e42290f655d49615a7124b5db4541df5172b404f143ea878
TLSH
T103418AB7C3D89A7D894167F4AA116F1ACD2E0A18521D3C16C8D4AE1B53E2DB2D60029F
MD5 SHA1 SHA512 TLSH

Submit Download

d556c549-08b4-4d6a-b21a-dca426c69c75.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d556c549-08b4-4d6a-b21a-dca426c69c75.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 db571acd0e1a6f9190706b400f48292654cb8a066a6aaac490d178da8639424a
MD5 9ffc064d40e1cc4a9f3903e79a4a4b75
SHA1 04ba82f4dadad9fbfdba2bef25ab03bda0241ab5
SHA512 e7ec325a4951a4a01c6b4a7ea7c0c2aa6a115c953b98c3de07d7e8dc8a0093bf20cd991eda34b0a685cd9f8c7b2a6b1c727a94dc1d16cde4a3cb3b8fb1e73611
SSDEEP 192:xBRwm6yA6bv7uvAPRp2Y29JHsb+WNnMVlyR2Pt2Ku9kwcVyIsnAUgR:xBRw89jS6X0HwW62l2Ku9YR
TLSH
T1DC32C529AE60793B9CDFC629F9217753E7F5102221851F84EAFC893C24E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 e6d44abfb89a300c8a3164be407f2858cab04e1e591e1d35a49c45a233a4c9f0
MD5 f2b636e63dd39bea305a0f717a005cb7
SHA1 dca9f9b046ac4c5dec2833c9e7c46c4c827b6e6a
SHA512 27dfda13540cf58e6d810fb81a7e1d361ae516502addfe54a0690d65c65cc8207646fbe0369eed9491971e6424a5497c0e59043e9873302ab677bd44856df5ea
TLSH
T1C8C02B73A2B90901871407C30332557D87052CCC88C6C44D7003382C6038F337243FD2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 8d0234ba34d84110b2183d577ca89e25fbea2c840d674603f08dd9b580160bf3
MD5 ecdbd6ad67a01926105eb772e2076667
SHA1 59775ca7305a3353183193fe0ca25ebaedb4a88a
SHA512 836a86f4f5959cf06e563db43aa42f636b3eea90cd47b4eb2032e6142ca099d810086df33bbaf05d2afc12eb3e1d2d007a2527ba39289c897c1b6fbfbda2f7f8
TLSH
T100D0973BD6750040D22F0BC30A2104AA87312CC8E484A008E003382CD834A5BD311FD6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 f209959b4bd4bd887d5c1f0b8a29e688a16fae0bdcd2b6daf8e7144a2e31bf7b
MD5 1a383331cdd233fd1e30f9549aa30a81
SHA1 22c99e9e3c5b6a18c51d3b9c32963ee770d8dc94
SHA512 e2fd1a782cb55bc765bcee2d42d309742d95b4ca936e77051ce20c4a70cebf6c822a27a60e30d0bdea15b08ffaf6a536315ce92dea8abb50444ec000f1bb2c0b
TLSH
T109D0973BD2780040D16F0FC30A2104BA873038C8E0C89008A003083CC804A6B9202FD3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 2cfa63c9e329c46a4957c70000c3d38f01e24582e4857ec6bea33a622afe85a8
MD5 14b5b4b89861e31c9a4f6d3eb4506731
SHA1 83be10e36d525ebba1dd634b0b2d5e75db88a2b7
SHA512 76b2dc3cf02b75c71eb73622ec6f9a9dcb5e7c29b9b7b5578bf27256bccdeef280ee6130bff2f21779b12a2047f7820bd22fbbbb31c0286e53f2ac52effcab83
TLSH
T126C01277418166927B7934E7615231D8C5367FC85CC0DA8D4411300831349561405924
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

