5343326fb0b4f79c32276f08ffcc36bd88cde23aa19962bd1e8d8b80f5d33953

Resubmissions

22/04/2026, 02:00

260422-cfajcafw4j

22/04/2026, 01:58

260422-cd9knabs2z4

Analysis

user interaction
yes
max time kernel
65s
max time network
65s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
luajit.exe
Size 98KB
Sample260422-cd9knabs2z
SHA256 5343326fb0b4f79c32276f08ffcc36bd88cde23aa19962bd1e8d8b80f5d33953
MD5 00f60ee3ff2dee681b5d7d442009b2c2
SHA1 f5199b4191add11d02d58f521cbea21465b7ff6b
SHA512 6e3754ec8596f3aaed92387c5bd56ee9d65fe54af6f44d2bc89b4df0f670e379137bc5eca5ba8aceb030bd4b45970b3c01f2132d1eef53f5070f9af4d4246562
SSDEEP 1536:mmNzk2shF9CXUatIEqTIm4gKN2PwJy4wMUFA8:mmVvtQTKN64wHK8
TLSH
T1A9A3B5CBB6A44DAAF740423C80E6D321613FF6F0A6131B576A3476312F52B916DCB16E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5924	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212967616095834"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6084	WINWORD.EXE
6084	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5896	chrome.exe
5896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe
5896	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
6084	WINWORD.EXE
6084	WINWORD.EXE
6084	WINWORD.EXE
6084	WINWORD.EXE
6084	WINWORD.EXE
6084	WINWORD.EXE
6084	WINWORD.EXE
6084	WINWORD.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 6020	5896	chrome.exe	82
PID 5896 wrote to memory of 3252	5896	chrome.exe	83
PID 5896 wrote to memory of 5924	5896	chrome.exe	84
PID 5896 wrote to memory of 3252	5896	chrome.exe	83
PID 5896 wrote to memory of 5756	5896	chrome.exe	85
PID 5896 wrote to memory of 5756	5896	chrome.exe	85
PID 5896 wrote to memory of 5776	5896	chrome.exe	86
PID 5896 wrote to memory of 5776	5896	chrome.exe	86
PID 5896 wrote to memory of 1496	5896	chrome.exe	87
PID 5896 wrote to memory of 1496	5896	chrome.exe	87
PID 5896 wrote to memory of 1016	5896	chrome.exe	88
PID 5896 wrote to memory of 1016	5896	chrome.exe	88
PID 5896 wrote to memory of 5060	5896	chrome.exe	91
PID 5896 wrote to memory of 5060	5896	chrome.exe	91
PID 5896 wrote to memory of 1956	5896	chrome.exe	92
PID 5896 wrote to memory of 1956	5896	chrome.exe	92
PID 5896 wrote to memory of 4612	5896	chrome.exe	93
PID 5896 wrote to memory of 4612	5896	chrome.exe	93
PID 5896 wrote to memory of 1828	5896	chrome.exe	94
PID 5896 wrote to memory of 5028	5896	chrome.exe	96
PID 5896 wrote to memory of 1696	5896	chrome.exe	97
PID 5896 wrote to memory of 5292	5896	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\luajit.exe
"C:\Users\Admin\AppData\Local\Temp\luajit.exe"
1⤵
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc7fac728,0x7ffcc7fac734,0x7ffcc7fac740
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,3829084052325667900,16539038590568523131,262144 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,4488819988223309811,7321100900181408799,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,6726392018568556131,739752472768346630,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,770780275977990886,11984201430591601759,2097152 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,6652163536013194635,1631902894228204766,2097152 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,5487719091598593317,12938008581375543867,2097152 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4560,i,8127879316704205336,12384322050487523198,2097152 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4204,i,3611205153085189331,14366455211908244068,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,7589597766791523946,7036111774437957954,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,18083072170698374578,18081426850383060557,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,10419487464451199532,6507785339468401395,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,5255437030554727169,3273090746197964128,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,15862614320100922263,4723460537489817231,524288 --field-trial-handle=1948,i,6453956055903238062,4716094500487591002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:5292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4996

