hxxps://download1529[.]mediafire[.]com/kudjtj2ga70g7JAZoeMRcBlpcYoUYPxvuuhfznbramM8khFWcTMX3NBEeyUWdwF7i-Cwx3HejRKMU2el0f1cZyaNeLTAabF5llmAJPqol0zlaOdB49yjVrbLHG0oqNTWDqh_h9UhB7IMV9zGSJI6WPmjLFr8wGEu7w-8AnngE5FqUg/1y5s5xq9rn5nhig/SoloKlSpammer[.]exe

Analysis

user interaction
yes
max time kernel
41s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://download1529.mediafire.com/kudjtj2ga70g7JAZoeMRcBlpcYoUYPxvuuhfznbramM8khFWcTMX3NBEeyUWdwF7i-Cwx3HejRKMU2el0f1cZyaNeLTAabF5llmAJPqol0zlaOdB49yjVrbLHG0oqNTWDqh_h9UhB7IMV9zGSJI6WPmjLFr8wGEu7w-8AnngE5FqUg/1y5s5xq9rn5nhig/SoloKlSpammer.exe
Sample260716-2ncfcafv2l

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SoloKlSpammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SoloKlSpammer.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SoloKlSpammer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SoloKlSpammer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SoloKlSpammer.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SoloKlSpammer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	4432	chrome.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SoloKlSpammer.exe

Executes dropped EXE 1 IoCs

pid	Process
1976	SoloKlSpammer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	discord.com
241	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
181	api.ipify.org
240	api.ipify.org

