ee0ad9127d04ccb8d24e8fd96ccb1603fb83756580231d516e26aee7aba1bf6a

Analysis

user interaction
yes
max time kernel
504s
max time network
507s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LunarPatcher_Setup_v8.exe
Size 62.6MB
Sample260419-vmlt3afs2l
SHA256 ee0ad9127d04ccb8d24e8fd96ccb1603fb83756580231d516e26aee7aba1bf6a
MD5 f5e61ce60380676fa906045330a59ae9
SHA1 157c2f1ece373c34d36389f3c6f39d012356469d
SHA512 13c9c124fe53ef0d79a91541e874f3115264114b912adbe31a75ca75ceb7f5396591bc0dd2d953964032666cf51e11532db8df20b38f82460a07430073099769
SSDEEP 1572864:DduLUO+AoLOKbORhWTCVmxdPexUCBUEXL8NJaeY:DduLboxOauVqiUCB12LY
TLSH
T160E7333BB18B242DE82B1E3E72F6925058777FA078028D1696D0B80CDF765F52C3E656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	LunarPatcher.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	LunarPatcher.exe

Executes dropped EXE 3 IoCs

pid	Process
5956	LunarPatcher_Setup_v8.tmp
2748	LunarPatcher.exe
2128	LunarPatcher.exe

Loads dropped DLL 6 IoCs

pid	Process
2748	LunarPatcher.exe
2748	LunarPatcher.exe
2748	LunarPatcher.exe
2128	LunarPatcher.exe
2128	LunarPatcher.exe
2128	LunarPatcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5632	cmd.exe
5524	cmd.exe
3312	cmd.exe
4080	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LunarPatcher_Setup_v8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LunarPatcher_Setup_v8.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5688	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3892-1-0x0000000000500000-0x0000000000600000-memory.dmp	innosetup
behavioral1/memory/3892-7-0x0000000000500000-0x0000000000600000-memory.dmp	innosetup
behavioral1/memory/3892-44-0x0000000000500000-0x0000000000600000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210923565853167"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{CBB020FF-0F3B-4A8E-89A4-38E410E0BA35}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Вооtаррег.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Вооtаррег (1).zip:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4020	schtasks.exe
3588	schtasks.exe
3204	schtasks.exe
6080	schtasks.exe
6068	schtasks.exe
5160	schtasks.exe
4692	schtasks.exe
2216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5956	LunarPatcher_Setup_v8.tmp
5956	LunarPatcher_Setup_v8.tmp
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
4784	chrome.exe
4784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	LunarPatcher.exe
Token: SeDebugPrivilege	2128	LunarPatcher.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
5956	LunarPatcher_Setup_v8.tmp
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 5956	3892	LunarPatcher_Setup_v8.exe	79
PID 5956 wrote to memory of 2748	5956	LunarPatcher_Setup_v8.tmp	80
PID 2748 wrote to memory of 5632	2748	LunarPatcher.exe	81
PID 5632 wrote to memory of 2580	5632	cmd.exe	83
PID 2748 wrote to memory of 4528	2748	LunarPatcher.exe	84
PID 4528 wrote to memory of 6080	4528	cmd.exe	86
PID 2748 wrote to memory of 4428	2748	LunarPatcher.exe	87
PID 4428 wrote to memory of 6068	4428	cmd.exe	89
PID 2748 wrote to memory of 5524	2748	LunarPatcher.exe	92
PID 5524 wrote to memory of 2536	5524	cmd.exe	94
PID 2748 wrote to memory of 5864	2748	LunarPatcher.exe	95
PID 5864 wrote to memory of 5160	5864	cmd.exe	97
PID 2748 wrote to memory of 5232	2748	LunarPatcher.exe	98
PID 5232 wrote to memory of 4692	5232	cmd.exe	100
PID 2128 wrote to memory of 3312	2128	LunarPatcher.exe	101
PID 3312 wrote to memory of 4916	3312	cmd.exe	103
PID 2128 wrote to memory of 5348	2128	LunarPatcher.exe	104
PID 5348 wrote to memory of 2216	5348	cmd.exe	106
PID 2128 wrote to memory of 2452	2128	LunarPatcher.exe	107
PID 2452 wrote to memory of 4020	2452	cmd.exe	109
PID 2128 wrote to memory of 4080	2128	LunarPatcher.exe	110
PID 4080 wrote to memory of 3112	4080	cmd.exe	112
PID 2128 wrote to memory of 6112	2128	LunarPatcher.exe	113
PID 6112 wrote to memory of 3588	6112	cmd.exe	115
PID 2128 wrote to memory of 5352	2128	LunarPatcher.exe	116
PID 5352 wrote to memory of 3204	5352	cmd.exe	118
PID 2408 wrote to memory of 4340	2408	chrome.exe	120
PID 2408 wrote to memory of 1300	2408	chrome.exe	121
PID 2408 wrote to memory of 1300	2408	chrome.exe	121
PID 2408 wrote to memory of 5688	2408	chrome.exe	122
PID 2408 wrote to memory of 836	2408	chrome.exe	123
PID 2408 wrote to memory of 836	2408	chrome.exe	123
PID 2408 wrote to memory of 4512	2408	chrome.exe	124
PID 2408 wrote to memory of 4512	2408	chrome.exe	124
PID 2408 wrote to memory of 1760	2408	chrome.exe	125
PID 2408 wrote to memory of 1760	2408	chrome.exe	125
PID 2408 wrote to memory of 5112	2408	chrome.exe	127
PID 2408 wrote to memory of 5112	2408	chrome.exe	127
PID 2408 wrote to memory of 3300	2408	chrome.exe	129
PID 2408 wrote to memory of 3300	2408	chrome.exe	129
PID 2408 wrote to memory of 4972	2408	chrome.exe	130
PID 2408 wrote to memory of 2652	2408	chrome.exe	134
PID 2408 wrote to memory of 2652	2408	chrome.exe	134
PID 2408 wrote to memory of 4360	2408	chrome.exe	135
PID 2408 wrote to memory of 4360	2408	chrome.exe	135
PID 2408 wrote to memory of 1320	2408	chrome.exe	136
PID 2408 wrote to memory of 1320	2408	chrome.exe	136
PID 2408 wrote to memory of 2020	2408	chrome.exe	137
PID 2408 wrote to memory of 2020	2408	chrome.exe	137
PID 2408 wrote to memory of 5744	2408	chrome.exe	138
PID 2408 wrote to memory of 4464	2408	chrome.exe	139
PID 2408 wrote to memory of 4464	2408	chrome.exe	139
PID 2408 wrote to memory of 5416	2408	chrome.exe	141
PID 2408 wrote to memory of 4588	2408	chrome.exe	142
PID 2408 wrote to memory of 4064	2408	chrome.exe	143
PID 2408 wrote to memory of 4784	2408	chrome.exe	144
PID 2408 wrote to memory of 3848	2408	chrome.exe	147
PID 2408 wrote to memory of 3848	2408	chrome.exe	147
PID 2408 wrote to memory of 4616	2408	chrome.exe	148
PID 2408 wrote to memory of 4616	2408	chrome.exe	148
PID 2408 wrote to memory of 5472	2408	chrome.exe	149
PID 2408 wrote to memory of 2716	2408	chrome.exe	150
PID 2408 wrote to memory of 3896	2408	chrome.exe	151
PID 2408 wrote to memory of 3896	2408	chrome.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LunarPatcher_Setup_v8.exe
"C:\Users\Admin\AppData\Local\Temp\LunarPatcher_Setup_v8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\is-F4NK2WOVA3.tmp\LunarPatcher_Setup_v8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-F4NK2WOVA3.tmp\LunarPatcher_Setup_v8.tmp" /SL5="$4017C,63837573,990720,C:\Users\Admin\AppData\Local\Temp\LunarPatcher_Setup_v8.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe
    "C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
      4⤵
      Indicator Removal: Clear Persistence
      Suspicious use of WriteProcessMemory
      PID:5632
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
        5⤵
        
