82e79050083a681f6854099840176cfebc01464701206a6ef039d47386eb9a06

Analysis

user interaction
yes
max time kernel
97s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2026, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ENC_ cancelamento de cartão de credito.eml
Size 67KB
Sample260709-hkhcmsdw5j
SHA256 82e79050083a681f6854099840176cfebc01464701206a6ef039d47386eb9a06
MD5 9043c641aaf0d088e8a9df95f4a3251c
SHA1 5dc58f6fd9032a4abcbe5f3aa39ee77d1c5bbb9f
SHA512 e5f6f0399913041daa831f9e543bd8c40ed8292ccbc25ae2655fa4b44f78f7f974112e492f4957fcd66a22ed5041f1dd8701ea1a7d41b3a8f5392bee65894a25
SSDEEP 1536:OUEZY6qJ3JlVCIqgEhM1ePKbPqW3vkcrCV+RPIdzvWc2aUVIumObGQ:O1CJ3JvCI0hM1t73T++RPIdzvWc2aUVd
TLSH
T19C634B129B9E0D61E8D392EC3D02BD0F63813E61E6BFB190784695A70D9F0C6DB6F506
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
224	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280533533331726"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
6132	chrome.exe
6132	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe
Token: SeShutdownPrivilege	6132	chrome.exe
Token: SeCreatePagefilePrivilege	6132	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4680	OUTLOOK.EXE
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe
6132	chrome.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
4680	OUTLOOK.EXE
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe
1700	OpenWith.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 6132	1700	OpenWith.exe	98
PID 6132 wrote to memory of 1260	6132	chrome.exe	100
PID 6132 wrote to memory of 224	6132	chrome.exe	101
PID 6132 wrote to memory of 5400	6132	chrome.exe	102
PID 6132 wrote to memory of 5400	6132	chrome.exe	102
PID 6132 wrote to memory of 5980	6132	chrome.exe	104
PID 6132 wrote to memory of 5980	6132	chrome.exe	104
PID 6132 wrote to memory of 2564	6132	chrome.exe	105
PID 6132 wrote to memory of 2564	6132	chrome.exe	105
PID 6132 wrote to memory of 1596	6132	chrome.exe	106
PID 6132 wrote to memory of 1596	6132	chrome.exe	106
PID 6132 wrote to memory of 5808	6132	chrome.exe	107
PID 6132 wrote to memory of 5808	6132	chrome.exe	107
PID 6132 wrote to memory of 4772	6132	chrome.exe	108
PID 6132 wrote to memory of 4772	6132	chrome.exe	108
PID 6132 wrote to memory of 4664	6132	chrome.exe	110

