Overview

overview

10

Static

static

10

2026-07-06...ch.exe

windows10-2004-x64

9

2026-07-06...ch.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 03:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
  • Size 13.1MB
  • Sample260707-dstnesgy2x
  • SHA256 b7418aeca711d516449a99493515b3d12139eabb9681f87a9ef530e6afef8a0e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_689013600dfdc129a3234a2a1162a314_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737"
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe365ac728,0x7ffe365ac734,0x7ffe365ac740
        3⤵
          PID:2100
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,9876648604584931703,17918464363969020233,262144 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
          3⤵
            PID:1384
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,431881472556653340,807059937748702514,524288 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
            3⤵
            • System Time Discovery
            PID:3460
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,4225214287162361442,10734802052473788542,524288 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
            3⤵
              PID:4376
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2812,i,6129556412522471973,16658312948070035567,2097152 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
              3⤵
                PID:5632
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,3747552108436352370,3952320715734913381,2097152 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
                3⤵
                  PID:2668
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3700,i,1493144410875083199,10280511414414466790,2097152 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
                  3⤵
                    PID:5136
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3712,i,2749259288695917498,13979247876443395435,2097152 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
                    3⤵
                      PID:4304
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4436,i,4491028657482453169,12978799103181583343,2097152 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:9
                      3⤵
                        PID:2676
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3456,i,13739510243849413801,15634872628271684025,2097152 --field-trial-handle=1924,i,10014524065919215164,13118546976077650169,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
                        3⤵
                          PID:4868
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:2740
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:5880
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:2188
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:4192
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:1944
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:1540

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              prep_Activatable Class_Hermes_perf.cache
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                              • Size 603B
                              • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              prep_Activatable Class_Hermes_perf.cache
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                              • Size 599B
                              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              download
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-3804714354\download
                              • Size 160KB
                              • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              cookie-shm
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-807850687\cookie-shm
                              • Size 32KB
                              • SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Crashpad\settings.dat
                              • Size 40B
                              • SHA256 a747039ed0de0619355297e529a9be3c898aa2d1842ccc91ff6ab14a71354fb7
                              • MD5 SHA1 SHA512
                              Submit Download

                              Account Web Data
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Account Web Data
                              • Size 76KB
                              • SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Affiliation Database
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Affiliation Database
                              • Size 52KB
                              • SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data_0
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Cache\Cache_Data\data_0
                              • Size 44KB
                              • SHA256 a18084484320156571a6aae517ee0bcc4703caff3b9fddcaa26a9f33c3ab9c76
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data_1
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Cache\Cache_Data\data_1
                              • Size 264KB
                              • SHA256 d4710f9b26ec4a73b6d27976f82d72c1ab2e5462c27a1e4ceae7537af2eccc5e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Cache\Cache_Data\index
                              • Size 256KB
                              • SHA256 3734df26749fe9b055ad7731839e806f290b7d050b87b0a45b0418d09533967f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Code Cache\js\index-dir\the-real-index
                              • Size 48B
                              • SHA256 0f4da16a39fe59f8247fc7c7b2c1778a4b5a7116e4066f3a669a34576da975d1
                              • MD5 SHA1 SHA512
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Code Cache\wasm\index
                              • Size 24B
                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Code Cache\wasm\index-dir\the-real-index
                              • Size 48B
                              • SHA256 1bd1861ed09619009d37c8e4bb50b53f8a17e9f61a7740f39d38dcbd93415885
                              • MD5 SHA1 SHA512
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\DawnGraphiteCache\index
                              • Size 256KB
                              • SHA256 a4f277f84995c26b80415fe74f07136ca1ce130286f1f3ba9923c8cf3902be59
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\DawnWebGPUCache\index
                              • Size 256KB
                              • SHA256 1ef24cc291ea0dffb0e824c1db0afe7ee1580c70832180ddbb817cedcd115c52
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              LOG
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Extension Rules\LOG
                              • Size 285B
                              • SHA256 4adef715fcfe99f544027b10e45da1b5ae512f9c9984e5cfa24661e6c56a3c73
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              000003.log
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Extension Scripts\000003.log
                              • Size 76B
                              • SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
                              • MD5 SHA1 SHA512
                              Submit Download

                              LOG
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Extension Scripts\LOG
                              • Size 289B
                              • SHA256 6c5e6356b752dd1456be845aa5f5221bb34c33d6af52c609a940a8a6856da650
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              000003.log
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Extension State\000003.log
                              • Size 228B
                              • SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
                              • MD5 SHA1 SHA512
                              Submit Download

                              LOG
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Extension State\LOG
                              • Size 285B
                              • SHA256 9374c91a11fc34e968f50424b74c45b9716cd39ceb451776697082dfb40b3cb0
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Favicons
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Favicons
                              • Size 20KB
                              • SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\GPUCache\index
                              • Size 256KB
                              • SHA256 9345016ebf1b795a0c01ca7d5b94055adfc6128395eea2c9183c09b044b9f6bf
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              LOG
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Local Storage\leveldb\LOG
                              • Size 299B
                              • SHA256 1eb9a6427a686e6f25d7a24430df3015e73714e988eb12919ff636d3405b8f16
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Login Data For Account
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Login Data For Account
                              • Size 40KB
                              • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Reporting and NEL
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Network\Reporting and NEL
                              • Size 36KB
                              • SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              Trust Tokens
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Network\Trust Tokens
                              • Size 36KB
                              • SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Preferences
                              • Size 3KB
                              • SHA256 b7672cbff4cc5d855e77cf886d55516c5575fe3b9d3958349b0d0be14a918472
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Safe Browsing Cookies
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Safe Browsing Network\Safe Browsing Cookies
                              • Size 20KB
                              • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MANIFEST-000001
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Site Characteristics Database\MANIFEST-000001
                              • Size 41B
                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                              • MD5 SHA1 SHA512
                              Submit Download

                              CURRENT
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\Default\Sync Data\LevelDB\CURRENT
                              • Size 16B
                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                              • MD5 SHA1 SHA512
                              Submit Download

                              data_0
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\GrShaderCache\data_0
                              • Size 8KB
                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_1
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\GrShaderCache\data_1
                              • Size 264KB
                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_2
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\GrShaderCache\data_2
                              • Size 8KB
                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_3
                              • Path C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-4033714737\GrShaderCache\data_3
                              • Size 8KB
                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              memory/1864-315-0x0000000140000000-0x0000000142A68000-memory.dmp
                              Download

                              memory/1864-20-0x0000000140000000-0x0000000142A68000-memory.dmp
                              Download

                              memory/1944-334-0x00000113001E0000-0x00000113002E0000-memory.dmp
                              Download

                              memory/1944-351-0x0000011301CF0000-0x0000011301D10000-memory.dmp
                              Download

                              memory/1944-363-0x0000011301D10000-0x0000011301D30000-memory.dmp
                              Download

                              memory/1944-353-0x0000011314000000-0x0000011314100000-memory.dmp
                              Download

                              memory/1944-382-0x00000113142D0000-0x00000113142F0000-memory.dmp
                              Download