59dcd04d643fc1e02ad46dc0c2722896c53174c6b7ce5432b0f07eb3ddf94c53

Resubmissions

15/04/2026, 16:59

260415-vhp1xshs3w

15/04/2026, 16:52

260415-vdttbaey2n6

Analysis

user interaction
yes
max time kernel
318s
max time network
320s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OsuBuddy-Debug (1).zip
Size 283KB
Sample260415-vdttbaey2n
SHA256 59dcd04d643fc1e02ad46dc0c2722896c53174c6b7ce5432b0f07eb3ddf94c53
MD5 e873af38970ccc05fa86e69b0973c31d
SHA1 f4afcd64a536bf12e81cee64c1f26a4395701faf
SHA512 c4cd257c54882776d30eb1edfa8745924f8a5bb1dcea0bb1924818bfc2ccb3c52913bbdc3607ade7a9d65c9b1d161d8bbbdac0cdc9a255f8b8ea219500c0eb52
SSDEEP 6144:wxeMFdVraqgPnKRLQBh8xpTPqnT+8wJ8rnL/uPttM4pi1Q/tO4f/Z9xl:QrVra1iRLQBh8xpTPa5wCjL/Ym5T4fL
TLSH
T14D5423AB47E4C43E66089DB05BEC890E1AC59630B903FB719CAF151D8D94CCD26E7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2344	GameBarPresenceWriter.exe
4592	GameBarPresenceWriter.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OsuBuddy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OsuBuddy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OsuBuddy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OsuBuddy.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207456934881619"	chrome.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{3F73CB24-28EF-44E3-93CA-03E8B43F2DA7}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{7C77CA4C-63C3-4D4F-96CF-F5442F034FA4}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{374E5316-3EF6-489E-8D2E-CD5963F6B517}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{7A400DC5-EEEE-4A0B-83A0-AC3FAF42EB31}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{D15368E8-ECCF-4D67-B467-053226021DB4}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OsuBuddy-Debug.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\simpleunlocker_release.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1628	chrome.exe
1628	chrome.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe
1568	OsuBuddy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4404	OpenWith.exe
4200	OpenWith.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4452	1628	chrome.exe	84
PID 1628 wrote to memory of 3252	1628	chrome.exe	85
PID 1628 wrote to memory of 3252	1628	chrome.exe	85
PID 1628 wrote to memory of 2348	1628	chrome.exe	86
PID 1628 wrote to memory of 4120	1628	chrome.exe	88
PID 1628 wrote to memory of 4120	1628	chrome.exe	88
PID 1628 wrote to memory of 4216	1628	chrome.exe	89
PID 1628 wrote to memory of 2288	1628	chrome.exe	90
PID 1628 wrote to memory of 4216	1628	chrome.exe	89
PID 1628 wrote to memory of 2288	1628	chrome.exe	90
PID 1628 wrote to memory of 4464	1628	chrome.exe	91
PID 1628 wrote to memory of 4464	1628	chrome.exe	91
PID 1628 wrote to memory of 4276	1628	chrome.exe	93
PID 1628 wrote to memory of 4276	1628	chrome.exe	93
PID 1628 wrote to memory of 3196	1628	chrome.exe	94
PID 1628 wrote to memory of 912	1628	chrome.exe	96
PID 1628 wrote to memory of 912	1628	chrome.exe	96
PID 1628 wrote to memory of 1164	1628	chrome.exe	98
PID 1628 wrote to memory of 1164	1628	chrome.exe	98
PID 1628 wrote to memory of 948	1628	chrome.exe	99
PID 1628 wrote to memory of 1108	1628	chrome.exe	103
PID 1628 wrote to memory of 3536	1628	chrome.exe	104
PID 1628 wrote to memory of 1368	1628	chrome.exe	105
PID 1628 wrote to memory of 4944	1628	chrome.exe	107
PID 1628 wrote to memory of 4944	1628	chrome.exe	107
PID 1628 wrote to memory of 3132	1628	chrome.exe	108
PID 1628 wrote to memory of 3132	1628	chrome.exe	108
PID 1628 wrote to memory of 4568	1628	chrome.exe	110
PID 1628 wrote to memory of 4568	1628	chrome.exe	110
PID 1628 wrote to memory of 3672	1628	chrome.exe	111
PID 1628 wrote to memory of 3672	1628	chrome.exe	111
PID 1628 wrote to memory of 2572	1628	chrome.exe	112
PID 1628 wrote to memory of 2572	1628	chrome.exe	112
PID 1628 wrote to memory of 3664	1628	chrome.exe	113
PID 1628 wrote to memory of 3664	1628	chrome.exe	113
PID 1628 wrote to memory of 1640	1628	chrome.exe	114
PID 1628 wrote to memory of 980	1628	chrome.exe	117
PID 1628 wrote to memory of 8	1628	chrome.exe	127
PID 1628 wrote to memory of 8	1628	chrome.exe	127