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SoloKlSpammer.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4432	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287154248417629"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SoloKlSpammer.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	SoloKlSpammer.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2144	4284	chrome.exe	81
PID 4284 wrote to memory of 4432	4284	chrome.exe	82
PID 4284 wrote to memory of 2800	4284	chrome.exe	83
PID 4284 wrote to memory of 2800	4284	chrome.exe	83
PID 4284 wrote to memory of 4636	4284	chrome.exe	86
PID 4284 wrote to memory of 3964	4284	chrome.exe	87
PID 4284 wrote to memory of 4636	4284	chrome.exe	86
PID 4284 wrote to memory of 3964	4284	chrome.exe	87
PID 4284 wrote to memory of 2700	4284	chrome.exe	85
PID 4284 wrote to memory of 2700	4284	chrome.exe	85
PID 4284 wrote to memory of 3620	4284	chrome.exe	88
PID 4284 wrote to memory of 3620	4284	chrome.exe	88
PID 4284 wrote to memory of 4480	4284	chrome.exe	90
PID 4284 wrote to memory of 4480	4284	chrome.exe	90
PID 4284 wrote to memory of 2316	4284	chrome.exe	91
PID 4284 wrote to memory of 2316	4284	chrome.exe	91
PID 4284 wrote to memory of 3308	4284	chrome.exe	92
PID 4284 wrote to memory of 3308	4284	chrome.exe	92
PID 4284 wrote to memory of 3932	4284	chrome.exe	93
PID 4284 wrote to memory of 3932	4284	chrome.exe	93
PID 4284 wrote to memory of 3824	4284	chrome.exe	94
PID 4284 wrote to memory of 3824	4284	chrome.exe	94
PID 4284 wrote to memory of 1080	4284	chrome.exe	95
PID 4284 wrote to memory of 1080	4284	chrome.exe	95
PID 4284 wrote to memory of 2136	4284	chrome.exe	96
PID 4284 wrote to memory of 4224	4284	chrome.exe	97
PID 4284 wrote to memory of 4224	4284	chrome.exe	97
PID 4284 wrote to memory of 1464	4284	chrome.exe	98
PID 4284 wrote to memory of 1464	4284	chrome.exe	98
PID 4284 wrote to memory of 3020	4284	chrome.exe	99
PID 4284 wrote to memory of 3020	4284	chrome.exe	99
PID 4284 wrote to memory of 4836	4284	chrome.exe	100
PID 4284 wrote to memory of 4836	4284	chrome.exe	100
PID 4284 wrote to memory of 4376	4284	chrome.exe	101
PID 4284 wrote to memory of 4376	4284	chrome.exe	101
PID 4284 wrote to memory of 4860	4284	chrome.exe	102
PID 4284 wrote to memory of 4860	4284	chrome.exe	102
PID 4284 wrote to memory of 4668	4284	chrome.exe	103
PID 4284 wrote to memory of 4668	4284	chrome.exe	103
PID 4284 wrote to memory of 4536	4284	chrome.exe	104
PID 4284 wrote to memory of 4536	4284	chrome.exe	104
PID 4284 wrote to memory of 3708	4284	chrome.exe	106
PID 4284 wrote to memory of 1976	4284	chrome.exe	107
PID 4284 wrote to memory of 2284	4284	chrome.exe	108
PID 4284 wrote to memory of 2404	4284	chrome.exe	109
PID 4284 wrote to memory of 4556	4284	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download1529.mediafire.com/kudjtj2ga70g7JAZoeMRcBlpcYoUYPxvuuhfznbramM8khFWcTMX3NBEeyUWdwF7i-Cwx3HejRKMU2el0f1cZyaNeLTAabF5llmAJPqol0zlaOdB49yjVrbLHG0oqNTWDqh_h9UhB7IMV9zGSJI6WPmjLFr8wGEu7w-8AnngE5FqUg/1y5s5xq9rn5nhig/SoloKlSpammer.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbc20c728,0x7ffdbc20c734,0x7ffdbc20c740
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,641221550854243644,18201044260369235996,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,8367542959026926342,12395113553384495693,262144 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,15986112150218906408,8513550632460068419,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3016,i,4353863616818256364,14670201173260826556,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3020,i,18378681058156543916,8954843001762602898,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,13623891900522614114,17340416825645703338,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,9532558095059211667,6580952416275314185,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5360,i,7072128717981230266,17746153944329427456,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,6189945416128065689,17819759367712103758,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=2740,i,3321692919769245386,15057390738137308620,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6016,i,9944866100175220996,1183228330528489192,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6152,i,367123077178938197,1201453559265440557,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,12183031843454466419,8652220923395405391,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6032,i,1330287998026335582,678114276708576926,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6656,i,9696434997243221103,18275034178657248431,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6968,i,3431448779033419045,7658916261044521297,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=7132,i,17633778237198532991,2303446044501505887,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6964,i,7426605672462825774,3195900137023694413,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7272,i,5511076328967422154,4503823951528858792,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6300,i,7055523300635456824,6294026485984932342,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7932,i,17339835026374942909,14627208765008452506,2097152 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,7375916517395968540,6491574427539911369,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3708