        PID:2580
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6080
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4428
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6068
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
      4⤵
      Indicator Removal: Clear Persistence
      Suspicious use of WriteProcessMemory
      PID:5524
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
        5⤵
        
        PID:2536
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5160
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5232
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4692

C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe
"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2216
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "LunarPatcherAutoRefresh" /F
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /SC ONLOGON /TN "LunarPatcherAutoRefresh" /TR "\"C:\Users\Admin\AppData\Roaming\Lunar Patcher\LunarPatcher.exe\" /refresh" /F /RL HIGHEST /DELAY 0001:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3588
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "LunarPatcherAutoRefresh" /XML "C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7573c728,0x7ffc7573c734,0x7ffc7573c740
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,472473368773136122,16195404932130696877,262144 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,9389329781721694203,5492759503358336194,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1456 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,5387895216748383823,14794824318768235605,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2380 /prefetch:13
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,2370815298616709157,8506840773874329472,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3356,i,6601738238652516273,11586464915962519431,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,15919084498554315710,12622003276331642103,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,8713553742052231647,12967989435509559484,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,2683467057574920473,6326428644724172808,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5412,i,14706580737979422338,13164391869026532188,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4508,i,5027703422837799839,12322267755849576827,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3656,i,12361137250510861091,8631204710224829278,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,7522427281131126675,4920079063558176409,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3476 /prefetch:12
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,16770563653159067012,14730689326089790334,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,13486620904342192780,392788890308875174,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4596 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,9152694202021525328,4552785668831415299,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3800 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,4867972739843560689,7966301464377564136,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,8659593038028033842,9466819671305777380,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4264,i,6373680664320342824,12948016261893238532,262144 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4252 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6232,i,5297767106148731658,3328285878186928070,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=872,i,1074292775673765782,11745396458690731243,2097152 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,8852589664769400227,10974757196822712976,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,18290010995414476673,866890030787372704,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,12469943131370883040,14901944869738333869,524288 --field-trial-handle=1888,i,13910121615915465723,518465812211708196,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:3896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

accounts_state.json

Path C:\Users\Admin\.lunarclient\accounts_state.json
Size 82B
SHA256 a9418bdcb773e3cbab5003aa60eafc60874f77a90f3683524a14f5a2e71b4d70
MD5 e532354736a9f94fc4c3e8de1a8716d5
SHA1 8f88954d5f8771417afcf89cbad88c904daa93ce
SHA512 ac8f13d6e0317de66e1624a2a97d7f6356e164741ea054b8567e35030837e5e4ebbbb02f6e7a9b73daf8fef82897dbcc3f655bfc2f54b4690c249b7797dbe706
TLSH
T16CA01120082A00AA38AAA00032330088A0000B8C00200E2E30FBB028028E8A88800288
MD5 SHA1 SHA512 TLSH

Submit Download

patcher_state.json

Path C:\Users\Admin\.lunarclient\patcher_state.json
Size 70B
SHA256 1c014b46679fd35ff3c5edc9e6d9f913e054987cd79e1dc29770e641980a22af
MD5 9068e1cd98024a2a653127ef97ea9903
SHA1 f0a3041753358ee321ea3acf18f59cfa76631bda
SHA512 2bec751320c5c66e48c7ca93be340371f780f14a1b2e997356422d839724b1aa3188bf39fd1a975d56bf8832160e781bf02d55c319930e330c4412924fd48a64
TLSH
T1E4A0244445133C5C11010101D0341D4F41503101CD4C13075DC15F0010307150F0C4C3
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.json

Path C:\Users\Admin\.lunarclient\settings\game-backup\accounts.json
Size 53B
SHA256 656967cb536e94199da44fb524374cbe48d488b0cdce9a945ac50fbc39bd34ab
MD5 0654a4dce2cd001de0c1e67db48cb81c
SHA1 dc8262ddd094989857ac5f23d608de8982e0593e
SHA512 520ebf23ccaec668c82272db2c595937061a65eee6533bdb87178d389a1d6fe23c42c70e18daea6479d13803ae83d1b3136bc1b9b0bc2f437c73c8473aeb242b
TLSH
T1BF900245060511B399A458153136118964111A4901301D5D71F3B43465494940541742
MD5 SHA1 SHA512 TLSH

Submit Download

mods.json

Path C:\Users\Admin\.lunarclient\settings\game\Default\mods.json
Size 126B
SHA256 c2afa0ede9827ba96f180f9a699d10d77ef82291e96806fd9cbebf819fa18dc2
MD5 d3cb52e0e0e5aae374f8b46080207961
SHA1 c914fd7bf1e85de8ab7d7a53a0c870519f18c11c
SHA512 9188434825b7845c469db94c72684d0afd84c94058eb6ea34e2993410866c22d9f6909633957d0de61c99df6b845c488bf0bbb20471faa65e6f1750b010afd69
TLSH
T1BFB0922A14A021AA9284C6ADC29C6F0342BDAD3721027055E94C5A3439BB0B8A133AB7
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.json