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\OsuBuddy-Debug (1).zip"
1⤵
PID:1464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b3e5c728,0x7ff8b3e5c734,0x7ff8b3e5c740
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,17000258082864169010,8124851071899685816,262144 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,13426699691202939985,4432328363734841732,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,5622163833026976838,9689752083976830865,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,18043820468401740351,4580822124534695618,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,6736210417223751028,13138071671699452255,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,14683053401497669048,8816239877918649641,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4204 /prefetch:9
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4620,i,17952629820378808512,14193695624069050889,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,15622245885563689095,7295591480550450851,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5752,i,9412245982423843821,8620409206978561918,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3276,i,7831624095771618107,10644407617258879104,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,14788325693290112380,12657595172994841629,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3340 /prefetch:14
  2⤵
  - NTFS ADS
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3080,i,15817758573491602424,9134596168436772241,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3384 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,5026771364405988021,12343513221190137913,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,17303242877052071423,9146935122820902612,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4556,i,12515029953816123530,13332908688397339365,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6100,i,4373161252675740836,3367605718898190484,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6324,i,5866685819510698929,13209859805446560966,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4300,i,8844403995722849008,15612773102853193073,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3812,i,2421247221558469181,7162936933762534657,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4180,i,1878684865202826514,15244189237367761117,2097152 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6476,i,9080252580147247821,1546975361980046242,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6484,i,9923122707526951274,6297377278134233416,262144 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6392 /prefetch:10
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,7091399124451065419,18360683625486361942,524288 --field-trial-handle=1908,i,15924285063262967085,7378096195252790842,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:8

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1548

C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe
"C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1568

C:\Users\Admin\Downloads\simpleunlocker_release\simpleunlocker_release\osu!.exe
"C:\Users\Admin\Downloads\simpleunlocker_release\simpleunlocker_release\osu!.exe"
1⤵
PID:2592

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4528

C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe
"C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4868

C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe
"C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe" C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe
1⤵
- System Location Discovery: System Language Discovery
PID:712

C:\Users\Admin\Downloads\OsuBuddy-Debug\osu!.exe
"C:\Users\Admin\Downloads\OsuBuddy-Debug\osu!.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1936