- C:\Users\Admin\Downloads\SoloKlSpammer.exe
  "C:\Users\Admin\Downloads\SoloKlSpammer.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7532,i,13665139280367169843,9096141211893788855,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7556,i,3235240980390897418,8493791478974424938,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,1419501083731486200,12772398478429312255,524288 --field-trial-handle=2044,i,12905595707395057193,11910651428433494491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:4556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a4ea8b8be1451fe88f812f0e136bf56744968adc22ba72ce7006f3e1e1037807
MD5 ba45f966ea54de57f69c358e0073dc0c
SHA1 667cba6254daad80766aff4069ea5b0a6b4f92be
SHA512 22c53a7139bda25ee80ce9f8c58aac52a8308f7366ea43f91344610f8b8b4acd1cb444d7ee6e647fa4cc932a876a7047c80822fec841ae05822048be846cc281
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 15aa360de8ebfb97bfa5ae9e9b8758005cafb2a5c2f7c4f310610e69c275775d
MD5 904866296395e28e5884acc712b34ec5
SHA1 60684403a7826cbb7fb15ab1b0e87c4033fa2b3e
SHA512 b00a331df45ac7ac575bbee947e3cb367fea553fb46bc493f5622650c91a3a01c33775fcb567e4974cff19255f4c5616ceb7e5c1bf068c12e5ac8cc85b9af13b
TLSH
T1B7E02BAACA11AC2F1EFD4B5864984A87EA5003A76761494F3B3D820D8FB17368581D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a0f2b094f1b8ad4d7634fdce7a0bbbf5adecc24a6ab8f5de9fceb6007f62108c
MD5 091706d69d75c7e507a93c8f334a89f2
SHA1 11983e80a8923ef4a1091ca6404628b26e43b86d
SHA512 3cc9f0e840dd0ffb41a28e3d4bb411a3abb99c82faeb00a8abe0b9618e4d12c91ff5da25da2011bcf7d9cbfe3c0c664782833bc4be10e4babdc6bae5c2aaf2e0
TLSH
T1D6517BBBA1D16103CF8592B8A6D57C2979B02034A3DF0FDBA5C0D972108FFED1A1C955
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 a9013b52ee94ea708c8984aca0c650f77c1d82bb6f6c19ff398a69c26f5b1bb6
MD5 9b651bd38876fdc6afdbfdcce811df41
SHA1 f388eba73fdf0389510955387b3debeeddb0007c
SHA512 34605192968e9542871e875b004c21c50f3007588f5d93fb9f24f8c6f946036b0b2d1cb904473c5c1c2aba8da876464171c2ccb28a58946d32f2e7ea57858b61
SSDEEP 384:DjMjR74XgUM41BGe1eIx6W/e+T9LuCZsesFrJv09BeNRaIaEdDaRh4IYciS4VY90:mwyljf7Kb3h5j2W1/cIX6
TLSH
T151D2BAF383E5D52E891157F896106E1BCF1C1615832C3C2988D5FE8BE3E2432E16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 f85f49903bef750a4354eaaecf50f8b9ccfc503f33c9e32341257b37afe842ce
MD5 7c045d47fb97c76e789d65aa213381c0
SHA1 4eb4eb86d49c7194398abe1b28b3d606fd44ecef
SHA512 34b373fe7b8bc310fb734cd98cc0509f767b9a45d9d2231e9c211cb7f08c5f3ceffb96a87f6184b9951b89c88ae72e0b1f51c0094feb613428a0b4c48312d6d5
TLSH
T1888190A381FEB81B213D48BB5D4DB84A697FB8361681D4F4DA9681FCB085CF34716463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e3e0538657649706f9de9ef4bfc9427eaf9b45e80d5f15c08eefa59a2be6d3f8
MD5 d6503ea8700b61ff54f1e587be6a2bc8
SHA1 924d97f6bea6aec1e66ec32b02c3fb7d68b1fa9d
SHA512 c84ea1ad95dff7b4a018c276227a9ab7546be55ff5c41cfb3949bc94a47ca33f077992e2e5d7ac792546478d5ceae6645562dc54fd0b8371d33a1f8edd5765f8
SSDEEP 192:NRwKym1b/MOkQypv7sBpAPRp2sD9NHsb+WNnUOoEK27nwcvVyIsnAUge:NRwKyS7Mbp8UX1rwtG2Tze
TLSH
T1DC42C56BAA00797B6CDBC269FD227B53E3F5102135D12E84E6FC8A2C15E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 32d4394fb73cd08244daef8c4eebbb35f2531d63edb8f3e6f9127cadf593d46d
MD5 0523d03e47ab9b47d22301d500f7a772
SHA1 a8b955ee75b6ee3c92afca6058c46d9781eb5f15
SHA512 e87402a145be1bcea39e5ed0b2f15cceebbf226ac4fad79c83e249dd2dceb33f12bc73daa925c8b1e5ace865bc9248f54867943045d6e9b45e81de1b07dd8707
SSDEEP 192:NRwCy41b/MOkQyjv7sBpAPRp2Fr13yH9NHsb+WNSjLUOoEK27nwcvVyIsnAUge:NRwCy87Mbb8UX1rwyZG2Tze
TLSH
T13F52E66BAA10797B6CDBC265FD227B57E3F5102135D11D88EAFC8A2C14E7ACD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bc06ae1f55fad52a5d455c0231ffef622cd93d2b94dfb0571cb7afada9788356
MD5 8f17415d6f05308c0235fee1d92f8bca
SHA1 4f5ed6f2b09af35c04642ed624b59c4174861b73
SHA512 0e416e4fa4ac7e5bcf18eb00a9b40d85d613bb00361e5ab473c640493798e1cf5daccaf78931306b1f68743ea462017b0f92cd971e1eb72c2b7fbcfaa8d40c41
TLSH
T158B01201C4015193C08202F431422488B124FF10E60A270543E0E973C8291618428050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a8c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586a8c.TMP
Size 96B
SHA256 95755c6caab193de2b514c765d0a4076a110f1b1ba802d69bbe5594e34066031
MD5 689286f45c8bfd14553751534ff55566
SHA1 45be079d40dbd8d0b4a6cf05d12141854acb98f8
SHA512 adace667e069cfa0aac0f09bc4b1666850906b69e5997a2d5f9add2a51eb1d532614467d46c997ab472005a6db463812b5b86de18384c8ff411950d9920b29bf
TLSH
T124B02200C0022223C08303B028F2A0C8B020CF32CA03320282E00AB2CC2023002200A0
MD5 SHA1 SHA512 TLSH