Path C:\Users\Admin\.lunarclient\settings\launcher.json
Size 242B
SHA256 de3865d07ba051aa5856ed20dd07523080735b6a2716993b6f37a6d2eca9640e
MD5 ffc2b839d2f8bd70252eb0d7bdc00ad9
SHA1 9a700eef34e0f9d87cbe5dc0733ce8ee2e5205e8
SHA512 4d1c09deac9f861c6ce5ca1a2c3e8339b80ac7dfef0812e94eaa3f85bcff0141b89b783ae8b2ba265d362b9d3ca52fea67008d54e7adb10c870ea6dd743d9cf1
TLSH
T1F0D05E96E0001FAE16FB133F4E529562A222831B64A118267DFA504C1F313754123B82
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e8b4e3f4460b4bae1c58dc600177f63c71570fde7ab0e150af4f0495b3ce0a44
MD5 adb417b87b1e63fe8feeadc06c3fefa5
SHA1 e518e0648cb0b9dead2f80ef0c6858013ab8b85e
SHA512 0e0d0d763220a59bbf77f140cb7bf0089f1741831105bc056ee3f64d459702a471be1303c83b858ea9765cf724629047124f6092ed4a1026147c6b6deefc4d5f
TLSH
T100E02BE9D821DC370AFD0B1D60514646E718132B2B90898B3B3C820D4FB167609C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 56KB
SHA256 f4e4e2448284cfd2e90dbf3ad7eea682202e327c7f994c290e1a657ad8222377
MD5 787bf66e09c87694c936698886300966
SHA1 c90ada722ae4f4efd803cc351377d5ccbe3e0b93
SHA512 873f2dff23f95762fca3b0141672fd60d5472fd3704982bf6b37fcef7d82d8599249550a8c15e2d788a03ca838dde0dbb9b23a6e09324b579798b55c6c99804e
SSDEEP 1536:CiMUZd26nUh5yxumqiCKXhA0rJMS1BzclFfKagTwRrHpFH6CHmwga2:CiTZd26U7yoiXXh1MYBzc7gTGrHpFCwK
TLSH
T10C4302A3665A7067D92DCCF023C15BB20BCB3A2F512F1089517EEDBB92750A221B1F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 658KB
SHA256 db211ab6528d981ae14c7605959e3d440928db50904f454a7e9a654f7b093414
MD5 49b541d7101f1456108a5046a38449b2
SHA1 d23e66d96f966d83f0ed7d27dc644ae584c2bc6f
SHA512 70b4a604d7269067a2be03d1f9e7b5ee9d39e9110370bb58dcea1d911ad6713578be685c6a14b6efed014c1a0972e0eda2b58b0698b7465b461c549fa2e9dd4b
SSDEEP 12288:W7/5bQM+sIxleFzEFMOufYbaVsbEiPWWRMgvWY+cN0ycc1u/CFYr/N:os2YF9MGWXVknSCFE
TLSH
T132E4234020196F616E643E70EBD259778F1879E3FC24A4687289C81CB79E275B3BF0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 23KB
SHA256 7baa342b447f1f3fbdcad0c118d89a4beeb2231398e0af26b85c762065864ab9
MD5 394f91948c6a388bbe5d40488c04baf1
SHA1 59eca09c97f81036a1d7988c82d96a50db603164
SHA512 5668c15249dc898fa3c0acaae01900bedea44574bbf339cfcba0ffb3d732fe2f4476171de60d4d8f4cc110d864cc068308974ab57ef3d244d5ba3a9468bbed8a
SSDEEP 384:dcgGG9Dx/J30V3QjlJPfPBzQj+J2VZjWFMo9a/MeBV9+vFUAeETaZmI4mEjd:GFGNx/JkulJPf5UycYOCaEeBV8UALToO
TLSH
T1F0B2E16469BB0669FCD1E6410C26FF2B4F753384629D36CA449DFA2CCB72E97100336A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 34KB
SHA256 5acb0dd928af80fb998e41fe541b6a780c1addec39b5343971071ca3bf0e57b4
MD5 04d78f1be05001f612bc3590da8738c7
SHA1 bd10f2482d7a0ca863431958e1992936d6abeded
SHA512 36dddf1b85fbe5481d2c1aeecbdc1b7657f219ece3e7f39a09beedc7bbeec04e08405754bd52dfde59ac655d10f60bcf933f2ea9f1f44c18a0801c67efc75935
SSDEEP 768:sfWZcXP2KzahVzW2HGA1C7v+KnUcNUZ7vQcZmAI/ls9N:se2XP2Q0ZW2mA1CLwZyk9N
TLSH
T117F2F1B84D201B495E803538D6CAE8D3C5A0CFDEC5B3DA19633F632BC5EE98911D546E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a
Size 3.9MB
SHA256 4d0083f353d35d4f9bce5977ec3d8f065345ed9df8258a9a9a1c9f058151ae62
MD5 12124ab52b9231d739a8c0ef516eb9b8
SHA1 0113799ff3078d905bfff5d24fd46ada711dda8e
SHA512 0bd63c5e725c52aa1f80b4358f3298eebc777ab99e00a908585ac9920e93902d2d6b40ac9eafa03215e559ae9f851bf2791c3486a1338354d449bed218d49bcd
SSDEEP 98304:RzWBpEjphpGOXtIE0Ocv0zUlq4FM0YxrkPlLCMX0:RzwpEjlGOXiE0OcXc4FF6QpCMX0
TLSH
T1811633A48036631598AB584ED8A357C2F283909C28C5CEB7C6F34BC17D786E584DB7F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 2adbb259c72743e19f0a9e7d3d4920cc96f801cce37a2f53b855f02da118009c
MD5 ab3f4b6ce0e03af98edf535225058ff7
SHA1 2a85a89192e57c1858a0056eee8a8a4e416265ce
SHA512 bb4083906224f25a2b94efe1140f7cf74040383a9c6faa0faf5e8b4b449b379258e1461c38b96f940b787bf900551c079470e5f509e834c09f5d79d790572671
TLSH
T10F01DD9D49FBE0C2FB2640F25DB00B8534661B780302EEAA79C020CB09C33F6040A391
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 2dbbd3862dce1e4122d144879a4fc6aec9af5a6da02e3bc24facfe23ae38a04e
MD5 14f1dfea038cd81551c985472ed7daa5
SHA1 92dec83cb5addf556cb314b1c60db6eb9f73b1e6
SHA512 b67d29c46ff2fef5175cb2e13dab7229bdbb7ce4ea229f5084fc79823da2b6ea8ac3ae21cbdc9c27e33fa616b24a3525767fd9a75f9d41efab358a1847fe100e
TLSH
T1E701A2DD45FBE0C2F71684F25EB41B45345667741346BE9A79D454C749C32FA04062D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 e3b8630c4e69c5c281766b8997dffff6859bb2bf83dedd009bd33c95c19a1735
MD5 8e206fe09106c1435a4ae1269485a90c
SHA1 a362a70292f088c3da6614629d0a0f2f7dce7836
SHA512 c1caed882d140106a12b02dacbdae1968e6d19af76287fbb809bbe227a460a6d3bb1aa75699a8b3a7d19bb24afb55de24a529a28506116c2ac79454af9a0c998
TLSH
T1741197AD4AFBE092FB1640BA69A41A453A615A240316BE9E7AC060CB4A832F60419391
MD5 SHA1 SHA512 TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000004.log
Size 38KB
SHA256 1144fd8b953c7c4a2e4913b91da73d39b009adc9f7be431f79264d9a356d08f8
MD5 24135d158f1fe523576a1d74d84a9853
SHA1 0106a8d5067f1148ff2a38b47991acc884f6816c