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4392

C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe
"C:\Users\Admin\Downloads\OsuBuddy-Debug\OsuBuddy.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5578b9e85bbbcb106f764d91a0e7e5962da556705af7d2d186b423b301b383a0
MD5 0e8ce5776cc3adf41554a5fb0c2f6c25
SHA1 b21af2c67a3735833700f209a205302395bf74fa
SHA512 f0d92cf3b2b2346dad9c95834b4d1af7f3faf0eb6da76e83b01fcef48830d36c7238be800bca0c940a00051397cc7f9a65314e17dfda903eae52985c32fbca41
TLSH
T1F7E02BABD9719C3709FD0B1990504747E7A1136E2B90A46F3A3DC20C4FF5F3A494595C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 58KB
SHA256 048b6f37e7cf63001a7f160703650dfc915660dc62046870a83411fb897fb6ac
MD5 6549f6379e7dcbfa30f9b69da7d0583e
SHA1 4a7b9c464f8794c6cfac21f6759df41b504b0a91
SHA512 0f21a5d1c8ac1cbe9c7f85127fa9831f72bc98d986a2d871299ad0e3197426d4046149637b92c5be807e70d170c022c23f1e8daa87b0b6c98279059168f26e05
SSDEEP 1536:GLddTUCQBEz8UzpdsRin8V+NSyUXW2VxT4es:ydSJEdzpPn8VLW2Vxxs
TLSH
T1E843027328C06CDFD74B73B26A7D60DE5890623033617786771FDAC4A4DA10B5287A79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 87KB
SHA256 4f903fd2c42c512d5dabd8ec7ad4cca538fc2ce4d740ee07cad230d08ec9777a
MD5 cd67b2c6feaf289659a29341aa38965d
SHA1 9159f1c2ed3363afadd46320851c23454c87be61
SHA512 5cab98a99c02a97e695cde705f1139fcdf4d1074a7f4f1929b03647aa8fc86e50ed1dfacaf4b63a2dcde766c4238d3eb7dc1ef43e7515b3e5c3464035e1c24b1
SSDEEP 1536:nwiiQ4aH7yzMHwjlj8SrjrWp+LSKftZVjFmvkIhAih2tEIU0TKBRkFUxkP+D:wiXNkMDayp+NlZVj6AiEEYKBGIkPe
TLSH
T1269302CE4137D8648777CBC3506898C7F091989800B0BDD66DA99ACD3D1AA7C86F66CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6485f54ad49faa48fd29dd6e7aa1be7e5bc3515353e6227fa972a4e7a5cdfdff
MD5 e39f7d2ec95c95e9579578179f61d7e9
SHA1 e43805654ff00e0270daec687d8cf5c0adf1244d
SHA512 9898df0f91278a47a9d5d9f408f091679e3900671142967ae55e35518faca8374fa5eafcfee8262485dca10d5be6b394c5123fcb081276864290ecf8f8e83287
TLSH
T1A35183015AB6E442FB8A02341CC2AD747377A7984F0B5F467BF922BFDAA7BC4064051D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3002dd75abbb96ae2c657b8b514c5739fb37212c44a89ab0c678d00c70ad90ec
MD5 d5ea2f068438103b08fcd410fbb557ed
SHA1 3f06887c975dd2a4407ea2bbd5a70c1dcbd6625f
SHA512 e4951a14c3ae280424fa07e1275e44c9e61a7045935ffc8deefe20f6be46450df5e15365088cac3bc9a55326daa132d9aad7d862cba65a4dc9968c7f7298c670
SSDEEP 48:zuWSsMiKeTlXwFjJCJ/b67v6lfHo2jbwbnJ0foUpmh/3Oi5rY8ycnGK5YoDbJ:iBiKeqzq/o2QbnJwoUpmprrycntuUN
TLSH
T1FF913D055932D317E7412130DBC2EEF0637BE7504F0A7E0ABBF96FBAD9A2694510192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 35db2e690cfed33111fbacd6c39787324301485357a5f8b75f04824204bc53db
MD5 2b7dbe9c4e47d27c02f0788d65f242b1
SHA1 abd8c8a474724bc3e6eacdbc4d55f62d95b52f64
SHA512 dd213bec6db573ff985eab05147687a71ba93cd27e5079da7d9e496876b752f187cc0ee22a116bcaac8e05d75b378d2f45535e4d7435745768d157e2de24d3a1
SSDEEP 192:D1to1IPgmMm2rIqCIaa3FUtNLpCx509c0mmtNmrmQmEmmmg030B:D1to1IPgmMm2rIqCIaa3FUtNLpCx509G
TLSH
