aca15fc2907247b00b723a85dcdf5cbb27496c55942c4af15fc70031ac6ae721

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
306s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
VoicemodInstaller_1.6.20-0lozco.exe
Size 6.1MB
Sample260724-qzcpps1erh
SHA256 aca15fc2907247b00b723a85dcdf5cbb27496c55942c4af15fc70031ac6ae721
MD5 b9285082903013a2c7c822557fad71d2
SHA1 e7d951b3271e648878a481281097cb821d8c55ce
SHA512 17e1c04bc750cf3e3ce15207e57d2d5cb1ea13a71da43b7bfd47bfca08affe3ffc1c1691a4459105605dea580645b718bdc6164f01143463f8069e1616b852e8
SSDEEP 196608:ZzrUPpUMHoqCVZ5IS8gslUh+YbE4ZXybR7vxd:J7+CZGS81lUh+uE4ZXqjz
TLSH
T1CE5612237344E53ED09A67344132E67094BBAF69B817DD11B6F4CC4FFB256C11E2AA22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit discovery installer persistence ransomware spyware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
157	raw.githubusercontent.com
158	raw.githubusercontent.com
230	raw.githubusercontent.com
231	raw.githubusercontent.com
156	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
1196	VoicemodInstaller_1.6.20-0lozco.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4692	4344	WerFault.exe	134
2792	3356	WerFault.exe	143
1748	1460	WerFault.exe	146
1032	3280	WerFault.exe	149

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.20-0lozco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.20-0lozco.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	chrome.exe
996	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4968-0-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup
behavioral1/memory/4968-8-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = ee0a389174e3dc01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BA897EC9-8765-11F1-B05C-C2D11B6ECFEC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BECEBC23-8765-11F1-B05C-C2D11B6ECFEC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D42B01F6-8765-11F1-B05C-C2D11B6ECFEC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{E481F326-9C41-4A2C-B9D7-16F4A2FF9C41}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CEBD04AE-8765-11F1-B05C-C2D11B6ECFEC} = "0"	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293741131817773"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
1180	chrome.exe
1180	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3920	OpenWith.exe
3388	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe
Token: SeShutdownPrivilege	4732	chrome.exe
Token: SeCreatePagefilePrivilege	4732	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4340	iexplore.exe
3416	iexplore.exe
3416	iexplore.exe
3416	iexplore.exe
3416	iexplore.exe
3416	iexplore.exe
4732	chrome.exe
4340	iexplore.exe
3272	iexplore.exe
3272	iexplore.exe
3124	iexplore.exe
3124	iexplore.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
4732	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe
1208	chrome.exe

