4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076

Resubmissions

20/04/2026, 15:01

260420-sd558sdy3p8

20/04/2026, 00:51

260420-a7ldtaay5s8

Analysis

user interaction
yes
max time kernel
395s
max time network
401s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Velocity.zip
Size 12.5MB
Sample260420-a7ldtaay5s
SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
MD5 69c1ec1744daf4c5dea14f428621dbce
SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
TLSH
T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
32	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "210"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211203680003300"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4148	MiniSearchHost.exe
3932	LogonUI.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 3832	3272	chrome.exe	83
PID 3272 wrote to memory of 1596	3272	chrome.exe	84
PID 3272 wrote to memory of 1596	3272	chrome.exe	84
PID 3272 wrote to memory of 32	3272	chrome.exe	85
PID 3272 wrote to memory of 436	3272	chrome.exe	87
PID 3272 wrote to memory of 436	3272	chrome.exe	87
PID 3272 wrote to memory of 2556	3272	chrome.exe	88
PID 3272 wrote to memory of 1816	3272	chrome.exe	89
PID 3272 wrote to memory of 2556	3272	chrome.exe	88
PID 3272 wrote to memory of 1816	3272	chrome.exe	89
PID 3272 wrote to memory of 2908	3272	chrome.exe	90
PID 3272 wrote to memory of 2908	3272	chrome.exe	90
PID 3272 wrote to memory of 4396	3272	chrome.exe	92
PID 3272 wrote to memory of 4396	3272	chrome.exe	92
PID 3272 wrote to memory of 5116	3272	chrome.exe	93
PID 3272 wrote to memory of 1080	3272	chrome.exe	97
PID 3272 wrote to memory of 1080	3272	chrome.exe	97

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Velocity.zip
1⤵
PID:2280

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab6dbc728,0x7ffab6dbc734,0x7ffab6dbc740
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,7653816453450623823,13985800861699066196,262144 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,15109597241541821347,5788702148759554192,524288 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,7528202770781270163,13787182843934743734,524288 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,10307471606767972606,17296074584359077323,2097152 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,3621853566556687352,15634104243768838545,2097152 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,6946007659183590703,14833009075880667885,2097152 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,3488930237525278015,5344818906050773215,2097152 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,8494547496506660984,10670479878102662994,524288 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,8121856948534022205,14453276109884726802,2097152 --field-trial-handle=1956,i,17401169357018331011,5620612646778152808,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5108