T144027CF7C3E5862DC91156F4AB15AF2FCE290A14431C3C66C9E4AF4B93E2871E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 cba72b2423c8774e31d2d93e6a304b9dce0d5db40fd1f1287c6876cccc42ed3e
MD5 c3b8c06c1c0e0849fbdd35baaed86a0f
SHA1 dbedf69892b2e180794154f5a1eeb74c7bfe4a89
SHA512 792a71377bbff20ad9f2c263d5ba66b3a4afab475822a3a099546080afd7c4cd39701a3fe7cd643ba110070d0b088df884d45423eb4be31bf328ffcbdbbe7f41
SSDEEP 192:D1to1IPgmMm2PIaa3gA9McKBUm6mmmQmDdgNmzmBNLi:D1to1IPgmMm2PIaa3gA9MnBUm6mmmQmr
TLSH
T11EE18CF7C7E5852D891156F4AB15AF2FCE2D0A24431C3C66C9E4AE4B93E2872E21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cfcddfab9fde2112fd3be082c6faa749c84365b9878f8f98e44ced363c5050c8
MD5 8fe0b5ff1ce2a4227944a43f34bd3c52
SHA1 353374ce2a3c2ff20aa81343481dbb559be9578c
SHA512 4234e59df30510a8c078ca65d661a504028427dd0a71f7b141318dcd369e498fa3058b05fa82877df144273a34d973adcdeda13e7fa342f6cba5559caa0647f1
SSDEEP 192:D1to1IPgmMm2rIqag/Iaa3FUtNLt09c0mmtNmrmQmEmmmg03097jC:D1to1IPgmMm2rIqag/Iaa3FUtNLt09cO
TLSH
T19B027CF7C3E5862DC91156F4AB25AF2FCE2D0A14431C3C6689E4AF4B93E2871E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b3bc500ae2a8560ce182f1c0215d7c0b32106286e5f53f8741a2d4330612f30c
MD5 16a71c5eed31b8b7b79d5f89ec4ec5c3
SHA1 d320c1196cb67b166ee76dd299f2848c17972a2e
SHA512 60427d97bc39545f6b88d9750dc62232dd4f650ab289c066a65d4b81528520f710ee2ac91d3bde875e00655f1cfc24bd5ad14352760412d95dfbe94a82234169
SSDEEP 192:2RQ5cBz7Yrsv7R4gwv7HYhPPRpDPJtR9x98Hsb+WNZYW9J4BmyWrQKJsh5EzaVyr:2RQ5mz7Mq1sEZXVb6wZX4dW0sse
TLSH
T18F62072EB954297B9DD7C229F812BB57EBF1202561D42EC8E7FC8A1C05E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 057c1061a70e6b4936a4ffe821182a99ff0f45055b5d3d22b3854525cbd120db
MD5 d2f2c0731c901c05f55c626c4e07a370
SHA1 59f459f884aa3652a9fb7357cea86960e042cbe2
SHA512 caa6443bb0de989fb225b50aa3f9271a2d9b8a6d551badb4befdc5d33682e64d7242a1567df98f84675f0591dca3f802f77b144ca5649c78e863d39032b954d2
SSDEEP 192:ZRQ5cBzHYrsv7R4Q+v7HYhAPRp2Nmo98Hsb+WNnua4426422QKJsh5EzOVyIsnA4:ZRQ5mzHMqJ6E8X86wr4o423sY8
TLSH
T1A952F72EB918657B9CD7C21AF922BB57EBF1202561D42EC8E7FC8A1C05E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e2aafb521e6b926c1613bd69211e6d39b3a879dabd2e5fb873ba0ab66183eafe
MD5 4d7ebd1e87a6ab098a1066ae75ef945a
SHA1 a7580ebaa609c7034df15efe87da5080b93b3105
SHA512 fe2ddd2d0b221c1fa62f8841b5a79b1ca566dbb2d8ee0f8a3f1881c25a47c453631996e801f93794467ebd893735554822ff069d9fa7d443504d971ddffac598
SSDEEP 192:ZRQ6cBz7Yrsv7R4Q+v7HYhAPRp2PJtS9o98Hsb+WNZYWua442642sQKJsh5EzAVK:ZRQ6mz7MqJ6E8Xm76wZf4o42psGe
TLSH
T1A152092EB958297B9DD7D21AF912B717EBF1202561D42EC8E7FC8A1C01E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a58c41bf079f3cbe1ec8a117106b80b8d3e6f80d7db80dfe6969dd16ef4f7fbf
MD5 4527cf0c4150380ddca8ef6d180f842d
SHA1 7359649eefd2352cb814567e633a81b6bc5c5cf4
SHA512 c7454e60e28f8f2e9722c912921928f7c1cbc4e4736424980d4d141e65ab2dd184edfe16d744b5446cabb33718185d2e7cd4f81a2dd3a5a366275eab127b1b00
SSDEEP 192:2RQ5cBz7Yrsv7R4Qmv7HYhPPRpDPJtS9o98Hsb+WNZYW9J4B2642QQKJsh5EzaVK:2RQ5mz7MqJSEZXV76wZX4V42tsse
TLSH