Submit Download

1e02f294c645b5a0_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\1e02f294c645b5a0_0
Size 63KB
SHA256 b4d29dd582ce8a533f8e59de39309329adba9652659fb3e4e0c08491c275dc41
MD5 1aa7640ddc3723e27281b477545370a5
SHA1 1bfec455e0152fb24a606a7e72763dc230d73836
SHA512 cb58defae6747a392cfc817549d31beab89c0cb35ddfbbff665b7404b9675f88f354f2eda399b8a7936f150fe5b769ae8599924713fc5eab9b9ab063ff3016fe
SSDEEP 768:DeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:DDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T14D534BA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 daa3af7d6c2bf28b0e869701726c93b3fbe6beaf2aab8e2b09be2d0ed8286edf
MD5 ba6f3be7bfa1ae418771ed60ec8ac0f2
SHA1 45cf5101b1d43e0ed93f42892a86744c7d444e6a
SHA512 2038edb0f2a7b5e7d3f895e93753e061c78c805b3b0d1e6980d6a7cef7073ada4db5a4066f05cfb1ab342af9c0f512fed63eb0ffe7cec2509d2f2ff18d254214
TLSH
T156A0021571C24001C55581713841C1443308ACD40041B323E0D61886C99A0409743100
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fe383d7e4395006bf93f47ce601e5468aa5211fcac211b547c13fef68d909e45
MD5 b0e2d922dbb043635b0ac013b1f77cc6
SHA1 212481e3aa2868ef4a38a085e3a20f97a2d4d56c
SHA512 3cf0a5f3b7d48d8424f087d0a04ff04c0529277e5bb03b9e26891699fcf29e32704d4deb34db1245e9147f645c8148ce3fa01507aff298349fa52cb0d4bee497
SSDEEP 3072:lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:sm7Rkm1tYpBeh2BAoe
TLSH
T17BC3122B5E75A97759B9B74EB08E0B1F1EF14EA7C920DE82C8D85B0437E97CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 01b124c8cefd6ddf8984ddf68385cb006e42e4fb7efd424f0576651d8870bf42
MD5 f2ee5e0b140265248ab761f8ec042cec
SHA1 5731fd0d9a79be5262fda29124a9772599d595da
SHA512 0d9249f4f5d70e693ebe268fe005db6b4e810c84a00bb172a9326d2789d06d5041bec121a8c96e1c268799672d7d22b931474d151540ba9dd2aac8304af2e017
SSDEEP 3072:xrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:xym7Rkm1tYpBeh2BAoe
TLSH
T11EC3123B5D74A93759B5BB1EB08E0F1F1EF149A7C920DE92C8D45B0823EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e9f27d07238ab48982109582bee29540c6ada343c185a6d8b95e374969333fde
MD5 bf071c603c8e25491a40e34f386f25ae
SHA1 be7717a0daab51124bb729b1cf259bf376fa658e
SHA512 32110d4ac3a9925b2b5ec2d4199ca2257918a1f805b7acd4babd457502ae3714663b24285791900ff2efa562c04f259b844230906c3a40275b61e11c2d2246b0
SSDEEP 3072:ckGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:cHm7Rkm1tYpBeh2BAoe
TLSH
T1A6C3123B5D74A83759B5BB1EB08E0F1F1EF149A7C920DE92C8D45B0823EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3e7ec84bebc1dd014a9fc8edea3fef3a7e7fbe9d2a0a5ebf7b0fecfcf03102d7
MD5 1eaf4a0f54b76987b008c6973da25089
SHA1 713e9d570c20ef78a88cda7aeb61833ac329288f
SHA512 4b4f38fdc5170c989da9d005ca911f666cbec85f8f276d18f9d18817f4c27aac109b776e8f78b787c90b6b137d40efb8aa652667f710901a3e591b8424a5cabf
SSDEEP 3072:xDGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:x6m7Rkm1tYpBeh2BAoe
TLSH
T124C3123B5D74A83759B5BB1EB08E0F1F1EF149A7C920DE92C8D45B0823EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 95187296494afbeae65eefe21c12c5fc73306a69510437eeff39d357b0700f64
MD5 eab75f1e79d3c22c1b9b25e1b11e4409
SHA1 773250b62a4c47fa776ef0e0c60bdc2e53f3375f
SHA512 70aaeae40171695f85d6d781c5a6c763db0398f2d173d93cced3db19a918173a03a97842735bed6aba4b53dd29f7c25ba74d1ebcd06042e3bbf3b523c8b21318
SSDEEP 3:MsEllllkEthXllkl2zEklSAu/:/M/xT02znSAu/
TLSH
T1484404477FC0C507C50110714431C35453F1D41007115743347144175CC55450C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoloKlSpammer.exe