Suspicious use of SetWindowsHookEx 59 IoCs

pid	Process
3920	OpenWith.exe
3920	OpenWith.exe
3920	OpenWith.exe
3920	OpenWith.exe
3920	OpenWith.exe
3920	OpenWith.exe
3920	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
3388	OpenWith.exe
4340	iexplore.exe
4340	iexplore.exe
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE
3416	iexplore.exe
3416	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
3416	iexplore.exe
3416	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
3272	iexplore.exe
3272	iexplore.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
3124	iexplore.exe
3124	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
1732	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1196	4968	VoicemodInstaller_1.6.20-0lozco.exe	87
PID 4732 wrote to memory of 2952	4732	chrome.exe	90
PID 4732 wrote to memory of 1840	4732	chrome.exe	92
PID 4732 wrote to memory of 3792	4732	chrome.exe	91
PID 4732 wrote to memory of 1840	4732	chrome.exe	92
PID 4732 wrote to memory of 3824	4732	chrome.exe	94
PID 4732 wrote to memory of 3824	4732	chrome.exe	94
PID 4732 wrote to memory of 1768	4732	chrome.exe	95
PID 4732 wrote to memory of 1768	4732	chrome.exe	95
PID 4732 wrote to memory of 3800	4732	chrome.exe	96
PID 4732 wrote to memory of 3800	4732	chrome.exe	96
PID 4732 wrote to memory of 892	4732	chrome.exe	97
PID 4732 wrote to memory of 892	4732	chrome.exe	97
PID 4732 wrote to memory of 2780	4732	chrome.exe	98
PID 4732 wrote to memory of 2780	4732	chrome.exe	98
PID 4732 wrote to memory of 1832	4732	chrome.exe	101
PID 4732 wrote to memory of 3984	4732	chrome.exe	108
PID 4732 wrote to memory of 3984	4732	chrome.exe	108
PID 4732 wrote to memory of 2608	4732	chrome.exe	110
PID 4732 wrote to memory of 1820	4732	chrome.exe	111
PID 4732 wrote to memory of 4288	4732	chrome.exe	112
PID 4732 wrote to memory of 4724	4732	chrome.exe	114
PID 4732 wrote to memory of 4724	4732	chrome.exe	114
PID 4732 wrote to memory of 4908	4732	chrome.exe	115
PID 4732 wrote to memory of 4908	4732	chrome.exe	115
PID 4732 wrote to memory of 2308	4732	chrome.exe	116
PID 4732 wrote to memory of 2308	4732	chrome.exe	116
PID 4732 wrote to memory of 5052	4732	chrome.exe	117
PID 4732 wrote to memory of 5052	4732	chrome.exe	117
PID 4732 wrote to memory of 1088	4732	chrome.exe	118
PID 4732 wrote to memory of 1088	4732	chrome.exe	118
PID 4732 wrote to memory of 2816	4732	chrome.exe	119
PID 4732 wrote to memory of 2816	4732	chrome.exe	119
PID 4732 wrote to memory of 4168	4732	chrome.exe	120
PID 4732 wrote to memory of 4168	4732	chrome.exe	120
PID 4732 wrote to memory of 3644	4732	chrome.exe	121
PID 4732 wrote to memory of 1180	4732	chrome.exe	123
PID 3388 wrote to memory of 4340	3388	OpenWith.exe	126
PID 4340 wrote to memory of 1588	4340	iexplore.exe	127
PID 3416 wrote to memory of 2968	3416	iexplore.exe	131
PID 3416 wrote to memory of 3584	3416	iexplore.exe	132
PID 3416 wrote to memory of 2572	3416	iexplore.exe	133
PID 3272 wrote to memory of 1100	3272	iexplore.exe	139
PID 3272 wrote to memory of 3124	3272	iexplore.exe	141
PID 3124 wrote to memory of 2628	3124	iexplore.exe	142
PID 1208 wrote to memory of 1944	1208	chrome.exe	153
PID 1208 wrote to memory of 4348	1208	chrome.exe	154
PID 1208 wrote to memory of 996	1208	chrome.exe	155
PID 1208 wrote to memory of 4348	1208	chrome.exe	154
PID 1208 wrote to memory of 4088	1208	chrome.exe	156
PID 1208 wrote to memory of 4088	1208	chrome.exe	156
PID 1208 wrote to memory of 2936	1208	chrome.exe	158
PID 1208 wrote to memory of 2936	1208	chrome.exe	158
PID 1208 wrote to memory of 4296	1208	chrome.exe	159
PID 1208 wrote to memory of 4296	1208	chrome.exe	159
PID 1208 wrote to memory of 620	1208	chrome.exe	160
PID 1208 wrote to memory of 620	1208	chrome.exe	160
PID 1208 wrote to memory of 2152	1208	chrome.exe	161
PID 1208 wrote to memory of 2428	1208	chrome.exe	165
PID 1208 wrote to memory of 2428	1208	chrome.exe	165
PID 1208 wrote to memory of 2576	1208	chrome.exe	166
PID 1208 wrote to memory of 2576	1208	chrome.exe	166
PID 1208 wrote to memory of 636	1208	chrome.exe	167
PID 1208 wrote to memory of 636	1208	chrome.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.20-0lozco.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.20-0lozco.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\is-G2JLN.tmp\VoicemodInstaller_1.6.20-0lozco.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G2JLN.tmp\VoicemodInstaller_1.6.20-0lozco.tmp" /SL5="$70056,5564221,899584,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.20-0lozco.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa05bec728,0x7ffa05bec734,0x7ffa05bec740
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,7802225425276178919,1214257838143148108,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,13632023123078415492,7695519687224259493,262144 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,3247278481447060020,14150133189119902763,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13181388889442092499,10906363038578650696,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,5225720282851226661,8794678341698124966,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,3499661971798796622,18357035605180710598,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,10937313840634344800,6964137088124707438,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,1228059150269223929,5507037741608197575,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5608,i,763798760405118019,7159089874003709931,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,481310842080973024,4382871631266395053,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,805672897233075350,7041518101119310837,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,7629128999255194636,7916597886649520635,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4440,i,12262417738005565243,7527881286128690950,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4472,i,2571688792386317193,13709758452387584401,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4432,i,3005879287205701250,4162914240851568922,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5844,i,771933518134320796,4352612100942235783,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4848,i,13906979678677231273,3172192417130815646,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5964,i,7370663094198241573,7428357616085594206,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3240,i,2025889464335889923,11526274710059964758,2097152 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6416,i,2303545825905804590,10307096651567619640,524288 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6296,i,15593822670877817502,17845651132169682547,262144 --field-trial-handle=2204,i,2666905312384736751,3698784176805261563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\Interop.ShockwaveFlashObjects.dll
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\AxInterop.ShockwaveFlashObjects.dll
1⤵
- Modifies Internet Explorer settings
PID:4748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\AxInterop.ShockwaveFlashObjects.dll
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\AxInterop.ShockwaveFlashObjects.dll
  2⤵
  - Modifies Internet Explorer settings
  PID:3584
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:82948 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2572