T1DF62F62EB954297B9DD7C229F912BB57EBF1202561D42EC8E7FC8A1C01E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8bb916e80c819f3f13c1e1ab556eb266863249e84d3206ea2d7087bdf8bb6847
MD5 e8e36486feaabc719c9335f6a2ade69c
SHA1 80f97875a54e1df764a7f9cd3765c29b985279a1
SHA512 120776f04fea5fef42d5256608ea4f438f68f4b53c1fda57e7cc6821eec12531c5c3e275b5bc44ed5c1d50a16b32130c2d39dce6f1b6f48f1f50c8312377bdf0
SSDEEP 192:2RQ6cBzSYrsv7R4gwv7HYhPPRpDPJtXCqx98Hsb+WND89J4BbvEuQKJsh5EzaVyr:2RQ6mzSMq1sEZXVb6wQ4hEvsse
TLSH
T12F62082EB954297B8DD7D229F912BB67EBF1202561D02EC8E7FC8A1C05E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 66f361d44b43c96ab5817a4cec42ad5f16c873808603845dd81cd25da51011bc
MD5 ffff0776a83df8ae9bf0ee42bdc0b3b4
SHA1 946e41f35412646b563a0f5d42e9d96b1b659914
SHA512 51e8cadfb139a11e1bc3f8a0fcb506737b968447b2617933ade7da16f55b2cdc52a0c64e9c43b0cf6682401e10d9705d71ac2eaa2b513dfa8d6b90c52adbad0e
SSDEEP 192:ZRQ5cBz7Yrsv7R4Q+v7HYhAPRp2PJtS9o98Hsb+WNZYWua4426422QKJsh5EzOVY:ZRQ5mz7MqJ6E8Xm76wZf4o423sY8
TLSH
T11552092EB958657B8DD7C22AF912B757EBF1202561D42EC8E7FC8A1C01E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6fdf0c1866ff17068a5072b53d11901f34bfd65ce84d095670a572072f7e1ec6
MD5 875cc3e7f3099e71f935ee0d67705802
SHA1 3c6e508089f44e413a60a115dfc8370cc2789cd6
SHA512 677ab36afbcfc20ec353a10ffb9cdaa3f6fd4e6780a4c2af6a8ac2a923c232b3b996b24259c964a89fc1c72c8b950dc367c2d143a20b3b7eb71ffa0beaa9edcc
SSDEEP 192:2RQ5cBzSYrsv7R4gwv7HYhPPRpDPJtXCqx98Hsb+WND89J4BbvEuQKJsh5EzaVyr:2RQ5mzSMq1sEZXVb6wQ4hEvsse
TLSH
T1A162082EB954297B8DD7D229F912BB67EBF1202561D02EC8E7FC8A1C05E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b001544ea05293932bd8ad6512910f8a5d8de3f660568a5b0c3ec40c122429e
MD5 6a2643bf9a9335a5c483182306a9fd42
SHA1 0a6415f752b510ef02d9ed662fd131d7d25d93cc
SHA512 4845477d036324c3b20790dd680750a3acbcb532cadddadafed505b343f3c14774799c2c8d369bec1402b5a8487bd4182c433c785d8877ebee26c4b32c746392
TLSH
T166B0125280029501C80303F41686148971189F119B05130593F06EB1D82B5E14014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59864d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59864d.TMP
Size 96B
SHA256 fd19ed63a9f3749f1524632096a77aefd4e5b84881b25240b9595efca89e8909
MD5 9f562b4887247874a508049204f94b44
SHA1 3f0cd7c0c32622cf664fadae5094d9b92c2b0852
SHA512 62776a1f07cdec3cb051a5e6fdb61739a386918854b474c8ebc231207be81e30020ab2f00d9993c059c2510d76f3e565ef54809a41160b584db5858ecad7a6ed
TLSH
T1DCB02288C003A282C08203B028A080C830A0CF28C30B220AE2F00B2BCC22320803A820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3f14e4650246b0308467b3638c04c68bec41d44031ba5589ee5a75837782c144
MD5 9522f949484cf3e2b4c04fd4ab892135
SHA1 4593798df5193115beab1bc107fe5dd6341d9f2e
SHA512 7ce5ff7a72c667cb598cf0e64cf91c5c9918dd71e94b7b63c1bdbbe318d8ed6ccd8106cdecfc3b6b27b2f85beccc3e7cc330e2081c078a5b7a0a6f96155e141e
TLSH
T11CA0026102D05802DC5A03F47B9541C4632059145737861345D14244ED522464342251
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 2ac6df80d2a13eb98474913e187a4e5a8a44e4412c3ea5130676fc53068c45da
MD5 f70b4bfb03ceccf3a29cb102ca9bf28b
