593bd2c56c9f8397f7a3120fbb5a6e163cc58bab2fa846e7223e2d7ea1ebe8fd

Analysis

user interaction
yes
max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UniversalTool_41354.exe
Size 68.6MB
Sample260416-ml4pgsf17v
SHA256 593bd2c56c9f8397f7a3120fbb5a6e163cc58bab2fa846e7223e2d7ea1ebe8fd
MD5 4a9cbc780dc5a699a91510906977660e
SHA1 b0cbc93aedf3a28210019e5f89c4f7ee9a1c623e
SHA512 53492cc7661362ab215c42e6176aefa587937f72f0bf9049923394fc711c3a1983aadd4939961faba7ff6f080b0a90c4a8e5ace5de922c4c92bb8bf184700131
SSDEEP 393216:bsbEPQA5hBnWO+xg5Oy2GPZj0AJqYfbqye3lL9z6xQs:bsbEPQA5hBD2mOy2GPZzq2Ze3l
TLSH
T184F79F866319F294F3115AA489683B6108FB14757BA0CC777F87A9C20A2D1D9DCB3E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	UniversalTool_41354.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\43CA.tmp	UniversalTool_41354.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UniversalTool_41354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UniversalTool_41354.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2360	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208111607018516"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5780	UniversalTool_41354.exe
5780	UniversalTool_41354.exe
1944	UniversalTool_41354.exe
1944	UniversalTool_41354.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5780	UniversalTool_41354.exe
Token: SeDebugPrivilege	1944	UniversalTool_41354.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5780	UniversalTool_41354.exe
1944	UniversalTool_41354.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 1944	5780	UniversalTool_41354.exe	88
PID 1792 wrote to memory of 468	1792	chrome.exe	109
PID 1792 wrote to memory of 5324	1792	chrome.exe	110
PID 1792 wrote to memory of 5324	1792	chrome.exe	110
PID 1792 wrote to memory of 2360	1792	chrome.exe	111
PID 1792 wrote to memory of 756	1792	chrome.exe	112
PID 1792 wrote to memory of 756	1792	chrome.exe	112
PID 1792 wrote to memory of 2648	1792	chrome.exe	113
PID 1792 wrote to memory of 2648	1792	chrome.exe	113
PID 1792 wrote to memory of 1960	1792	chrome.exe	114
PID 1792 wrote to memory of 1960	1792	chrome.exe	114
PID 1792 wrote to memory of 1356	1792	chrome.exe	116
PID 1792 wrote to memory of 1356	1792	chrome.exe	116
PID 1792 wrote to memory of 2428	1792	chrome.exe	119
PID 1792 wrote to memory of 2428	1792	chrome.exe	119
PID 1792 wrote to memory of 3360	1792	chrome.exe	121
PID 1792 wrote to memory of 3424	1792	chrome.exe	125
PID 1792 wrote to memory of 5104	1792	chrome.exe	126
PID 1792 wrote to memory of 6128	1792	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe
"C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe
  "C:\Users\Admin\AppData\Local\Temp\UniversalTool_41354.exe" /yqcyzq
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff900ac728,0x7fff900ac734,0x7fff900ac740
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,14743326974273609802,3685561697208622107,262144 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,189003846948949919,9410405336627467231,524288 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2584491369656277430,17920344664508214169,524288 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,1581041175464565799,8055388401159261993,2097152 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,9116090530972901314,8952847563149918679,2097152 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,6251774414278287594,7625376003084597831,2097152 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,9214149968959705248,7297237581138676613,2097152 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,12221256763805835866,14956973329442229740,524288 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,14461556530972234393,10422172595954001357,524288 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,15432707329398069148,11798910342705848066,524288 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,13741429441462969661,812586096929730263,524288 --field-trial-handle=1968,i,2390290198599770001,7266440391226332013,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5357ed5fdcf6a5cb9c9b8457e83c866455882c73a103d68f9597ab0137de895b
MD5 94890b05891569a3be59eefe1a3095f0
SHA1 31a35c78a5ecd5c8a23da21e552467886ec02b64
SHA512 bfdf72a018f51a5452bf0059974b18923816900abe42a0b107de7cfb7cf1c187dc959018caa4bf79fd35addd697c4d7830016e8d7d7e71c3670436119543ff90
TLSH
T172E02BABD852EC2708F9171860540B4EEF1013172B41968F7A3D854C8FF463B4986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d9a4c4abfe67195f10d9744c3875f88b2212361aa72c1013a8c269d874557be3
