d15e0afafc2ecbbc3883d3a1369542c16dfc3ed395e13e9de233fadaeb003f4c

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
catlean_1.21.11.jar
Size 10.6MB
Sample260601-rtesjsfx21
SHA256 d15e0afafc2ecbbc3883d3a1369542c16dfc3ed395e13e9de233fadaeb003f4c
MD5 c15af2839acb31f2fac2ee177c01c545
SHA1 a34ee078867ff2a94ada33477c0eeb94ac855de1
SHA512 f95f4dd908bd04725ee593be4b496bf56237c17cffe608bfd67d2c7cfabb280c905a661f600bf1c5198c17fe8946f29d801dd9a36bc953ecb9228c60e510174c
SSDEEP 196608:U5/L57DWES67iJ6Uvn5pG15WyQ1QpGwFuwG6DXcMVLAzWWs7pru3ge4Wuzfhxpjr:2L5+m7dUWz0a7uwG6rcMVyWdpdBzfhxx
TLSH
T195B6125A3FE48565DE07A0B20900F5636C2A53CDD106A02BC9B40DDB5B77DAA8F13EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247978279823025"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
2856	chrome.exe
2856	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4040	5004	chrome.exe	85
PID 5004 wrote to memory of 4972	5004	chrome.exe	86
PID 5004 wrote to memory of 412	5004	chrome.exe	87
PID 5004 wrote to memory of 412	5004	chrome.exe	87
PID 5004 wrote to memory of 592	5004	chrome.exe	88
PID 5004 wrote to memory of 592	5004	chrome.exe	88
PID 5004 wrote to memory of 5256	5004	chrome.exe	89
PID 5004 wrote to memory of 5256	5004	chrome.exe	89
PID 5004 wrote to memory of 5276	5004	chrome.exe	90
PID 5004 wrote to memory of 5276	5004	chrome.exe	90
PID 5004 wrote to memory of 5032	5004	chrome.exe	92
PID 5004 wrote to memory of 5032	5004	chrome.exe	92
PID 5004 wrote to memory of 3532	5004	chrome.exe	94
PID 5004 wrote to memory of 3532	5004	chrome.exe	94
PID 5004 wrote to memory of 5544	5004	chrome.exe	95
PID 5004 wrote to memory of 5800	5004	chrome.exe	97
PID 5004 wrote to memory of 5800	5004	chrome.exe	97
PID 5004 wrote to memory of 1152	5004	chrome.exe	99
PID 5004 wrote to memory of 1152	5004	chrome.exe	99
PID 5004 wrote to memory of 1760	5004	chrome.exe	102
PID 5004 wrote to memory of 1708	5004	chrome.exe	103
PID 5004 wrote to memory of 2584	5004	chrome.exe	104
PID 5004 wrote to memory of 2856	5004	chrome.exe	113

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\catlean_1.21.11.jar
1⤵
PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87435c728,0x7ff87435c734,0x7ff87435c740
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,11554941224721078027,2362291415194494141,524288 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15332947344099239254,4695153801646474883,262144 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,14969646740426171168,7843518495598613719,524288 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1744 /prefetch:13
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14188045167155560563,1801572802688212385,2097152 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,5094726486994879392,16755868166835989069,2097152 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,13502080800397508620,17410506619487473925,2097152 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,1646959792502237022,13780554972780232151,2097152 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,3602928744911945985,10842617737600619488,524288 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,16883555548350559530,2015328177190436917,2097152 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3628,i,13322592291310252707,7257110044168892474,2097152 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,18120340795577036967,6896807117408536874,524288 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,3720026597067869099,8723160169119687713,524288 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,7933294231171766837,1630456640842225218,524288 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3584,i,4931994878609628436,9019832127832010684,262144 --field-trial-handle=2064,i,9135687898339406567,12855367776468102819,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5792