SHA1 6b94c5d8be65e584747feec15ef69e4221d9d63a
SHA512 857f7230b2210df807584280277ed5ea9551868388ed0edf7f488edf8565397999e44b2a162253ac6e35d6a0c52dbaf0a093345ebbd3647b8e55498beab8b8bd
SSDEEP 3072:+cXLdhhVMbXuvI7Puexn+YuVqsmjMwliSZ++J3qUQm08KMWF0bFTcVHr6zK:+ipMTuv+r5lsSnhZ++JjcMW2VcVL9
TLSH
T1941413ACE905ACF413CBD60D61131D1585F39AEE9218377C2386DF5B09AA393971BC6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 ec4527986e632a357272ceaa906757f78f2ba844d9f55890986a641c1926c930
MD5 8f2f610e9ed13240110c5a1c1006b026
SHA1 d5440832684f65390e449abcb384b508ca424c73
SHA512 b3c0161f96aa0679251515e9734b03c185993045c08a7d1cc5a4d5e9acdadbe7b5fdf67ac13d4f9b9e2c92d6308c219cd7e7c38fd2bf1c7221063db188b43648
SSDEEP 3072:mcXLdhhVMbXuvI7Puexn+YuVqsmjMwliSZ++J3qUQm08KMWF0bFTcVHr6zK:mipMTuv+r5lsSnhZ++JjcMW2VcVL9
TLSH
T1F31413BCE906ACE817CB920D61131D158DF3DAEF961C767C22868F4B0899393D71B86C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 6678d932df81ef7e50fa754899f1f5c97ad75fcfcd089ffd3dc042c12eb5ec82
MD5 b08ce1d21f6660097a5cb56a02fcfb1d
SHA1 8631c712a0a73347ac30d0a1c57f49d01f02de60
SHA512 ab7001afacc148b2761f54ac4fb1e075c7b9eea5ee1a8badb692b1030ee3070efc44a938749349acccc7795ab179893c9c375447480186887bacb1f0971fdc41
SSDEEP 3072:4cXLdhhVMbXuvI7Puexn+YuVqsmjMwliSZ++J3qUQm08KMWF0bFTcVHr6zK:4ipMTuv+r5lsSnhZ++JjcMW2VcVL9
TLSH
T1951413B8E906ACE417CB920D71131D158DF39AEFA21C777C22868F5B05A9393D71B86C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 8b3832f1cc55aa2d907704c307ccd2eb29d70097904483886dbfa0edbdc44bf6
MD5 6c8834fd8ae47f388856d9d1110c268c
SHA1 8d8483ed2257b5b3168910796a2e542356e5c513
SHA512 0333ee0fd69782db188d4c717a6d8bbd6e5d69334d35b823ec7264de4f1b4c53dbd693c0f87e7a0289d7744b03cd896ab35e8c4606a7a97aefb1e937d4a6a09f
SSDEEP 1536:wSVP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:v++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1859312B9991E7D79236EC39AA0179CAC8DD3DCDE151410BC30C65F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 62aee105a78cafc04d196fccd81d4c3ce62c31206f382b1a12e8424ebf87c293
MD5 2b41a201732dc29b81157ae1329ec96a
SHA1 02f802cc1aefbadbdce8b2bbc96c4ef859a84abe
SHA512 8481f18597e08c8724063716d1fa118e6dbe0821afe2e640350eb1457e0674c23c424c99e0905c5f13a3396b1c27912f0284c28f72bd13c33970c26e325a1b12
SSDEEP 3072:pcXLdhhVMbXuvI7Puexn+YuVqsmjMwliSZ++J3qUQm08KMWF0bFTcVHr6zK:pipMTuv+r5lsSnhZ++JjcMW2VcVL9
TLSH
T1A81423ACE905ACF413CBD60D61131D1585F39AEE9218377C1386DF5B09A9393971BC6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 77366976a495c67df198dec395340de04bef436c73288d3eef08a5241c05dbd2
MD5 6f84c8d8bdd3b58b25a18796e182845e
SHA1 84856ad8fb52d385fd2efa1f46236ad397a9abf4
SHA512 4b8d8151a7a76268bc046f5de3e40660d74beb624718caeb76a46e65b4230ef38db403474f08a151233520a01560ce13b6986287df986c8fe6202420946a7b1a
SSDEEP 3072:KcXLdhhVMbXuvI7Puexn+YuVqsmjMwliSZ++J3qUQm08KMWF0bFTcVHr6zK:KipMTuv+r5lsSnhZ++JjcMW2VcVL9
TLSH
T1671413BCE906ACE817DB920D61131D158DF3DAEF961C767C22868F4B0899393D71B86C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OsuBuddy-Debug.zip.crdownload