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\ExitSuspend.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf85b3acc52c485a740510f164677ecbaeb2eaba0827f1d9440bd20b6bde0ec5
MD5 cd4d21cd0283fd9274b387daa53e27af
SHA1 3eec880fc46ddb053e29ddc7a2810c29b88777ba
SHA512 2ea4d8d2331c8821d6bd39929ab37b42068487c9661b08cce4456db253740571d0849be51906486ed36fb8175be319b36a23b323c5239221568d08a1e7bd4432
TLSH
T1DAE022EACC22D82B08FD0B2A60544BC2EB00031B2B41854B3B3D821D8FB063B06D5D6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd09d1792106a5f87715f85d124b47f2f6154f5f5ec18d9e89443da994759de0
MD5 0e6ab3b48fc9fa9c28080ebd8f83094c
SHA1 8538878cfd6ae368bcf56b57c8f7768345a88a29
SHA512 4f3103d527af378c214e7c19bfa876f0ff5e1f359d74102b72fe0da1baf54d8558c55b9e96f71d9da91bcc1be02764a6dbfa333fc47f03e90eb430f166ed1b15
SSDEEP 192:nRoc3uBWg9xcgr/v7dpAPRp2d9ZHsb+WNnmz0do23eoQarHCfVyIsnAUgraJ:nRT3uBNnRXpUXGHwc0W2Eae5e
TLSH
T1D242A62EB914793B5CDAC219F962B757D7F9102121842D84EBFCCA2C15E7ACD621702F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a085c918f8b3f0d5303af7ac2cbcd3fd4333102796a948d8a6f97f2f5a31cb64
MD5 1161c1a3680342380e25f0fc16cfafea
SHA1 e4e2e32b2bdfbdb20c698f276737bab0e7e418f3
SHA512 81d86f25acf12da7e9241a5fddbc1c02f31f80c7144ac46a16e9361f19de280cd94043ee3fe5555851fb50124ceb1318784d0c6f67b0c6faae3923a15193a8d1
SSDEEP 192:nRoc3uBWg9xcgrIv7dpAPRp2d9ZHsb+WNnmz00o23eoQarPCfVyIsnAUgtaJ:nRT3uBNnRUpUXGHwc052Ea258
TLSH
T10442A52EA924793B5CDAC219F962B757D7F9102121842D84EBFCCA2C14E7ACD621702F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8b534fdd0017001d2b677732fddd110725199b228954991f2ce8eb0210045bbb
MD5 1e1c80a3c9381dc0cb89442f10c22d67
SHA1 0201e29e4e877d9d92781fff9809909ad962a6c6
SHA512 33bb73fb573c46f0f25ad9df1a1fcf0bc4e1c9f73059e81be21b7a32abd50ac74ee0d8b61abcff09503c05d53a01fa05ec8b58374797d290da07c2abf36d31ac
TLSH
T11EB012508001A501C80B06F91282458835249F108705670163F46D759C2E6D140241D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc80.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dc80.TMP
Size 96B
SHA256 2839b811cdae37315facab1a3042f79ae684743e3f58b9b2838e236cb1cb1706
MD5 629ba72121f11c314aefc0ce04f2b048
SHA1 58c2c45c9af4f9ffb17126dfe7f2c74655a6c300
SHA512 8a50fc23c9b94f6e909214fe21a85254c544f3f1011410ca391eb22b2943143f5d18ae0dc9d81ebeaca3c84dee37fde06900a758c49744b438d4d5fc9d5141e2
TLSH
T173B00266C102A212C44307B02995D5D97262DF25D6036B5AD3E41A6ADCA667185259B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b457a93f3406f94866b0c4a8857928b38450077bbbadb31937902367f1b60144
MD5 62c10675ebf712427ba18a062355159c
SHA1 f5631c4df2ac294061c0e08b20c4d809200987fe
SHA512 c6bdd7023bad0cedf8cecebcde54fea3691cf545ede0e317755c38ed74ac51025fd04fa236d3acfa89b2b64a937014fc60db1c2ec7015ac1e577b09fab7d0038
SSDEEP 1536:XGP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:s++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1EE9302BD991E7C79536BC696A0079DAC8CD3DCCD111451BC31C76B0E14BA3A3A31B8EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 898d294f7334b589ddda86164c332dce35310bfec3edb5137f22b4467f9ed457
MD5 e1564c5363757d4ee326963c18df594c
SHA1 df7374a6a1d53377f13f59451ab2aafa2ad70868
SHA512 205d6ec6c51a69c73496c583edd08f7c2c7c7d48405f45920fc2244a85cc4866bc7963f6423351c6e271e35dc4be8f5827e613d58bd8e87dece8862924b64099
SSDEEP 3072:jPKxSmy6B1pYrc8kcRAgMlB94hpCTBKP0Xrd++J3qUQm08KMWF0bFTcVHr6zR:jP6OQRsAgU4hGzbd++JjcMW2VcVLC
TLSH
T1C71413BFD42B3C6A95DAE359E0339E8D4CD3488F6924797C30469F1D0CAD2E66253C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 920f20b65ad5407d21056ebccff4dc7f29b9298943567f7d5a246f58144268f3
MD5 1999a6a1951dfc209dd19beef8b0571a
SHA1 20f044ced11658e4faf4e72c3f0724959829f666
SHA512 0a9b719cee06014b77b87270a57e64257a180417ab0888326eaab235bb3601b250fb9eda3b5ec70ed55d90181125e70fb1016cfe431d27ed31d5633ac537315d
SSDEEP 3072:6PKxSmy6B1pYrc8kcRAgMlB94hpCTBKP0Xrd++J3qUQm08KMWF0bFTcVHr6zR:6P6OQRsAgU4hGzbd++JjcMW2VcVLC
TLSH
T1921413BFD42B3C6A96DAE359E0339E8D4CD3488F6924797C30469F1D0CAD2E66253C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 372B
SHA256 9faf521dbf05ee075170a4feedb41990bffd4da8de8df0c119814f050eb2cd8c
MD5 392ff1b1f8dd99deb23c7cc0b83e891b
SHA1 31434d23b05346313ee4fa4d304103bec7b3f3cd
SHA512 c82f7f67c3b4b5ecc0273cd397064e5912fbdcb4f8e73c32bfccffcab8e320d2bd34c89f534ae136d09890040a172f5b0815407ccc3d291144f96af70c302169
TLSH
T17EE01A577325EBF2937D81A83D799DE887F34C08D3AA552026DC0CC90D62983C4A7448
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6084-91-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-93-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-92-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-90-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-94-0x00007FFCA4C20000-0x00007FFCA4C30000-memory.dmp

Download

memory/6084-95-0x00007FFCA4C20000-0x00007FFCA4C30000-memory.dmp

Download

memory/6084-89-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-138-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-139-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-141-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download

memory/6084-140-0x00007FFCA6FD0000-0x00007FFCA6FE0000-memory.dmp

Download