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a29055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 80a0101e975bc166e16ea4f120cacf4ef14bf30f924652f37a04b91ccf145275
MD5 e061e5e2eff2242d678cfefbe002c8ad
SHA1 5d3b8616fc98df0c3e3b9922320949b2090456db
SHA512 0809248bfe79d88ff98488080c4c0f626651c140007e6aeb3386ad04c1119abfeedc26a4dff4cbc7973c1a8b8843e3a5be455cc64b458dce4ae8e7276ff47e42
TLSH
T123E02BBACC31D82B09FD0B1960144B82F74023572B51859B7A3D820D4FB423705D681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e5dfaeeef9a99c0d54dfa9a654d934176a38ebf0f1df55f4c8e451943c0bb838
MD5 7eeaadbfa0736e79fd9cf75a84050869
SHA1 f70de83bdae9af13e11012513ad48af7b1dff3e9
SHA512 20ba24c822cfccb3bde44e2eb63069520f6e5d424defe591911af016c167423b80a281c3681c15b26813455742d73a5ceba7b2c459632e1e2cc50b2a756d5b79
TLSH
T1A4518DF793E4866D891196F4AA156F2FCE790A14031C3CA689D4AE1B53F2972E20178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 0df530d57dfd61f288e246d58d42d8671124a27c635f3b9033a9b3e151e4c06c
MD5 b4e8705d939270346ef409c999f1b489
SHA1 a6ea8c64bbe1e6e9dc55759d6d6d7e4373463881
SHA512 1170e0aabc98d5baabacefe95ecefb8ca7d9478a7eb3b50430daa1252e480bc38b19d4f7044aba3f844f3be25a260d57d07acffed5b7a9163eeadb0d72083945
TLSH
T1ACF050E7AA7E793B24BA45AF1E5078055CF6AC3B018128F4CE5A413C9045DE75F03847
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 78043b58862fdde125fb4bb4f8ac5967e4407e706d32ce85e28d3b693587d0b1
MD5 5e627c9c434fcfd7a34f9d9dc47bbbf9
SHA1 cf4ee7952389798a3ef953a141eeaeb2313554ba
SHA512 b740bec9ba1173754716da55720ec4567d4c1992d9ac05d09c1a2c1dde0c5d40facaaf9c9d77c7133012eabe9a8d2ac0c6672b2489a1b190bc7af4a6bfd55050
SSDEEP 192:FRCPVuBMsfGBagMBvv7dpAPRp2d9ZHsb+WNnBm0Nj6kwKSrCXVyIsnAUgtaJ:FRqVuBthBnpUXGHwA016qXx8
TLSH
T13442A32DA954753F5CCAD229FD61B727E6F5202171942E84EAFC8A2C18EB9CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8fc0bc8f5c44d428dd38688b354f453b27b65260481d52bc9a6bdcb547f996a7
MD5 cd0fea322bf8204d434c392a8bfda915
SHA1 a61a3f11d0198f971f4157bf4249f34b42297d90
SHA512 d5c924b21afb135afa8b8d46c482c2f401b5eb1798edd0ecd9bd52b82942dcc8e2fee2d320db58a34309eed6311336e8743ea5ac5ef637529ce6ebbdabf79984
SSDEEP 192:FRCPVuBMsfGBagMEvv7dpAPRp2d9ZHsb+WNnBm0Nj6kwKSrCXVyIsnAUgtaJ:FRqVuBthEnpUXGHwA016qXx8
TLSH
T17242932DE954753F5CCAD229FD61BB17E6F5202171942E84EAFC8A2C18EB9CD221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 94382f1f8b7e8c5ca361bc17a6b92f4aacb6c4f127565d5f17274c95e8dfceb7
MD5 2fcfcaa8617003480f20a9d2c5a32174
SHA1 3201f7bb18c9e67e865031c50c6dfd3c2c15c0cd
SHA512 258dfdf23d3379f7c64cd43cd3588c0992b1d0025ac2ce4746724aa3ed52fd951b37f6502372c0ad647f3461c60f2cf532c0befb9bc63ae44f7c062a24cd3dae
TLSH
T166B01210C402A602C04302B01186488831545F10C705138573F16AB6E8271A24224154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da55b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5da55b.TMP
Size 96B
SHA256 53d2f4edd750a888144e55c390172f291875b90cb4017b8e8ea84cf314782961
MD5 3c0d35b1725d9b1ddf6963b444dc69db
SHA1 60c163c8f4dacc835a64d8a64be0b95f8332e598
SHA512 1d23d7954b46053326c69fb941474908ed943ec7c394ca914d7252b897ff998401afd2d1f5448c969c18143d9c41283d3d405239187907f6a1885dd74ae4a146
TLSH
T103B00296C15AB312C04227B0699A99D9B260EF39C6071262A2E11FBAEC6567145251A4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 fd402cba2e019d13682bcf9e22d60405c633c972758683477bfa6777ae94e0f9
MD5 2cf74b0171b8e40e702c5711787afd93
SHA1 b0808e4c752b87de7e5df41db01a7613429a2337
SHA512 bb7037decd0b22302c5b307bafcccb106f9cdd0a944c396d237676f8c1b098d3887df1ea9780e2424bb913c03e37491e0f6f70d02af40bef868d04fa434d4a8e
SSDEEP 3072:ukcothHWNfF1sE1hE5i9v8qvaJFo++J3qUQm08KMWF0bFTcVHr6z1:ukB2daE1Ki9v8KGo++JjcMW2VcVLu
TLSH
T1B21412B5DE0F69F2A75BC2E6A1274D6E8C91DDCE613C613432C69F4F10CB78013A2966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 22928c9628b4b78ee7ecb4361d00ef4470577596283eeb7d83056c57f8279402
MD5 0eb2837ba95b143b14e5e937aa47d918
SHA1 550906a3e8d8421263c03dc02b4e85d9e12bcfde
SHA512 bb949d0c0c0f8121fd85b5b11731f0f834b14fe943419fa89e2b13a63f05a62803f69a6e0588f382e641db76bb5d0fd1ba283a16a35f91b29bae1241ec25aec9
SSDEEP 1536:XDP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:r++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T16A9302BD991E7C79536BC696A0079DAC8CD3DCCD111451BC30C76B1E14BA3A3A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 239c342bd59c914d036bcca867901af9f632dfe61e16f45b0d9117ff86800794
MD5 678830999bedf8de7e50fe9946b04b86
SHA1 4a9558868867f15c654471333a51f597b6e550b1
SHA512 6ae85be2431ddd7edb67171c7f1af434f4fe6fc32be5439b9dc55ad0daaeadf88af6e955729861cd473890a0f0c842c52252b3f8bc47199e281146377b4dcf6d
SSDEEP 3072:xhcothHWNfF1sE1hE5i9v8qvaJFo++J3qUQm08KMWF0bFTcVHr6z1:xhB2daE1Ki9v8KGo++JjcMW2VcVLu
TLSH
T1C01412B5DE0F69F2A35BC2E6A1274D6E8C91DDCE613C513432C69F4F10CB78013A2966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 9996ae9e60a00489fd1ce2cf8a78cc2084e79631777c76ef84e40250141a1a44
MD5 cabd1b6884a16b55ad53f849c04341a8
SHA1 d38457f315dd2899883048bb0a5f79fc93835a05
SHA512 8fc7468b40673038e9bd5ffe9905b7cf6f93c98ed68254ebcef7780aa24599e1cabeed8e96c0db2bfc2d297fd88f0e08a16cac606b58a94f43e4cd06560bea5a
SSDEEP 384:TJWJRVca12krtuJVpmXmlJVjeQ8RJoSHghYjUhUWK5PEm5k+GDa500VGYAV7cg3A:l+RVcWrml8RJdHg2jUhUn1k+GDa500Vr
TLSH
T1ECA25C743AF41719F3F69F759AF1A95A643AB8669C00DB4D0122028D0937D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads