2dae63543f854b1ded859de5918ca0577ee39c6b4b27508e6690289b05f0a0c0

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_4dca2f91ce6e908e5b1b71e37f92812f_akira_batrat_cobalt-strike_glassworm_quasar-rat.exe
Size 9.7MB
Sample260509-e3pb5aaw5v
SHA256 2dae63543f854b1ded859de5918ca0577ee39c6b4b27508e6690289b05f0a0c0
MD5 4dca2f91ce6e908e5b1b71e37f92812f
SHA1 4b02cf0e91ddfef415152a6baeb77d3e305f6a41
SHA512 ddb8573cc337db099294e393287eab53db0a5abd23c5b399d8527c14f257f33fdc4498b43736bd636ac437b84f603a875cb284d5993ca6147789af5085372c19
SSDEEP 98304:I4wgAHpUT0bTkbM1MjkPyTPsL10ivjIs5m3/HnYsXKEAjC+s:FZ//AjC
TLSH
T190A66C07F9B390B8C569C4B9C31A7673FF31BC4A44367A6767A48B303E64B506A1DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3032	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227744991622279"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2804	4388	2026-05-09_4dca2f91ce6e908e5b1b71e37f92812f_akira_batrat_cobalt-strike_glassworm_quasar-rat.exe	86
PID 2804 wrote to memory of 4292	2804	chrome.exe	87
PID 2804 wrote to memory of 2280	2804	chrome.exe	88
PID 2804 wrote to memory of 2280	2804	chrome.exe	88
PID 2804 wrote to memory of 3032	2804	chrome.exe	89
PID 2804 wrote to memory of 4420	2804	chrome.exe	90
PID 2804 wrote to memory of 4420	2804	chrome.exe	90
PID 2804 wrote to memory of 1192	2804	chrome.exe	91
PID 2804 wrote to memory of 3016	2804	chrome.exe	92
PID 2804 wrote to memory of 1192	2804	chrome.exe	91
PID 2804 wrote to memory of 3016	2804	chrome.exe	92
PID 2804 wrote to memory of 4012	2804	chrome.exe	94
PID 2804 wrote to memory of 4012	2804	chrome.exe	94
PID 2804 wrote to memory of 4948	2804	chrome.exe	97
PID 2804 wrote to memory of 852	2804	chrome.exe	118
PID 2804 wrote to memory of 2144	2804	chrome.exe	119
PID 2804 wrote to memory of 5016	2804	chrome.exe	120
PID 2804 wrote to memory of 5024	2804	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-05-09_4dca2f91ce6e908e5b1b71e37f92812f_akira_batrat_cobalt-strike_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_4dca2f91ce6e908e5b1b71e37f92812f_akira_batrat_cobalt-strike_glassworm_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app=http://127.0.0.1:9876 --new-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc407fc728,0x7ffc407fc734,0x7ffc407fc740
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1832,i,6631998759002250672,15728341625491694858,262144 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1652,i,786955364424312084,4420548319338871360,524288 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,7278525013819013447,1954423013354773004,524288 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2608 /prefetch:8
    3⤵
    PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,9193488590068614900,5746585528952846883,2097152 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,6939047661377717578,11793727142881827160,2097152 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,10580638065814809351,15028910282057506709,2097152 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4448 /prefetch:2
    3⤵
    PID:4012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,9753717554102892822,2164202308732207592,524288 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:4948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,8611182478353632442,7289415856215870198,524288 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4576,i,10327021388422871191,14231843734796238353,524288 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5396 /prefetch:8
    3⤵
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,12981830679699873109,12606669639927645387,524288 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4452,i,4710460697917301755,12729717798794591740,262144 --field-trial-handle=2068,i,13097325879429607410,15230611420283043877,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b959a601499be651fefeecf627339bd4640eeaa95287d41bd22b5168f20361a5
MD5 a679c1df52eafad72b15ad6296f5676d
SHA1 2f3c5415ff2b18e42062cebebe9bf76c5992fac5
SHA512 d0826bbc04f9666bcbe5acd1eb56a91a438d1beae38a5b64dc75a9219a4768cafb6fa32de37717532b97556a6eaf06f886bf5919efe81fde62538aa40596c9ba
TLSH
T115E02BD6C915AC3708F9671C65644746EB4143172F40855F3E3CC20D8FB47365246C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6a39d664e69ff47c4f4189d0494a05cbac961f3a0e985e94c1a850683851298f
MD5 544d90df1e5909f45b9565cdc8ea864e
SHA1 8a010d1c2dd548c510952a8ea35f6c25371d88f6
SHA512 4519711c2b604d66543b4b54d8443f19a4fc4a58f9e23251f2346976517336cf96d31fbc6b059d03a57a873e9d37b4c72478973418874be91fa01aa75f6e47ee
TLSH
T19C51BEF793F4957E861192E4EA146E1FCD790514431C3CA6C8D4AE0B43F2972D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 22eefbdfe710850e1d863f9cbd70e53803c72f0734684cf68f621f2e302b3494
MD5 8ae43815ea2791e1037535b4359ed151
SHA1 436f8aa8379f9f2ec16ebeaf3ce93ff6509a738d
SHA512 0b10fb46b8b3856d8600025fed8686665523819a76112424c5d75984241e68034b3d003f2981627e1bef38ff8d3427f3784067f748ade598fc8b953be5f03988
SSDEEP 192:7R+KPpBJ/nPA5+vDv7ZpIpAPRp2g09wHsb+WNnZLd7Q2Hy25gcHykw+a5MqVyIsH:7R+29z7EUXcOwxK2S25gcSj5Mq8
TLSH
T15042D42EE954693BACDBC319FC21B747D7F5002261812E88E6FC8A2C14E76CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 68c4e52f6428eab0ebf6147878db03fdb63a8718c0fe7eeade0fc81ab817b89f
MD5 c4bce2095ceb6eae967c0ff0352da1dc
SHA1 f27c2faeb8fae3da291b4bc63c1b2bff274e358d
SHA512 e06465f14260801c71883641a39a6828cadc1e2575b39964c8913969e1837c18a0a5e4e5ce62a159f42400af534c0a4a569b8b7e2499c636cda8d72659ab7bd4
SSDEEP 192:7R+KPpBJ/nPA5+vDv7ZpIwAPRp2g09wHsb+WNnZLd7Q2Hy25gcHykw+a5MqVyIsH:7R+29z7EBXcOwxK2S25gcSj5Mq8
TLSH
T18942D42EE954693BACDBC319FC21B747D7F5002261812E88E6FC8A2C14E76CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7085bd26a00ea25f436317507845db76624f1e305c5ea5c1633f0710fb2525e9
MD5 6fedf8e0cda28604a18bc21b3b3a9b01
SHA1 6e736322a4f9228617a8d1dccd80d010032b80ff
SHA512 7c43690cde2a8678a5465e416e0cead981d993013a68eccf60d0f0f8520df5a31229546fee29023f6dada5f06f5e8901b2628e5ccb2a58fa5dcaf82771739eca
SSDEEP 384:UO62joO6z7KxkXqKf/pUZNCgVLH2HfgslBr7pLuLcifKO6/XODoO6P+ErU3f6HGy:UO62oO6z7KxkXqKf/pUZNCgVLH2Hfgsr
TLSH
T18972E9676C4C9E770F94CACCD816BE4FADB5010B65D9886843FA982903D4BDB11462FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4c8ba307e9d321ac7876b9f9689848d0bb3321997421208cd7363ea90601960a
MD5 2e34ec3be73797897f33e293ce98ffd4
SHA1 fa91d361bd62d88f8be371803ad4c295a6a2e066
SHA512 b92c1870c381a5ead602434c500cacc1494a8e111aa2f3e9465dfbabcd5661235ac49f802324519e8ca1823f6112d2ba4e8488ead2e50ab231b34c002fa99a8b
TLSH
T1C7B0122080416562C08322B0358344AC71587F108706270173E07BB2D82E1A1401C161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585c44.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585c44.TMP
Size 96B
SHA256 2a8e2f814bd6dd3f5d8af4375e12e1396ea396c6f1892ad4a2c078fdd146b555
MD5 aa417ea7987d9593849024ab22f70591
SHA1 6faf8e649d96790a24c8efa7da6bf5ba1dc7e03f
SHA512 ed60e3fcaa02fb5ccdf95b07aab7d05e39e08e0fd3fa8f9027492d432616f8e2d6f44f9782af0577aaf42add5e2f7e5169334dc45893c4cbac9a4f5e36352b26
TLSH
T11BB02222C2033282C00303F0AC80AAC8F030CF20CB03030383E02E32CC302300828222
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 7cc76d9d9e635544f1bf41bb36906ae2ae7ed8ec54520ce12334a07fbde51446
MD5 378e5421066e3dabbe11727ec6badb69
SHA1 559c204d31e3aac778bce9a5a5c8a25dd8912bf8
SHA512 92dc2718b083e6c3eb26e43cb58a6ffe6b889d06a4ceb2e1e8cea00e4c6011a35a4dc6c1f2b75c20c687a14e1746d254c9e2ee5f25cbc44f9a6918e4aa96b85a
SSDEEP 6144:PI/+SCpoA6aAcGE35FrOk0HOGm/SFyEEq:c+SCxJFrOjuGdF2q
TLSH
T1CF14137D7F339AA3E5EE9E82716F2A29CD219B06F28F959D537402CC12C41C41B57B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 d142ae0c669d9553ccedcd791781542f995522580ec12e7d550f25176f28e584
MD5 4bea64cbd076cf2f0d508275cbb61dca
SHA1 be49c4a66d17b6bdf9af3260528f1d00e8a2dd6b
SHA512 95a63894df34135283d43db97cdda8e9ce64ede830a618997a1e66538097cc8d160864e3ebde6c4f89dd6b06a38e94f7cc3c5f16bb8a3f75f77e59af1fe79104
SSDEEP 1536:YEcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3u:X3Qw/xLANk0mUW5GmRntSFCjEEN4
TLSH
T1F19302BA9E174AEB957D4A8176AE7909CE12230D70AFB9CC315C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 c634017cfab774f3a067ff4c264d967255e95b338dbced85350ac3062a22ed9d
MD5 1e460043e0caf8354bd4e82bd7c75858
SHA1 572643878dfed6050f5f677319865fc1538fd9a7
SHA512 b1566dc52705a56ae1529da30117cc576dd9d3186dca0b9b4b1ec1419a76792ff73e3e44f5e787496f4b1399dfae1cd14ddccf011a65c46dfaaf0ad8c79f3ac2
SSDEEP 6144:sI/+SCpoA6aAcGE35FrOk0HOGm/SFyEEq:/+SCxJFrOjuGdF2q
TLSH
T13B1423BDBF239AA3E5DE9A82717F39298D119B08F2CFA29D537402CC12C55C41B57B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 e5d6b26f6a187bec899382f30f0a47db781b140c8e4d908a92477d8d1b807164
MD5 a6a2ec12be7d533cf9f8ffb991cb5731
SHA1 3296b2be247c2834be64ad479eb138e45d328fca
SHA512 c57e3574f555103742fad514e049d433ed0f48dfc14650f1181024cf784beadb4caaa1e9fd2b543d4db8a984a8483f2bf2a655a1c70bedd4210d9dfadc58496e
SSDEEP 6144:hI/+SCpoA6aAcGE35FrOk0HOGm/SFyEEq:C+SCxJFrOjuGdF2q
TLSH
T1D11423BDBF239AA3E5DE9A82717F39298D119B08F2CBA29D537412CC12C51C41B57B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4284-30-0x0000017547760000-0x000001754788A000-memory.dmp

Download

memory/4388-69-0x0000000000590000-0x0000000000F43000-memory.dmp

Download