MD5 4570a29182d8e7abcb254a1e824e0067
SHA1 b653c09a0c2dd45173e55d15e7ec3437d64d21ef
SHA512 560f47893118f8dee40f4180bb4559e5015d22cfab2655fdac286cac8f343b8e8e23ce34aa7337234f8e5bf4d269e4a268641f7273bf15e765f8bf4f6b99c6ee
TLSH
T193518EF7D3E4897E8511A6E4DA156E2FCE6D0A64031C3C66C9D4AE4B53F2972D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7ee763637695a8cf5d382215c8ce7343a1bf03cbe62dcce8a88cb749e8feb3c4
MD5 abb642127f6abe18e2a5c50c86afb762
SHA1 d6a430b95a33dd841313391811487886437b5f6c
SHA512 a0303c79f6372705c85c8c97bdaac69300d74f444e55c8c29e586cd8c0e6be6af2cc25591c056c82ffddde9d2a3c150aed8ca848015d59b0f4db777fb3e99880
SSDEEP 192:/RKLY73D0BfNv7japAPRp2w9mHsb+WNnWr01ekRJRfhP6r8kwUaeIVyIsnAUgraJ:/RKL+utaUXbIwQ013RJRfR6w0aese
TLSH
T17142D72DB914643B5CDAD21EFE667B27DBF5103161941F84EAFC8A2C11DB6CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c66263ed95c6435fb7eb649af475e3f55e4052640b86502cdea007044faf2901
MD5 f6f6e610f2bdd798a0e8972eca322ff3
SHA1 47fb3629ebd3777cc160015b1e063cbcdb7adc66
SHA512 9a706d18e61e93b64f62b18157dfd4dbee0fe378a81ea7b6d6c3eadffd7745d440b184fb2bee2c43ab3046ddc64156f4e584f2f93be26d30099ef84ea9ca97c5
SSDEEP 192:/RKLY73D0BfGv7japAPRp2w9mHsb+WNnWr05ekRJRfhP6r8kwUawIVyIsnAUgtaJ:/RKL+uyaUXbIwQ053RJRfR6w0aws8
TLSH
T12242D72DA914643B5CDAD21EFE667B27DBF5103161941F84EAFC8A3C14DB6CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ffe4c71e3a86cdeb2773257d928857cac54262fab32128720a248950e4e82d84
MD5 f6491cb980330cb8fe114d5f10fd544e
SHA1 68ddf560103e8695b07a4fa9e02bb7c224e66871
SHA512 53cab6703911cd157d7b129aee8e19ccae2f78bd830c8c9808af917dbf3086b3b8a8c6443d953cd1e6dbfd50612bc4173d7bb4d1174ace772e2ad1f83c0ce882
TLSH
T13AB0129081019902C04302B1238204DC31545F309706130157E46D75DC272B14114150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596fc7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596fc7.TMP
Size 96B
SHA256 577117fa57bc2b3ca5893fb9438f8b9147b05966539e2ffcfbd6fb17e46b37fb
MD5 14a8c91e8f27b25cbcebb8c284649ea9
SHA1 ae81904cb58d38d8a934c480b9d1fa3ae320819c
SHA512 8b98ecc5d8a2a67521a9aec830ff19ff3b7467cfbc60fc527aba0e436df56df13fdfb4ce7647c517b8a53317fe13a81c676d7cceb01a6378a8fa6b1450234467
TLSH
T17AB02200C2C2E202C00303B02AC083C83020CF32CA03822283F00A33CC2CA308038220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 f22340b207485253067e8f5b0b31e8bada1eeec9ebd02c625a6971aed2994b5e
MD5 2e7fa670a477f419fc5b181bce329079
SHA1 631d6524189b6db00c6730e953330e0ec72c659e
SHA512 9d710a34abd333ba50296f316241eb592dca569e7ac1fd4a7f95e0654258f7893d8d0fc7bb772340aa07f359f04444e5f98c61ce5f06008c5d1811ac5ee6dfc9
SSDEEP 6144:0j0xjocXfKiRkoLtCMarOk0HOGm/SFyEEl:0ABoWtkoBCMarOjuGdF2l
TLSH
T1F41423A7C41B896E9EA85B1174BEEE1E8D1413DDA08FCD8D72ECC78A61F82441713D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 836d35387e5455b92a0213457cd02915e8756303e63d7423ef79a8ed186f05e6
MD5 4c7757b5e721738a74a17c6e5512358d
SHA1 384a4d04b6b03782405dfd1de9f54f4616df1a2b
SHA512 f64097ea890d435e9494375d09711b234b00fc93fc9d32e030e3a8fa5c7f04c76e2e78c01a279c2da4b75b15639e2791220facfcf8f97337f397d2e39c1b8c6d
SSDEEP 6144:0U0xjocXfKiRkoLtCMarOk0HOGm/SFyEEl:0vBoWtkoBCMarOjuGdF2l
TLSH
T1021423A7C41B896E9EA85B1174BEEE1E8D1413EDA08FCD8D72ECC78A61F82441713D35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 edf3570b42e2616197a268f92603217351b626e70b18c12de10791a7f9e4f1ad
MD5 5964d144e89f3d02c28614ddd4fde130
SHA1 67d83fda47e1d914d0835d7e16c65ae1763e685f
SHA512 16af713b13504b3fb6c9fc8059eb9bbae9d88665b88d84c69d125ee768dea364429c2ad0e5b11eb232d5e16f2547ddb9f29427212e2f7449a4670c1f12f7c2d4
SSDEEP 6144:0OM0xjocXfKiRkoLtCMarOk0HOGm/SFyEEl:0YBoWtkoBCMarOjuGdF2l
TLSH
T19C1412BBC41B886A9EA85F11746EBA1E4D5423AED18FCD8C72DCC789B1EC2440B03D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 5e3783a07ce5bcb3ece18663ba79b0b25524dbeb3f9918dbcd42a47f44999308
MD5 a8beb8fd9b89ee02fba1ea54bd9f227d
SHA1 c3495588c87cc596327136aaa6fa69c77f48eec1
SHA512 0eb51a7c4a176f224d064eb78282d731b4dcb56fc917f7a0f51587f97a6d8ceaf09f3313a984c57301f0061ef06fd3afce0fc783e2a9149c5b8768a1d96b8c7c
SSDEEP 1536:0cC1cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0J3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1749302BA9E2646EB957D468176AE780DCE13130D709FA9CC315C639C21D42C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-3-0x0000000004BE0000-0x0000000004C43000-memory.dmp

Download

memory/1944-2-0x0000000000800000-0x0000000000819000-memory.dmp

Download

memory/5780-0-0x00000000013C0000-0x00000000013D9000-memory.dmp

Download

memory/5780-1-0x00000000039B0000-0x0000000003A13000-memory.dmp

Download