Path C:\Users\Admin\Downloads\SoloKlSpammer.exe
Size 21.3MB
SHA256 db50f2725cf6aa4400e7e03375514d6449704403c1efb36ebba66a74a4557903
MD5 c7e63d1092e412b5de44f5d7cf66566b
SHA1 0055de1286d578ae45b65e2038ffd3af39df1b69
SHA512 5284697d1a478d85e75da024522a0436cff5cb1280574eb0cd061220e124d80772f70ad8355a2902c8ef95c5dac1f586efeed7c18b6e4b819ca90a73d416199a
SSDEEP 393216:a1tXEAphVtz0gkGwEhFlnndotLaNL2djwLVvfsoaazv:aTRphdkgflO8x2mLpUoFj
TLSH
T1C527024366EB0CE9CED767B8A1C36336A734BC718A291F3B6644C6312D537C06D6AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoloKlSpammer.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\SoloKlSpammer.exe:Zone.Identifier
Size 319B
SHA256 650b6f2607f34bcab7b3a69824475a4a07cf037558bf657a2d6835776c0dc05d
MD5 47041d26968d90526f9dacca87cfa956
SHA1 1f101daeab73a5b94558f8acd0eefd98cbc2997d
SHA512 08adb58953c95cf69b114f24b203a897f41170316dd5ac4e0e6030491e9494c35dcbb2cd289702668936b8a2fcac410f827f6293fec32e9b5e4d3692a946d16c
TLSH
T165E07DAFCC6BCE404BD2784587BBF9CDB4C7364488209184AC504C63D5750B28290E1A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-398-0x00007FF708710000-0x00007FF709A7B000-memory.dmp

Download