SHA512 70a4dd5ffe21213dd1473b5db2466f7f356940e256b96550e5a2414dcd2b938735b35c8aba1db3149c5274595e4396841326e7c70757bdd3e20645f481e5a0a9
SSDEEP 768:bq2HLVQn+GEGS6LJELuaimOS62U93LbfPbLnmq0sIQsUoQCHyZUzelwP6hc7GN4H:bqoLVQ+GEGpLzpyEPrch
TLSH
T1BB03012F82D48ADBC705C1F549190B564F3A2D4668E874EFF08E7B1EF63A2601B71D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000005.ldb
Size 56KB
SHA256 f63b70f2f6c379ca904f2fac8f549aa5162b896d2696506e8c285aeaa117be35
MD5 60a25c1add05315bb55b34df50663e22
SHA1 c2183ef9d19bf89238d56693bc5cc75cd1ff17df
SHA512 d3de8318acd4fda48feeb5a0a818feddfa86d3dd2b8387b9c96bb35360c561857c2641a9b1c029742b392f0dba43ab950a81fa43353d5df95a243987668f894c
SSDEEP 768:6qM/1a9seZRm/ilbv8VxlIUGdBGeGz5BZYv4Fcgo2/Lsw30l8Je/SHrFd:6qta9/qUkGemyvU73naGT
TLSH
T13243AEB27BFD841695B58637C8FD11CE4FF5F90E2AB0B59D7A813318081A99B24D9F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 1KB
SHA256 3c59a0b7aba3a2107d67650ad153faad2bdd72ed3625924c49393935ebb5d565
MD5 5e9a43c6671ff2472bb4be61892d6e71
SHA1 71ffd897a88c31ae8fedf03037644d073d8cd9be
SHA512 99c453d2d542fe311b8b2da67691ddde05072ee1b1d2a804b4be26feb46f84595e13ca148c495861c7101b7a7bf7b8d473b400cfa3ffb066c99d607c5adcfb0d
TLSH
T118314CCB8A8A58BD40D1C072953C3144CC9C9540565C5B19AAAAE7CF1BE060FEE4B476
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 130B
SHA256 53c0ca9c17b3abbfec79b4651e854a144513706084f0767f5aa2acf4de8564c9
MD5 7226af280f617902a1a7d3fc9eb6f7c9
SHA1 8b3b0a0b2d868e201058dc9f7171d55f8a9fda24
SHA512 bc82b38a63d12340b38cd2202269a19757c3f493bd111bce41e8b59ef6bb97d20e700aee6734d7e8fb3e36525f57e324d91df658b95fc01baf1a16236afebe51
TLSH
T11DC09B7567D82552F454027C49B9511E6E156146004EDD4A209E647918137145C57D28
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 c5bf249fe37c4a2812f3f94807c9925ef0a61002e46ac504e2a94f9f1de6b575
MD5 0b68e6bce50bb06288c72390701ba49e
SHA1 0693b9bfee8ad28c66e65f8c2a72f7ce3180e4fa
SHA512 d1d0a3546160c4993d368741ee2a47a2b890df6fa7a00288a1ada4df0ad25b3d01f81a7b10dc4cf3d533ec209803646d870a06a95e28189e2efa64caee30e75f
SSDEEP 384:DfugIFhfznReJOIO7nMGmo1DR3aoYpA/A9McpD5SgaIaN7AnNOjJSfJGVQt2rhW7:MME/9W
TLSH
T17B52DDE3C3D4822DE82616F0DB54391EDE790E7883683C76D9E6AF4B53E5431E211A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 120e8099b3ed759e3c1139154662fd5b580a6959cc0a203be6022cdb1c874e4a
MD5 1217deb3330ecbd79a277e458e0d606e
SHA1 e466d04a1dabf224f0b26e08be5f09fe7a4a5861
SHA512 3775d83a34b34afd9f7e4a45916d42ee6da75e77a941a9d765fd4324d40af7213fabbabc78de5cae69b99294e086da53ea403db5c906d94b01deaff3dc540242
SSDEEP 192:eRUEKMg2DG/axv7ApAPRp2K9AtH9BHsb+WNnW1iF62q/2bB86kwwaUA+VyIsnAU/:eRU3Qth8UXgDwEx282bBHQa/28
TLSH
T1E252B52EAE14293B8ECAD61AFD61BB17D7F51025A1841D84EAFCCA2C14E75CD621B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a7091412c89b7dd181d627c0dd47ce5876998ee1997d0661090d209793c66b8a
MD5 94cb8d7bc378e10f10e1920b3e40d007
SHA1 24ef5fec51fb8318b91614642619457355f7c838
SHA512 fc8870e465c3f72f482512575a9fde48ce99f15e2858759cb0509a42e2a5194c0bad9d2e903d0edcabe1ec5370a3bb4694451f8315f49b3414b2a70eb15a33a8
SSDEEP 192:eRUEKMg2DG/a1v7XpAPRp2A9BHsb+WNnW107/2bB86kwwaUA+VyIsnAUgtaJ:eRU3QtF7UX/DwE0L2bBHQa/28
TLSH
T1F142B52EAE14743B9DCAD31AFD65BB57D7F9102161842E84EAF8CA2C14E75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 bcc6cadbe6ed7ff862e100a88a5ed8d868af0f663c8ef794cdeadc43bfda52c4
MD5 68a41c37c6cfef079d91eae5be2d5718
SHA1 ef425327b814d41aad93895429fe7cb495d55509
SHA512 cf4f6794561dcabdbdd6c118be65f13dc0b709ddcb0ea148304610ba8ba38be71c8aa1921d98dc06d155d10d06a5ca40b6ae30f0bdb427b255886914ffe0f642
SSDEEP 192:eRUEUMg2DG/aRv7Ap+PRpgmv9brruH9BHsb+WNV0W1hn/UnXiDL5X/2bB86kwwaL:eRULQtB8GX4DwJV0iDL5P2bBHQaf2e
TLSH
T16162D92FA91429378DD7D62AFC61BB57E3F61025A2C41E84EAFDCA2C14E76CD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4caf0aa843df0200752f909e903f7f51ec47e4d6106be5dc509db31fce52a09c
MD5 4b1b7bace36f08097760914a10109b54
SHA1 4765eb8000ae55bce0638b67ec4f99dde5832e6e
SHA512 19d14e82de70e1d4067e95445e8e66add065754e4828bf463e6e00ec4577197b500bc6ff069057fe27a15aad08b65f0cc0007663b4cb60c09b43e4f73db14379
SSDEEP 192:eRUEKMg2DG/aAv7ApAPRp2K9AtH9BHsb+WNnW1iF62ms/2bB86kwwaAA+VyIsnAq:eRU3Qtc8UXgDwEx2mm2bBHQar2e
TLSH
T11E52D82EAD14393B9ECAD71AFD61BB17E7F51025A1841D84EAFCCA2C14E75CD221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d58121f2a8c34a882b4cce4d627778c37bcc1306652b73769a6dc52983fe4b5a
MD5 247525f3dc479b8aa377e62347752351
SHA1 4578286626859ac4723817ffb7ed1595a9ae762d
SHA512 33598c0d487d3ff560214bd3bacbafce932f0d81f3f6132e4199eb598092a5214ad7e3638e621035462aab2753d85df026e20d5275b85355d2fa88a4a47d0d36
SSDEEP 192:eRUEKMg2DG/aGv7Ap+PRpgK9AtH9BHsb+WNnW1iUrEKX/2bB86kwwa0A+VyIsnAq:eRU3Qty8GX2DwEREKP2bBHQaf2e
TLSH
T16B52D72EA914293B9DDBD61AFC61BB17E7F5102561841EC8EAFCCA2C15E75CD221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 151b3ef855f36366e0c1c2f03bed8440036aec0dbee4c49e621a3f771059a037