Path C:\Users\Admin\Downloads\OsuBuddy-Debug.zip.crdownload
Size 283KB
SHA256 59dcd04d643fc1e02ad46dc0c2722896c53174c6b7ce5432b0f07eb3ddf94c53
MD5 e873af38970ccc05fa86e69b0973c31d
SHA1 f4afcd64a536bf12e81cee64c1f26a4395701faf
SHA512 c4cd257c54882776d30eb1edfa8745924f8a5bb1dcea0bb1924818bfc2ccb3c52913bbdc3607ade7a9d65c9b1d161d8bbbdac0cdc9a255f8b8ea219500c0eb52
SSDEEP 6144:wxeMFdVraqgPnKRLQBh8xpTPqnT+8wJ8rnL/uPttM4pi1Q/tO4f/Z9xl:QrVra1iRLQBh8xpTPa5wCjL/Ym5T4fL
TLSH
T14D5423AB47E4C43E66089DB05BEC890E1AC59630B903FB719CAF151D8D94CCD26E7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OsuBuddy-Debug.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\OsuBuddy-Debug.zip:Zone.Identifier
Size 1KB
SHA256 5ef8d1203eced625e135622a1bfe89bd9e83e653c268a3f60b077d59aebf3428
MD5 3953c6c1b92144844dfb438d5f66d6fd
SHA1 2c20771fabd063c86cf7545854f2ad7b67717c61
SHA512 e92bc4e48d5375831ba19c708710eb9700a97bcbada75f2b7ad6cc26e61b6092f4bcc29f9bea851ac32ed1ff20886f1148553e0c38de074932ac22e383b1d7bd
TLSH
T15C1165F7E016ED1B0706B1D2C99D5D4F712AF4E7C606468E0116E14ED0E81B961E747B
MD5 SHA1 SHA512 TLSH