ba1c2bb8-db08-476c-adbb-f6659fc0396a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ba1c2bb8-db08-476c-adbb-f6659fc0396a.tmp
Size 12KB
SHA256 2cd77ea2aea03d87163a46ab67b56ffef6d082e127bfac4469f58383613ff6bf
MD5 778ac724fc657331e3e0d2ee408896ff
SHA1 43f2f8b7df79d262a1c0ecf039f89b9286622063
SHA512 29a08be6a95188689a9cc6433004adb1d3d0638460f80715a49e6555fe79ea01aff096b53227f93832c117849d3b7c582802aba8ea5b125805274525f5e33d6c
SSDEEP 192:xBRwm6yAJEv7uvdPRptY29JHsb+WNnMVlPPYbt2Ku9kwWVyIsnAUgE:xBRw8cgStXVHwWxYZ2Ku9OE
TLSH
T1C542C72DED50793BACDFC629F951BB57E6F5102221911F84EAFC892C24E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd554135-e7ef-4dca-8dad-060af1da5629.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd554135-e7ef-4dca-8dad-060af1da5629.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bf0344ee-4413-4980-9bd8-4459ecedf1f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bf0344ee-4413-4980-9bd8-4459ecedf1f4.tmp
Size 13KB
SHA256 229ec8a3255ae1357cf4161855ac772c05727e4b59965cb1f01bd72c9c2e9fe9
MD5 4ddb8cfb33dccffe2fcdad20db413830
SHA1 0c1d3b3c78b74e8b615eab915cdef94313aaa5ff
SHA512 d6fb3646b36873b728b25cebc08f07a59405c800a76fe6a76f28adc5de36baaa85130c808b5791989789c6501d457bec544dcd8f38253967af0f96bd53a432bf
SSDEEP 192:xBRwm6yArEv7uvdPRptYUR9JHsb+WNlaMVlPPAoEq2ct2Ku9kwWVyIsnAUgE:xBRw8OgStXFHwRxAy2w2Ku9OE
TLSH
T1CF52C62AED60793BACDFC629F951BB57E6F5102221811F84EAFC892C24E76DD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5977388-a255-45ef-b22b-fa0f5343dd62.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c5977388-a255-45ef-b22b-fa0f5343dd62.tmp
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d152b003-76b3-44d9-b155-3779e6c19074.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d152b003-76b3-44d9-b155-3779e6c19074.tmp
Size 13KB
SHA256 b3e04ffbc0678843290fe1dd411973ad9b7289e0b5b5fff269559d96458d4a47
MD5 bbf710544f342b3a901bab58e7738038
SHA1 401a0f7054861f03ff7458d9a16ff0461a8fc2af
SHA512 0c74c3649048d5b3a6752a22813fd1bbd1c835556cee355ae39067ba1e5f37b9c347563d87885f9ef29da37bfcec161ad6d673d126a12b8376b004d0f482d19a
SSDEEP 192:xBRwm6yArrv7uvdPRptYUR9JHsb+WNlaMVlPPAo8ieYt2Ku9kwWVyIsnAUgE:xBRw8OTStXFHwRxA2eE2Ku9OE
TLSH
T19252C52AED60793BACDFC629F951BB56E6F5102225C11F84EAFC892C24E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf6c1a62-ea27-4f10-8985-9b9a1f838bca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bf6c1a62-ea27-4f10-8985-9b9a1f838bca.tmp
Size 5KB
SHA256 d285d772ac0218ba7178483cfd677295388c4bded9350389874458bdb2a2ee94
MD5 cc7182ac27b83534bf1d86e5a567198c
SHA1 dace20c4bd421ac129c23a5cc819ab0feaa9e033
SHA512 ae76b6efff745996c24b66ccbd705e4e047cfe6691993a6f28d5a82e0a8f17f9bfddb8e2746e2f567d5b961cc0a937b0c4e53bf1719ecc47a7c9ee1bf205312f
SSDEEP 96:NbJ0d+qw+CWJKhPPf36vatMSl8h4otop52vYDtB6EGyvr7j+pcKQecRNC39ISyVN:Nt0h2WJiipiU2Kuz0qj+pcK5cuCnN
TLSH
T1C1C1F871D46C6C7B8DF6E985B0032D47CDB4226B69587E64E9ED4E0801F76EC6383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db8ef900-b320-45d5-acb3-607082a8eb9c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\db8ef900-b320-45d5-acb3-607082a8eb9c.tmp
Size 5KB
SHA256 96ba96074b4be50aa085bfa5d14cff39fefc412a81e9178bcf70bbf6c1d7bfb0
MD5 c117d657ce4b589144886ac15f91cee4
SHA1 6945d9927cc4cb96bb44762b1355a3b654877829
SHA512 d4d2a34b279f5b0bdef15f70b6e729c60483979dcc08b2a341e037934e0f2668e5e80ab1329ac899756abec2943dba0a7a65868ed83e91102786a1f4c446fb0d
SSDEEP 96:NbJod+qw+CWJKhPPf36vatMSl8h4otop52vYDtB6EGyvr7j+pcKQecRNC39ISyVN:Ntoh2WJiipiU2Kuz0qj+pcK5cuCnN
TLSH
T193C1F871D46C6C7B8DF69985B0032D47CEB4226B69587E64E9ED0E0801F71EC6383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download