MD5 090aa7345672ba0ed5523a0665675b97
SHA1 35a29ffe5eec82a289e314cb349ee52aeb711c93
SHA512 ebc1c75bd9deae9881f54e6493fcd6fba528810c5f9b31f04e501bde984569d256787eab0ca8f7e6bffee423f791ef171f863e640db4e9f3827b9c915de46ce3
SSDEEP 192:eRUEKMg2DG/awv7Ap+PRpgK9AtH9BHsb+WNnW1ihOcvX/2bB86kwwa0A+VyIsnAq:eRU3Qts8GX2DwEpcvP2bBHQaf2e
TLSH
T15252D72EAD14293B9DDBD71AFD61BB17E3F5102562841D88EAFCCA2C14E75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 52a141ba72a3c184c428cc5f468d06b2f1b36d038da6577ef1fc1b67a018c703
MD5 98c4335277344d2c00a2f3e631badbb9
SHA1 821e09bb9d3291ef1f70a84687b0f00d9d9dc713
SHA512 37e0e33bd72196baff748c3043f48beee8566de51e7b9fa37739a204c0a01e87042907bd7ef700230e196d5abfc188b79d3b6ff8e0ef37f2d6a14fdc1c134b2f
SSDEEP 192:eRUEKMg2DG/a2v7Ap+PRpgK9brnH9BHsb+WNnW1inXiDLxX/2bB86kwwa0A+VyI6:eRU3QtC8GXzDwEmiDLxP2bBHQaf2e
TLSH
T17C62D82EA914293B9DDBD75AFC61BB17D7F5102562841EC4EAFCCA2C14E76CD221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 65c6fa9b8153f32eb7d47d7dddbc6350abd306054bb3fed300b962b620dfd52a
MD5 c1930fbab57dce8f66103a4017995b21
SHA1 71b9cec2900287fbd25dda10628b31dfb8383a56
SHA512 ae7f3c44b337d9122e8fc1a0179d2aa10e4be54bf65fe8917f5351c9fd92fc3d3c6a50aa3e8d5623ac52d48eb5c8304240c3c64bbfaf4118bc3c58f7808dcbab
SSDEEP 192:eRUEKMg2DG/a3v7Ap+PRpgK9brruH9BHsb+WNV0W1inXiDLxX/2bB86kwwa0A+VK:eRU3Qtf8GXUDwJmiDLxP2bBHQaf2e
TLSH
T10562D91FA91429379DD7D72AFC61BB17D7F51025A2841E84EAFCCA2C14E76CD221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 db4af140c73f6b56aec7b61ad6235ba6aee16c191df8bf61ca63ea35cb750132
MD5 28ade6ee0bb2b935a2ee41f4cb6ba4d7
SHA1 9521617715aa4d4b496be4156780dfa24dc9b8ec
SHA512 67d634dbe9a16225fe3acbadf809ae1bd22f7cc0af68ed1863933ba964b63d2c432d07b7e63e467790bcea6652eb032fce8f2aaf4404ef21c53c87bdfc7e8bae
SSDEEP 192:eRUEKMg2DG/a6v7Ap+PRpgK9AtH9BHsb+WNnW1iF5CrX/2bB86kwwa0A+VyIsnAq:eRU3QtW8GX2DwE+CrP2bBHQaf2e
TLSH
T16562D82EA914293B9DDBD71AFD61BB17D7F51025A1841E84EBFCCA2C14E76CD221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b348ef89a2004de3932b2d422cfbadcb8511ef1f7a57517647d45e46cced5182
MD5 b0d1f07abc4aceeca25ae213a8bbac55
SHA1 a12bc0ba5cc6482694c623f530bb61f84aa919e1
SHA512 31718e2157284309c07a2a635a298c85d9a7fbefa24d929b57b0b42e496770d473b3856a02414740260339a70352d551dfa116ce6cda0e72e227cf4c48e62db6
SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLuLcifa7XOD0z+ErU3W8HGWTStBdUV:460v7KxkXqKf/pUZNCgVLH2HfgsyX7p0
TLSH
T1AE72F867AC4C9A770F94C6CDDC26BA4FADB5024B65DD886483FB581903C5BCB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3006b098-d107-4835-bea0-548f510d6386\index-dir\temp-index
Size 2KB
SHA256 c8c6b54918e10e33662f591b928159831bc7efef2a7436bd9f7dc62da46928bb
MD5 04c56326bb7442bbc3f0842763714f63
SHA1 c538351edffa369047271f4eec58396b135355aa
SHA512 0efe71a74bfcb8d48ef97255e94771f086a94871a656fd7a938c778b22f774c85795fbed086331960e415dd43b5374bd1d5bdd93824797215a6c3b4a41a86168
TLSH
T11F51958CCC809BADDC7251F92DD814F263752D24FC58C792C464F1A234836641B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3006b098-d107-4835-bea0-548f510d6386\index-dir\the-real-index
Size 2KB
SHA256 b7356a39a8b3dd9ce7d4c296623de434f0e16bba49d2ed96244d3f5a1e495c45
MD5 c77056e71ca153bd34e5c7955b4258d9
SHA1 2ce6966eddad149f1c40819b545ded66996141bb
SHA512 5fe04982bd8ffa1b37d1823ee6f4724a864a5bb2acc27f54753c8ee25444d84d10d99b22d9ac0ae719eae78cc58e944a504ae591f8ea4dd68d738383eb081c7f
TLSH
T1C741948CCC80979DEC7551F92AE855F253B52D24FC18C2528474F1A23403A681B4B9FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3006b098-d107-4835-bea0-548f510d6386\index-dir\the-real-index
Size 2KB
SHA256 977541e8d6ffe70ea2cc35c7ec5e273c65fb437a7e32d2dc1d62ab8808412478
MD5 ac2b320a1fe21952cba266e881e5f1e7
SHA1 6458be68c4558a008185c015b731acdbd41958e3
SHA512 05e5ec46c5da829ed5132deb48bcc7e6c798dceaeb7377351062c79923c5c3e761ad93018af06dc8ef767a2bfae4a847c7ea4cdf883b77a857449fa444b37d32
TLSH
T17851748CCC8057ADDC7161F929D814B297752D24FC68C792C4A4F1A134936681B479FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3006b098-d107-4835-bea0-548f510d6386\index-dir\the-real-index
Size 2KB
SHA256 7fcbc3a09dc9a2ffd31cc210263558cda5bd143a288941184e8d693bc00a6782
MD5 a5129b799bbbb7c3010c97a9ee0b29de
SHA1 6ffa9003ea94f92340c48b34eb1379decf2e0213
SHA512 94fd304393f2762e5a720c77677d9c00b1fd98da88c315e692a11ee7bba38a629a0793bb714d8931c8ff7228f8962b04fa71e5b5ef149f87b1858b496820bea4
TLSH
T13051758CCC809BADEC7551F91DE815B267752D24FC58C792C464F1B134836641B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c99d6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3006b098-d107-4835-bea0-548f510d6386\index-dir\the-real-index~RFe5c99d6.TMP
Size 48B
SHA256 d228d448d0f928c1cc34ba88a3c395bb4fd72f788b85c349db58e922612b3453
MD5 6d9602138ec9c08251e57da519681c13
SHA1 b034f08d111d33e50ebada89508f25dd2a4a9fa9
SHA512 a3c16b47d619a70be5fb6be18eb6d28fed7aa9e0869200d56f336695deddf9d4f1d6412b5abb8909d7fd7577e775372c7dcf4606d7927f337418c7b612457760
MD5 SHA1 SHA512