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2768

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89120900-3f37-4fd1-a996-074e46db4e72.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\89120900-3f37-4fd1-a996-074e46db4e72.tmp
Size 12KB
SHA256 6e7d240b5cf67453ddf6202e1ea3135276f2efe87e3d1a0010620e861df4c7cd
MD5 83be518e22e8da8e0c38565f4d66575e
SHA1 b14cbce268e2794e267ec946b6f7fea78e351478
SHA512 4a1bb860d3d3e43ee026ce3a69e5033ace97fd34fad762ada6596db5f07578f74ef818d1cbabba2be54f88bd2c08162159e11349ec463528142ddbb8630bd032
SSDEEP 192:HR2cBzzvyetCF0JU+PZROv7H+pAPRp2E3m9WHsb+WNnqx4Sp2k92iskwGbfqVyII:HR2mzDBCF+uiUXcUw832g23iS8
TLSH
T13642C73FB968657B9CCAC319FA627753D7F9102162902E84E6FDCA2C14D76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 99f5fe92ca97dab6dbe3c23541d1ad05575fe4e111b9adfa316fe63c2eedcdf5
MD5 f2a4444ed8500fa264a158d4edd86c6e
SHA1 9da84e5507c473ba178a5e2e08a14a71c7e505b5
SHA512 0eb15f3dcd8572f02049a134201b2cfc12ec492c45b7537ab2422a38dc85aa5bf9220e8e6c3395009b11b56c4f411cddeab97072fb90040d99eb3273d495e1cb
TLSH
T190F0F4BAC831AC7708FD0B1970A44B8AF750136B2780898F3B3D420C8FB463F869592C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 5c0b85dfa8bc52e7df1db98f63e1954be342711fe094e42645ebf6f10cea09d1
MD5 a0eadbf76b0a04f07a818223eb45c17b
SHA1 27ed37e27839fe97c61e1649f417b3e1cbaa839d
SHA512 739d0f3b0ac9f34527b127cd07c87685ae85e8d3086901d991d1f6b9b4f899a258967ac555e2a7076945d65cca02c4002466d1f53f6b44cfe604a64567ecd3f2
TLSH
T1C501244822A88F4BCB304973A5F929D53A2F5E5930439D0D07816E45AD17A71DC8E483
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 a578ca8f56c0de71b517e81c6a61554af05c9c6745ba260b3b17d94a52dc02c7
MD5 fb466751ac3bf27c774da56816052a97
SHA1 444ca13ffe552a98c189fc1fb84bfd3d7483d099
SHA512 c7db430a4df491052050ef3bfa26ca9d8ca7e185cae8bbb298809c10899493d7ea2bdb57ed0b82bd4b8be23ba29c647c3fbcdda088f14a7c71d9688065e201f5
SSDEEP 192:DNokGu6xbGCJvHfzoBpZb3KMI2MlepD44xyNon1NsWrfNq7GDLCxzwvfx2gaKMMK:DNokGu6xbG6vHfzoX1axr0Fx8q1NsW7m
TLSH
T1BD0270F3C2D8866DC91156F4A715AE2ACE1D192943183C67C8E8AF4F93E2472E35164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d19a2d589d04a574202ad0fff5480b927fa7adaf887edf01aae6a86681489564
MD5 53b4f199b479b5164275dc6b4faa5c71
SHA1 74d398138bff01c034db522a40d684c14da0d4a2
SHA512 d7ab0fe67931b20901321fe1a7519c31e8263fc6bb075db9be7d0924a2eb88088bbe2ad4655086b897e347784687e0e4225bdcd181857d2460d7d91751505426
SSDEEP 192:HR2cBzzvKetCF0JU+PZROv7H+pdPRpVE3Vp9WHsb+WNqJqx4QneY92iskwGDfqVK:HR2mzDJCF+uibXgUw5XeE23YSe
TLSH
T1FC52C73FB924657B9CDAC229FA21B757D3F9202162902D84E6FDCB2C14D76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 75ba14420bcc196f627aa0bc71ca05b4ec84253ae717130256a6b05ce6f51099
MD5 5fb566a33539cd1dc352eb612c52eeca
SHA1 f766b12301947ee13eb8eb09109e579a58e6b962