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\ENC_ cancelamento de cartão de credito.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument mailto:[email protected]
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0xf4,0x7fff5932c728,0x7fff5932c734,0x7fff5932c740
    3⤵
    PID:1260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,4823076935149752333,11342816304549140064,524288 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - System Time Discovery
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,18266787288299262595,12005110608701468385,262144 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:5400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,17725908552446843281,5675120257419946188,524288 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,14192501231774526263,6001562723280274070,2097152 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15289969473336366503,9758294109614958016,2097152 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,10005238196129467391,14132847156231191443,2097152 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
    3⤵
    PID:5808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,8052384163994329895,13835557449408156096,2097152 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,9754413187796398240,15027896939003929062,524288 --field-trial-handle=2060,i,17783738023936459925,17339001540301864807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    PID:4664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e6d2132b7f9e889ab9723256f606624760775f02b16464e30ed99c793c8e585a
MD5 656e0815d204f6b36d0f1c8a5c01d61e
SHA1 af3232733789a188b9156456944c0a417008ec3d
SHA512 04457f68167760014edf7f6bd5f0b05cabc6b62644eed64b1944add860e6a66ace9b630d75ee259f8c6a9ac04f7b19228807bc9beaff8e507934530a6b7f97f9
TLSH
T11EE02BAAC966DC3718FD075DB0500749F765131B3740984B3B3C85094F7433A4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 78792ffec1c45301c455233b180fea2c7a765ba02df00d48e8888b689dc5ef89
MD5 a8c82640e77d3ed2764432e85ef2dd0d
SHA1 e594d423a6c683ec699a1801a21987bc90f96aa6
SHA512 e7b0ba81411af9f09d12e50a5c0b8c547060fac7dc5cfb42c9c1706f71a7ad9f0856932464139e243bd2db47bebae76d368d7829edf86c026c08be4da39c95cf
SSDEEP 192:TRovCY6n6hWjv71hpAPRp2g92Hsb+WNn1ldHk3ViggeVyIsnAUgtaJ:TRov56jbBhUXDQwvdE3Vh8
TLSH
T11B42D56EA911697B6CCBD22AFD523B53D7F1103621E12E84E7FC8A1C15E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 389795aaad6a2071635cc515a2647c2e6ec4d0a43f2593b1bf245ab7a95f343a
MD5 43f7f1942b77291f69a6155c7179c69e
SHA1 f58ba0c0499e17a50daf2679f9a40a71a088034c
SHA512 b48ed78927395e9356b3007e29822621f24c10e3f34b4b12553133d64a5f2acc3f7af0f500a09a2b2f599ca861fe96becb898b574fbd91bc7e925dd259821e0e
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLILc2jwxXODKh+ErU3wZSH1/A1iYPj:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG6977
TLSH
T1E872F967684C8E770F94C6CCE8177B4F9DB5024B65E9C86443FA982903D5BCA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c064c702936b0c4fa341a0abcab06528c04f74f524e1dde2cf0eeb27e5f9662f
MD5 fab775c00ac38e61d2325104504f59e9
SHA1 81601101c5ee26e37ad0eeaa02d05b73b425f892
SHA512 e70fde542b114d7474b897928e4cd784896543463a5226eba6c9e94b891af99c1b2fba563a0e92cfd75025c2cc3cc4ad5df24969e7933ae7cd48a5a3b7ec7e88
SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:dm7Rkm1tYpBeh2BAo3
TLSH
T12CC312275E71E9375D79AB4EB08E0B1F1EF24AA6C930DE92C8D85B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 a7bc69620d033030eb971e9f9285fe0b5fddec6c8698238f17386211b2542787
MD5 4e8dd1f458dbd0d9bb6c8b12a24e00fd
SHA1 721366be66b4269c777dbb5da7d18817c58042ac
SHA512 930e2542160ee9b7e387635e238b8ce44c068eddbbb8826c42790f2d8e90213b2e78bfb85e5b982f5edbf51fbd9cca322ac2c55c58437d1a7764bde2d8686218
SSDEEP 6144:1cKUIgXsnK7utyfNtm7Rkm1tYpBeh2BAoP:22gHut19oBGcAoP
TLSH
T17D341277BE79AA7558E99B2CB7CB0F1E1CB0D2A3DE288D1654E8710847EC6CD4609C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/4680-0-0x00007FFF40A70000-0x00007FFF40A80000-memory.dmp

Download

memory/4680-8-0x00007FFF809F0000-0x00007FFF80BE5000-memory.dmp

Download

memory/4680-11-0x00007FFF3E2A0000-0x00007FFF3E2B0000-memory.dmp

Download

memory/4680-12-0x00007FFF3E2A0000-0x00007FFF3E2B0000-memory.dmp

Download

memory/4680-9-0x00007FFF809F0000-0x00007FFF80BE5000-memory.dmp

Download

memory/4680-38-0x00007FFF809F0000-0x00007FFF80BE5000-memory.dmp

Download

memory/4680-7-0x00007FFF809F0000-0x00007FFF80BE5000-memory.dmp

Download

memory/4680-10-0x00007FFF809F0000-0x00007FFF80BE5000-memory.dmp

Download

memory/4680-6-0x00007FFF809F0000-0x00007FFF80BE5000-memory.dmp

Download

memory/4680-2-0x00007FFF40A70000-0x00007FFF40A80000-memory.dmp

Download

memory/4680-4-0x00007FFF40A70000-0x00007FFF40A80000-memory.dmp

Download

memory/4680-5-0x00007FFF40A70000-0x00007FFF40A80000-memory.dmp

Download

memory/4680-1-0x00007FFF40A70000-0x00007FFF40A80000-memory.dmp

Download

memory/4680-3-0x00007FFF80A8D000-0x00007FFF80A8E000-memory.dmp

Download