Submit Download

32f6b69cc25e35c2_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e45c25b-6394-4b77-a3b6-b92b47a7489e\32f6b69cc25e35c2_0
Size 2KB
SHA256 9a6ebc9bef7cbc1cda31b6eaac7722333c0a731be0f5578e9b8c05a8bb9ef126
MD5 a4e96e2e2144cac1625157cb66d6079a
SHA1 13eab5939c13f9158bed53a583f486901dca310a
SHA512 d238dae2798e14d8f6e720ad420a436f92108f196dc627084e74fcc402e89d6b3977fca62ad6ed02d06968d2ef0d488f4769c7e509993c8a9d95db98007260a7
TLSH
T1304198A67B20CC50D68097B1EDFFDDFC6225AD27C89A54A728123E5FB8F52D085AB110
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e45c25b-6394-4b77-a3b6-b92b47a7489e\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e45c25b-6394-4b77-a3b6-b92b47a7489e\index-dir\the-real-index
Size 576B
SHA256 f0245ec69e62d0a1f9af62e630e4d7c89b9af48bbc3fcfca15ac6cb2e525ceb8
MD5 5785aa66a1a084e7b95577601777e79c
SHA1 d2de6835a5cc3670294c5925a7e94b71b1cbf40b
SHA512 b931c325a098cf0296be4c6b585d8e8a73c28a27235d4391df6e5edb142916c2ed6ad2afa8f0720a17465b9b3e91da0a13385821c23870f8b4d8b1777339378e
TLSH
T114F0AB80A161C01EFCB03C7A039321303BA4A49A0F9066B32C01103B750F20F9A0AB24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf554.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e45c25b-6394-4b77-a3b6-b92b47a7489e\index-dir\the-real-index~RFe5cf554.TMP
Size 48B
SHA256 ae8d66ecd3d3b0700299f43238dec3a3116f4b940fa0a8d0493ca94bdf9f730e
MD5 c25321657ef087e2690ad6ace05168df
SHA1 8ae3db4164ea855fe572a4b5a7d12159948a8451
SHA512 ca9e7b0bf2e2d9aba7bca349fe232ccf00a67b165d0802a08fbe51c02d6505a7ba01e700b8081995d36fd8d94b09c2ed9f2b50e9fd23b701601dc495606e3161
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 dd15a2b406a3949f22166b61b57ec5d4fdf8b910640b86195902b5428fe72963
MD5 57f33505fe356904e2b5a2c4d399cfd4
SHA1 4aab0a84b54ac469828855b9636583070d76ecc4
SHA512 81209fcca90e48dbe29e8340afc525b89743c2ec423bcd6ce5f2a676847e8539c1c78357f4ba2c560bf52aed7cd16a599c444b633f68ada82c186c4825ec8112
TLSH
T188D0A9D6813148CA6A30AB81103422AC523B8F848D84CCF48908B0AB2CB8503C403526
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 36f85fa6ecd879916bd73174051c803aa2e8dc02f9f0a3298054792c96f9a583
MD5 34c979884caf9b5e98068d7cae3dadc5
SHA1 4644498b4755d3a34065ad58d12983d5fb9ebc25
SHA512 459dd08f1ff65aba767f6eb65d772d1539191494da474661c1a7590fec9c908c759bbfed4e488d74eec34b6aae8341306c62621328a960130e1b51e3507a55e6
TLSH
T100D022CB45308A831770FBC83439358E817BCE08CC86CCE58D06B42B39B8513E401A35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 a28ad98d04c42f5d958e1e37ea202576e6ee055a5d76ee03b94d441a419d9a6c
MD5 c43f741c6e617d856af4c715eda1f846
SHA1 2a092748061e69dabb1767c97e1c4539f3e7429e
SHA512 32df0af13ab326b1bd7127a5179c4b78fb50339e3f3c458becb4082d855b8e575251c359c1d7e03370d8ca6a3c925f16eef1f265f4c73d4b4a9866f0df942f6d
TLSH
T12AC092D348108A874B30ABC834387BADA62FC6488CC4CCF59A08701B2A78917A802A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 414852d5b1b8f61af05a80af6b6e693c296cafb7cb6cd7e3fe3938799dd71dd6
MD5 288f43eb27a601159700ea1a4c84215e
SHA1 4f262a62fff697bd20721a943727ec6e133a3476
SHA512 cd64cb255b0a47558a402e8b17bb5018e1c975b028a2bb1b8d4bbce18f2b8cdb09d7884970ce1c7fdef3784667ab58341ede38d2a4c6258c18a6df2a7bb76c76
TLSH
T1DAC092D354108A8B4B74ABC8203877ADA62FC6488CC8CCF8920C701B28389179803A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 733340b7cf8cfe3a3a8151c4dc58e3d8563899c7ea863ae1650a1a4331e35ac2
MD5 18ba3e98abbfae69e8d3583d403c14f3
SHA1 7d103db37d650bbe0d0b51ed06acb37fa5ad9a8f
SHA512 d64869d9b13f26dc4f99e5abbe6ed898f47b7e49547dbd82b2b859293f5932c5b6c83111c7969a9a5c149a88b844b61caf941f8bab3d4bbb19c1a39e41b71bd0
TLSH
T135E0C045F9510D459CB7DFF1382130ADD73F914C8C07DC688748102926B060BE496E29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 ab080054b6565f9565c15a203405c711cac8121e2b5495fdc993b27e4a879bbb
MD5 33f01865147556e7ebe145bed52f6d4b
SHA1 3f44274dac57a963e31e27e2fc3102e5423f9102
SHA512 f1019f7106bcb2301f247dafaa9ee6d2d70c6c5f64f6af36c6ec65d9be713b6fecc7a94e29e83f3869f370698d16b6de0e60e242537538c8db772580b95d394f
TLSH
T1B6D0A786685405860A355EE4343476AC916FCE8C8D81CDA88B04716633B490BD819A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 390B
SHA256 3eea568e4e7d94bd771c894c1d3f7ade8e8618cbd6cbff4efe30f181fc2614e5
MD5 3b86b149a492b3d42220474db6b18b3b
SHA1 85d23f5e9b838ef820216fd9adf55b2efd1a7208
SHA512 b624f7d698d2348ab5867a75d4679063836c061b95c1a68ab855320cf762ed7cd44c6b1f72a4d83e386596759c3aeff37014fcf805aa4f14f45d766e97c0c8a1
TLSH
T192E06845B9620D45CCB79EE1782134DE977FA94C8C02DCA88A49302927B060BE495D29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 02cc469dd21aae2387a9663d035ed63c284892cbc547e6ee7755bbb523d0eade
MD5 b8c7f7038c738dcde51e51a4197329f7
SHA1 4079d8e02ce6fcdc09aff7ee56ab489c1e8c301f
SHA512 6398f191d587cd7a53ef1a2d4f88eef477ae8bc624f0170ed96dcd6c37f725136d752fb540ed5b655e997dc9026db104548e911504d46c6404cc144e80b58a99
TLSH
T14AE0C089F9550D499CB7DFF1382130ADD73F924C8C02DC688748202926F0A0BE496E69
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 790ee4c4cc72294bbb9b1ea71530dfbb81fa7c99f1a893077ca5ba4258f3a513
MD5 033f273cd56050d0044e0223d26c1b80
SHA1 d9a2d1633a60ff691b07428a3fd5f8780ef41c37
SHA512 7a23d94007d5e5e444e0e256ce11941e468cbeceadd841b96a307d2007e8c1219b774ebfa9f6596748b36e07dea6e7720b5b7ddd23ecbc28d9bdeb454f579e12
TLSH
T117E0C045F9560D499CB7DFF1382130ADD73F924C8C02EC688748202926F060BE496E29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c74ca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5c74ca.TMP
Size 137B
SHA256 845635960fd7a37118c7f21810823014ec231b9d24b03040768fcaf433837a9e
MD5 16b36864648c5b9bf1dec21acaebd4c9
SHA1 7c85f3494bebaeb4394946ba67a67613b5f3f288
SHA512 1114a502d5219f2ea255c73932565dcfe151a8bc65f7e03dc3a1124b645cd23a8a99c2984b3c87744388eb8670c1652ce6f1bf808299c66d7eb6aacdc7db7f5b
TLSH
T1A0C092D344204A874B31AAC52038B7ADA63FCE588CC0CCF4920A705B3838917D806A25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 f354ffc0349afa29e709d45d273066649d310f804a3189167accc4edc37839e3
MD5 e8fc286091022866c6d28a36d00d7127
SHA1 d9d6bfb8edfff210e9c7dd2c05d6ac78cef683b9
SHA512 0304219ee482997558c2232e5bbab6c4920b68f4bb4bf6967a48ac50a530505d8f95b9ea2c1e60f561eaf546f2c95bdc0c224bc53bf39962ad84372cab1f9b91
TLSH
T1DCC02B208040C110C05191F4059114EC36309F40CE09130122E829575C7B0314008102
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ceead.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ceead.TMP
Size 96B
SHA256 cdd5efd7d21d5f6930a3ba3a0190ac6862279e4d292ac411b27905d08faa1c09
MD5 1b1e3367c79081c8dcc6fed5ca0235ca
SHA1 1c51f4e533acab019ce7d451c3e92aecebc3c2b9
SHA512 afe018d47c3ed496d0d8d43a7774bd0b2759e5ebd62ae22a702962833773ac12ff18dd65a1866c1c43ba7591ef808ca4ca54e3f57fceb6529dbf0f512b20f2a4
TLSH
T17EB00255C613A616C0C287B075DED5DC7D64DF75C6037312D3E02A67DC3567145252A1
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png
Size 10KB
SHA256 8eb2475af37471d0c8668d19cac0260cf31320b189217b01da9e937acd8f6b18
MD5 e5ed1d60a7f33f28b9a6789a089a6d43
SHA1 974bb8df6c4b316bb6954437894181527e1f28d4
SHA512 0a705f27f5b16fd8a125354b63b1b5789b88290ca570783ae61ac5d441f49bd9a666b166aa178547046c775ba72b95af20600ce5cd960431c4144bdea60156d0
SSDEEP 192:G7rJ6x3h1JJRIc2CHl2i2W2OI14DWEEnjMxD3TLU83e3G:G7mdjI64TdSDWE4jK3Tte3G
TLSH
T1AF322A55A441885179FECAF3D80BEA034663C33686165727841EB97824F75836C4AF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2408_1190226369\Shortcuts Menu Icons\Monochrome\0\512.png
Size 2KB
SHA256 e7537de88977426000cf535f51c50337339a74dcafbc57f4a8e3da6e72d6bb7f
MD5 3f4622732a64b2bd7f0b6c9165fdf499
SHA1 cfaf799b98b045b88b2782476b16804266a3255e
SHA512 d410b3fb37228f08481a033f2936f76726b00fc09888a1336d738ed0fa7d240ee67a98479702bd7521cc5f9900fe9428134a3797a1b4ed08f4225561de626bc1
TLSH