Submit Download

simpleunlocker_release.zip.crdownload

Path C:\Users\Admin\Downloads\simpleunlocker_release.zip.crdownload
Size 943KB
SHA256 9768bf823d8f801913705dca9032b83b6912061c3a7b4bb7f47c9f225651d78f
MD5 53983ab653bbef58fcbe634f67d04850
SHA1 682bbf531b12d036d6a9133792b5df5b9b1073b7
SHA512 cfb35e06693d35dcfb64f85e5f9a55579e0229eed627cc3b5bdd61ae08932cf0cf16c358721d2cbaab1cac481b22da55ab7dfef24d8f7530ab83f9dc0cfb2c43
SSDEEP 12288:+fitUb2odWtw/S5DRuO37SaB5In2Ftxs8oQkG7FIre4QUEysNxISYAaX//cFdR1I:+Y/2/S5DMO+25IlGjoBNSYF/UpC2/c
TLSH
T1182533CC006C360AF512A2B7A760DFC7889C70594691F79475CEF382AD75BA27325F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

simpleunlocker_release.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\simpleunlocker_release.zip:Zone.Identifier
Size 148B
SHA256 ffeba57a5920b58ef3a737e9346bd342d223267de9b707148aab64c6be53d7a3
MD5 21330d8e860321d3e8dfd959c035b89e
SHA1 5e823c7e8fe57dd5a736d804ce0f3c920c11d998
SHA512 67a611a22637933bc8cc03258c73b3e6abbf903d65dfc344609fd011e09d26b0f97e3e5973612a21d48532f4a4ece0892cb6562641258e5fc44a947b1d4277e9
TLSH
T121C09B535420488C1B2995D978DB62BA716678CC4B9C4154E511835B6C4F6F4C0D3F2F
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1568-416-0x0000000005D90000-0x0000000005DAA000-memory.dmp

Download

memory/1568-417-0x0000000005DE0000-0x0000000005E02000-memory.dmp

Download

memory/1568-413-0x0000000000F30000-0x0000000000F6C000-memory.dmp

Download

memory/1568-419-0x0000000005EB0000-0x0000000005F42000-memory.dmp

Download

memory/1568-420-0x0000000005E60000-0x0000000005E6A000-memory.dmp

Download

memory/1568-418-0x0000000005D70000-0x0000000005D7C000-memory.dmp

Download

memory/1568-414-0x0000000005FE0000-0x0000000006586000-memory.dmp

Download

memory/1568-415-0x0000000005980000-0x0000000005988000-memory.dmp

Download

memory/2316-961-0x000002F0320A0000-0x000002F03214E000-memory.dmp

Download

memory/2316-951-0x000002F0320A0000-0x000002F03214E000-memory.dmp

Download

memory/2316-952-0x000002F032980000-0x000002F032992000-memory.dmp

Download

memory/2344-987-0x000001728DED0000-0x000001728E07C000-memory.dmp

Download

memory/2344-934-0x000001728DED0000-0x000001728E07C000-memory.dmp

Download

memory/2592-978-0x0000000001250000-0x000000000125C000-memory.dmp

Download

memory/2592-908-0x00000000008A0000-0x0000000000A32000-memory.dmp

Download

memory/2592-977-0x000000001B580000-0x000000001B8F8000-memory.dmp

Download

memory/2592-948-0x000000001B580000-0x000000001B8F8000-memory.dmp

Download

memory/2592-932-0x000000001B580000-0x000000001B8F8000-memory.dmp

Download

memory/2592-933-0x0000000001250000-0x000000000125C000-memory.dmp

Download

memory/2592-971-0x000000001B580000-0x000000001B8F8000-memory.dmp

Download

memory/4200-999-0x0000028A406E0000-0x0000028A4078E000-memory.dmp

Download

memory/4216-936-0x000001F0E9500000-0x000001F0E9512000-memory.dmp

Download

memory/4216-935-0x000001F0E8C10000-0x000001F0E8CBE000-memory.dmp

Download

memory/4216-937-0x000001F0E8C10000-0x000001F0E8CBE000-memory.dmp

Download

memory/4392-1003-0x000001E78DAF0000-0x000001E78DB9E000-memory.dmp

Download

memory/4392-1002-0x000001E78E3D0000-0x000001E78E3E2000-memory.dmp

Download

memory/4392-1001-0x000001E78DAF0000-0x000001E78DB9E000-memory.dmp

Download

memory/4404-923-0x0000014A97730000-0x0000014A977DE000-memory.dmp

Download

memory/4528-970-0x000001452DDE0000-0x000001452DDF2000-memory.dmp

Download

memory/4528-969-0x000001452D500000-0x000001452D5AE000-memory.dmp

Download

memory/4528-973-0x000001452D500000-0x000001452D5AE000-memory.dmp

Download

memory/4592-1000-0x00000299FB3D0000-0x00000299FB57C000-memory.dmp

Download

memory/4868-988-0x0000029645E70000-0x0000029645F1E000-memory.dmp

Download

memory/4868-989-0x0000029645E70000-0x0000029645F1E000-memory.dmp

Download

memory/4868-990-0x0000029646750000-0x0000029646762000-memory.dmp

Download