SHA512 1f6abf38695ba5a12cdbc8cc089dc293db7ea1c582557bd0e0fe8751fc5b47b4adbc0e59be3794e77db0a8c6987757e9ba80c5d867b8f44b69eed7e6937c91a6
TLSH
T12AC09251C806F122C10A03F51246E8AC7154AA24A61E2B4952E45A66A834151816A252
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c08c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c08c.TMP
Size 96B
SHA256 97fc39992c6dc654e31cf96aeb269f375ff217c0d6a4472c1bd06f073e318231
MD5 63b1a291c014a1dd5e818502d5d10351
SHA1 bcf483e76eb2ea4685a40c40ded5933169cec483
SHA512 3ee3c98b85f07ebebd679786fc5057342100c74de4717ae96a184d8bd16f8f98b331d1744ee9ac784a5d9beaa0d626754aa730e5307b85af8e209aedfda00321
TLSH
T151B02203C002F202C00203B028C080CC3220CF20C2033223A2F02BB2EC382300C202B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 0fb0aab7f3a81845dc36db43a61b22c29bfd58e8706b597f22c1a2dac88afe6a
MD5 73f8ef7455153e0629e4801c81962bf0
SHA1 c6205cc4d4764f7f8b4fb063abefd1219f104a6c
SHA512 34b188a4a0987241ce2c890d2db6ea0160273f3ed7351746b497504ffa19ac5ff5669eeacea2a42deed6d078efcdc23b4e532527e51a9d39daedb2ea65c5c10b
SSDEEP 6144:pbQXsXhVXVOK4Ps7AInWDfxA3OnjrYQ9EU0/hEu:p13XS07AFDfxjjs+Cl
TLSH
T10E3412755D367DA20DFDEB58700E3B50BEA4ACF6644ABCD166AD2F0C24D9588013BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 098e3c15d6f14330601322e37f9d227e40dd8195e2718704f8181af50d7c4d82
MD5 fa1ca66069409a6ee06b41392f1b899c
SHA1 1a669561b199b9f0139471f95ede39bb3fddd083
SHA512 85892f95e91190d26c556533dca1ff25349e93231018f7d05df94c57ecd1a59c17c673fd7ca820b488412c11e427101eecedce5132c472a909830c0f429524ff
SSDEEP 3072:zzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:3WDfxA3OnjrYQ9EU0/hEV
TLSH
T147C302A11C3ABD660DF8EE98B44D3A60BFF4AC9A91835DC361ED2F4C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 444afe7905f528137e81e478bd6958d63f7e97f6ba7584c644db804676bf19f2
MD5 08371383d2d9cd4583a279f3653aabc6
SHA1 fb29fc9359f60274a12bcce3e55ebfb08729a2a4
SHA512 6f2203a102b403c7678b1ad9565b74e0e18d7836736118d5a8cd37b74885f4e1429774fdfb065aa7baad713966eadd13bac603e6f63213115b7e8899e2e39ed5
SSDEEP 6144:IbQXsXhVXVOK4Ps7AInWDfxA3OnjrYQ9EU0/hEu:o13XS07AFDfxjjs+Cl
TLSH
T1B13412554D363EA20DFDEB68700E7B64BF94ACF564477CD262A92F0C24D6688013BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 7dd07452c48a001ec3d616344dc58a8710429896fbe6a5e1068795f11f8ee4b2
MD5 d426a8b76b292c86ac18b73f57078184
SHA1 c8cd6e91cdca47aa8d47a690d525eb8b5f9539de
SHA512 631564ebe97c90c3decc5bc081cb832d1818f42aac77150911b369a8b9e324bf99bb4bb5cca3dd20c8ae1d84dfd4c973f44faa405761fb588b3a91ae6f5b0906
SSDEEP 6144:rbQXsXhVXVOK4Ps7AInWDfxA3OnjrYQ9EU0/hEu:P13XS07AFDfxjjs+Cl
TLSH
T1863412544D363EA20DFDEB68700E7B64BF94ACF564477CD262A92F0C24D6688013BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-2-0x00007FF882190000-0x00007FF8822B0000-memory.dmp

Download

memory/1664-11-0x000001FE0BBD0000-0x000001FE0BBD1000-memory.dmp

Download