T19C512B185350539340B98C5ECB530DA19CF2CBD24ABF82E8B80C274855AAF24BA88FC1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\f8f36b50-413f-44a6-9cee-ed4c95e76c55\index-dir\the-real-index
Size 72B
SHA256 29a1f42d42110089f829c539be4dfd85fbf204535c0a44bddca298c462c693f7
MD5 a3d4599eedfc93cde8ef2b907e70e485
SHA1 fca0bbc98b6a639de1c86bb40a5d13c165180264
SHA512 86b2bb69b8d1e26b9d4a768dbd7d609e9659a6fc15930369024e0e7e0c9245313569c0b51e830de0ec8e786f4566689d28080f0994bb8cfb30ac33f6ae3ea0a9
TLSH
T187A0022C12614305C44043B4246741E2B239CD14F905160785E67595C8961F5450323D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ec9b6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\f8f36b50-413f-44a6-9cee-ed4c95e76c55\index-dir\the-real-index~RFe5ec9b6.TMP
Size 48B
SHA256 22687eab35134c6b02fb344ad4f46c59e3ec1583c91cb967a1ca8a0b8ccd0a7c
MD5 fc2d4c53ea9c954de86d5e61f22611d6
SHA1 3a90b4bc7fe9b4d18e583c57c31a25a9351c8621
SHA512 7f914c6b34cb059b685c971585a438810fb42119a3f99e3489784517e8649b1160ac0f53a16f063a6937f4f192791dfc7fb091617eeea964c88316eeee55fb0c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 78B
SHA256 2359ea5510eca7b6baa0bd71ae4fa3933cce65bad0a6f99089c7d0b6f0801096
MD5 cb43da79de684dd4af0cc45383bf5ac1
SHA1 0f9fb1403622d67a8d3801da3fcabf13584ab574
SHA512 561e6e496e2810c107453b08a807f09a0c8e3f5a102e60518cbea72ea4a28b417c874cd42ad4a0af48ffd536f8f6184a555779e4ec683d4d348496b1b499d804
TLSH
T19EA001B70804848A6E70A9E82436B31DE20B869D8CC2CDF0985880822268A660002860
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 159B
SHA256 ce8139244b6d59dd2b2124f4e0f2a406b0299485c04005c5ed7a8b067cc8d57d
MD5 e0022502d014dae95ca74c83a34effe8
SHA1 73404954830ee96a08a2f04bf8040e902323e9b9
SHA512 b866cbd6e422602c8fe464c320ece7ba4baa6216462c4bc6d7c4ca0876be5b2a8a0ac0c6de3cc2151107003c1e3f8d3aed088a219354ad9cde2af78ab7a30e1d
TLSH
T101C08CE30120054A8B709DC82076F34DE22FCD19CCE1CCE49C5A304626389238903868
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 153B
SHA256 2407d14de72d811ed4841dc29e8ffbbf3a8473cc5da503be778d4560f4f3d05e
MD5 7650793b5df3eef866812a7410efd715
SHA1 3139f837f6574ae918a17c538bf41a7c11be6fc0
SHA512 08c43610a383cefdbe6ed8002ef88044f9def045d2077967b70a4ce164ab2371823758f4e24e021a7fbd42671998ba2447bc885f60bf8c2d843f206fe8e9de7f
TLSH
T1D0C08CE3041486464E709EC8303AB34DE21FC208CCE0CCE49C58004622789238803828
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5e7686.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5e7686.TMP
Size 162B
SHA256 02a78043dbce30a350b1e2047fc1e188c39740d5565bb154849aef705b65ad34
MD5 a72862f62499b33ff36052ce348f17a2
SHA1 70c961f185c85889b24e2cc99b0aa7392ed2807e
SHA512 8b0fc66148dcca163611d748d49dbedd51e0ccd74c9dcd167f62e1a20092c103a72910dd10962846bc5f8e5538a9b4a6fec4ec2b5b51d6b2abc637cd0bdf9b5b
TLSH
T1ECC08CF7413084522F30EAD42839A38CD2074E0DCCC6C8E48844B0C121F8B22C402924
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1558f472ad9a4df9b90634618947108c9670de853596dc3791466ceaa95a3ee7
MD5 9d4936d355cba9a7d7e3966606021014
SHA1 1e0f5bd0243eb8d5c27f8ceba2467f6149c9d120
SHA512 7ad5235d4108d13265c208e490a174dc4214b18daf37289b818ffc775b965a61595381303356a8ad8b9f7c118335959e7c5695a49422b52d3e69354e4cca42d6
SSDEEP 1536:aP/MtP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:R++J3qUQm08KMWF0bFTcVHr6z2
TLSH
T14D9302B8991F7979536BC2A690179CAC4DD3DCCE211425BC30C66F1E18BA393A31B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 cb17d8cb75c809ae7bba81f8a24d7a4c34d32bead15db9f095d39b4eee51a6d4
MD5 346981039244e4aac3e5776673aa99b9
SHA1 721dcd59d68f92e4ecc60deef40623c884451bf3
SHA512 bdd84eb79ae6e405db6e4fe0d07567a4c2edcd2bbdd22212e42540a775b062f76a0f3777c5009da8cceb37d269a72eb910594d7a4def9d15f3843e1979df3e5f
SSDEEP 3072:XcothHWNfF1sE1hE5i9v8qvaJFx++J3qUQm08KMWF0bFTcVHr6zh:XB2daE1Ki9v8KGx++JjcMW2VcVLu
TLSH
T12C1412B5DE0F6AF2975EC2E6A0274DAE8C91DECE613C253433C69F1E10CB7805392566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 f7d2a8f0b04507de567909027c8043b47f25b90d561179dece691efe54f9abd1
MD5 a3b0f93e96e8da0c6a19ef92b3829093
SHA1 7a3e66034843fef95b5ba9ffbfa45ced9ccb7447
SHA512 8ade8fa8dd7eaf5c90c79a76bb2ab506eb99ab0f6eeb878d0c37bafa2b4bf21082b514f53005f20b7f0aac95a08963bd8672f6617cb13c4f968c6cdaeb7dde84
SSDEEP 3072:ovcothHWNfF1sE1hE5i9v8qvaJFx++J3qUQm08KMWF0bFTcVHr6zh:ovB2daE1Ki9v8KGx++JjcMW2VcVLu
TLSH
T17D1412B5DD0F5AF29B5AC2EAA0231C6E8CE1EECE613C643832C95F4E50CB7805753566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 fa21ea37cf976aac99564e23c04e05067d7c625c8f7083ca7d9ef331f60c96c6
MD5 24623d9368640d6f9dd95695905e66b1
SHA1 ac21f42e8558d5f13029dca3fe8a51ed19214770
SHA512 b9d4dc210b0bdcd1d9e30d4935f5a8d137c5ec1c05c0a4c170d7a72a7754760023800c98a3f4b8c2897b7732eb104332d34a652d22c06ad274db238b3975c98c
SSDEEP 3072:GcothHWNfF1sE1hE5i9v8qvaJFx++J3qUQm08KMWF0bFTcVHr6zh:GB2daE1Ki9v8KGx++JjcMW2VcVLu
TLSH
T1211412B5DE0F6AF2975EC2E6A0274D6E8C91DECE613C253433C69F1E10CB7805392566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 ee5458c82e9034b2c150fb16d9c90ac7761920f1fec04bff59c19a716792f1c8
MD5 b520b138c64bed5673e9781b91725ecf
SHA1 f761c8e68a2080eac0a9152977f4d5f7eefb994a
SHA512 d2abddd0e235ca0ab9b7c2aab9613d3a4798409f287995eaf951348e1845171e3342474d8b080be9bd36ba5b1a559c164b53ad233d4eebe8796efa7fa7c4e84b
SSDEEP 3072:MvcothHWNfF1sE1hE5i9v8qvaJFx++J3qUQm08KMWF0bFTcVHr6zh:MvB2daE1Ki9v8KGx++JjcMW2VcVLu
TLSH
T1231412B5DD0F5AF29B5AC2EAA0231C6E8CE1EECE613C643832C95F4E50CB7805753566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 8671e9176a2f348b48e7bfebb4ca4e922d9cb60f937c482183b726a1e406cf22
MD5 7aa2f14ee4b738f41353e87c887e7674
SHA1 a2b831335e66e96bfb51c310eeef2b58f36feb87
SHA512 92ae7b30becf679ff1af71d4247b838dd6866c94aec8f5c038ce9a4768b9a9a45bf64ab4e206087ef56d5962a4fc8c47c7acae806733bf925f0049b03322d562
SSDEEP 3072:8vcothHWNfF1sE1hE5i9v8qvaJFx++J3qUQm08KMWF0bFTcVHr6zh:8vB2daE1Ki9v8KGx++JjcMW2VcVLu
TLSH
T1841412B5DD0F5AF29B5AC2EAA0231C6E8CA1EECE613C643832C95F4E50CF7805753566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\6PbVo4NKa_J_\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\6PbVo4NKa_J_\PresentationNative_cor3.dll
Size 1.2MB
SHA256 ac85222567293f695d972ef2edabd999372701d27b6d55f2d5721fa48b215f13
MD5 bd33368d12bc185c25770002a4eee9dd
SHA1 97da8bc1e1d3272061ec4437c25a4838af88e678
SHA512 764c3fb7cc46f7fe92301651266d407310a509d030c025bd953d29689d529d8244d61c898445412994fd2bd21f5b3b74dbfe11bb5180c6a44ab4dc0242c2b4d1
SSDEEP 24576:ygaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPIFv:jnR+g8lYP00OM8zT3GbNUdvoxWZBlIu9
TLSH
T1A1453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LunarPatcher\6PbVo4NKa_J_\wpfgfx_cor3.dll
Size 1.9MB
SHA256 ba56cf777a370395c385ecba19129efbc6673d5ef5f18c23f8d90d23b140a6f1
MD5 c0364436841e2b0f4ec096a12662702e
SHA1 49a4865deb8cdb6b91a6894e164559672d3e251f
SHA512 3a54ab1165b321d78a3b24967567ced00d2c6d64d51688e3e3016167cbbaced73cd5d1703bf69fcb25923a95c75e916ad0fe5c03a0403dbeab18a35f38a52314
SSDEEP 24576:kIxIZGnThquyQ2wv/JYIjXeIn/9FD3xBfveqZD1Eycg3wKXnaERvkNg4P:ywTUuyQ2wZYIbNFjvfGMEycowKX92g4
TLSH
T149955A46B6AC40EAD47AE23CDAD7461FF27178102761A7CF23A0479D6F27BD0497A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LunarPatcher_Setup_v8.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-F4NK2WOVA3.tmp\LunarPatcher_Setup_v8.tmp
Size 4.3MB
SHA256 cf7000425851eac14f967bc70be0e67c81c2f1bb16fd0d94d15208d2853f43ab
MD5 0b7c1e414d641af04b9c7020e66e254a
SHA1 122952f544f0ccfa21342a5caaf5d3de1f6ed9a4
SHA512 0d8785abd7de081a585a7d6854ff605b5fab47b6e930e993a9fd4f34b0ca6457c3a3b5024cd50e7f8c91c86763ed0fa66446c3282d2d5fab9d4730a0c4e252df
SSDEEP 98304:c3U5HY/KwjoYY1j48UWm2eTMFdC+Jx333J:t4/1jorPmEt
TLSH
T132267E03B348753EE4671E3A483FA680983F7E213A25CD4B6BF4195C8F3A6416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lunarpatcher_task.xml

Path C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml
Size 3KB
SHA256 0aaafb3215f33759d4d2ce57977cf07f97d419dd0a3016d1d87a177b81a30482
MD5 b3d7c9450fe1995b2760ec9bc471068f
SHA1 26fa6d92659a986e4202de7bd7e4aabc6e3d65ec
SHA512 29b497d1de2d2d5cf7e1ff0fd59de5539ea94cce52a54379fec73de9c0323ad9021342d4f89ba274d8c0e65931cea83eed2c5a6087f7f8a12308281da670f6a4
TLSH
T18461364367EE1109B1F76B2CBEB724614E67BC555939C46D00AC200DCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

lunarpatcher_task.xml

Path C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml
Size 3KB
SHA256 57673d4d595d5d66e3cb4b44dc9f24d464a9bccb65ca479dde1ac8189fa49399
MD5 fb72278a150ce015e5780b2a2b191773
SHA1 ba261c09e77f07568c0a2a69a740c9327ce4bf18
SHA512 a6a4a0d03637ba9aadb9d3d92ec509209f6b5b56180ac7f8f87d3bc4830f237a0e2463712a63236d6c5fce13362b5b9931abf2e19853932ba0a669dff9f48b13
TLSH
T17761364367EE1109B1F76B2CBEB724614E67BC555939C46D00AC200DCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

lunarpatcher_task.xml

Path C:\Users\Admin\AppData\Local\Temp\lunarpatcher_task.xml
Size 3KB
SHA256 af9c6d039d44a53495700c78bd1bd6c98a6896784e2024f2c55ade0b170b8790
MD5 037f567f695e96378e12df4a7f5f8695
SHA1 2fb382348d15e06ed23737c819cdaed3b931ab91
SHA512 905a6556e3302a90219eff1d18e593c5037c47941c651ac825e067131fe9400ed55e780657c47482f20e6c738fc6489d717e1357e1e1b6ce1751048bff51580a
TLSH
T17361364367EE1109B1F76B2CBEB724614E67BC555939C46D00AC200DCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Вооtаррег.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Вооtаррег.zip:Zone.Identifier
Size 104B
SHA256 af472cc6140277a7ac58c71ad6f1a7fd01df4cedeb564f28b294be3b7884c830
MD5 6f4825cad9da37f14025160e999f857a
SHA1 902d67d29d2ee86efc7d33c7ef5ac91b878c3325
SHA512 9d64761677b2c77de78cbe52ba825f13055a6857fae04884bf689573a768f1864d2b2a4ea1f822cdae1543f431ae5b802b34080cf274d0a4c77862d361dae383
TLSH
T173B012BF840489045A2033C022BFD70CB30F2B2E8DD381C0FCE444A6B8404ED80954D7
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 8d60b2201819bdafe3f5eb90010afccc663f82f7ef68fcc111039c271fbcf9cc
MD5 24e8a0c53ab97e86c5f5a1d4cd1a99a4
SHA1 b86bc7707d5417bf1f330f9850744aa235716bab
SHA512 005f68ce488457fdf7c116193dce16a95ee2e44f60659032b3f4e57d876eed8e4bd943f748d23505c54065ea0f9f0e9f542814e7e5086eadfbecdd984a6f9707
TLSH
T1273139314A4558AD22F38B64D428B46BE23BD0BA0D97F5A5754CC20E3F7090EA3BB34D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2748-38-0x000001BEEEA80000-0x000001BEF38A0000-memory.dmp

Download

memory/3892-7-0x0000000000500000-0x0000000000600000-memory.dmp

Download

memory/3892-44-0x0000000000500000-0x0000000000600000-memory.dmp

Download

memory/3892-1-0x0000000000500000-0x0000000000600000-memory.dmp

Download

memory/5956-8-0x0000000000270000-0x00000000006CB000-memory.dmp

Download

memory/5956-9-0x0000000003220000-0x0000000003221000-memory.dmp

Download

memory/5956-19-0x0000000000270000-0x00000000006CB000-memory.dmp

Download

memory/5956-11-0x0000000000270000-0x00000000006CB000-memory.dmp

Download

memory/5956-5-0x0000000003220000-0x0000000003221000-memory.dmp

Download

memory/5956-43-0x0000000000270000-0x00000000006CB000-memory.dmp

Download