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 1568
  2⤵
  - Program crash
  PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4344 -ip 4344
1⤵
PID:116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\YouAreAnIdiot\Interop.ShockwaveFlashObjects.dll
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3272 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\YouAreAnIdiot\Interop.ShockwaveFlashObjects.dll
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3124 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\YouAreAnIdiot\AxInterop.ShockwaveFlashObjects.dll
1⤵
- Modifies Internet Explorer settings
PID:1372

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1536
  2⤵
  - Program crash
  PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3356 -ip 3356
1⤵
PID:1968

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 1536
  2⤵
  - Program crash
  PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1460 -ip 1460
1⤵
PID:4900

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 1448
  2⤵
  - Program crash
  PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3280 -ip 3280
1⤵
PID:3740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa05bec728,0x7ffa05bec734,0x7ffa05bec740
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,4824231374480131096,14412701514420511162,262144 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,17239486552160329624,7621041045931764150,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,5257026856548421532,5134517451610185638,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,13510480157826139602,12136674999274539720,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,11648877495470034817,17160809738759225638,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,8113774733079569949,17902741847534424964,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,6103119766914476721,1263140283367693665,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5428,i,1303327228673494167,1275301754100027460,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3260,i,11687616713911142891,6961695220288027010,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5712,i,11336575499197690321,13743929809227762392,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3404,i,2502390257678653054,17103036224074695829,2097152 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,6240463978134060291,8235165082074877303,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,214204420897577361,12181126895373710569,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,8371651690574982589,5588435031051548747,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,13139800652621772276,16005138910454702162,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,16682150757603054814,14695476091344900112,524288 --field-trial-handle=1956,i,13241740505177583814,8607759264340845564,262144 --variations-seed-version=20260724-010529.581000-production --mojo-platform-channel-handle=1176 /prefetch:8
  2⤵
  PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1844

C:\Users\Admin\AppData\Local\Temp\Temp1_Petya.A.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Petya.A.zip\[email protected]"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4518103f-1645-4b9d-937f-f2ea6b7eb496.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4518103f-1645-4b9d-937f-f2ea6b7eb496.tmp
Size 237KB
SHA256 30f13b1ee7a8d7e9ea7dea91bea5c1aff6ec94008abcac6b7f43dba2ab4f605b
MD5 79e305de91dfb8ba22fad8fcefe9f12a
SHA1 84f40e69f9e3268769dec108addb53864c5c877d
SHA512 1b43ddafa9ce47c1190d9dc95e804a69e19b9a6c47df0738b5b891299c36ed1612f83f14e12c46763fd2a5b058d6b393f208aae7b3539966ef0a26974a930929
SSDEEP 6144:0393tbrNApjCVBhWpl2tuFqCAwFmUi21rSm8uUVNSlzYO:0pFNg2rhw2tuFRfi21b8j8zf
TLSH
T1CF3422246DB7BCB39A1970403DA9BB374DA94ED2CB44C88885439F825DDE3C64F56E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 aaf079ed9afc9a46283c1f073ab5a7d641290078f9a4f9cf3731bc5ee3bcd574
MD5 88706e65fc1745821f56d27cbfe98427
SHA1 9be8743a9a2dec74f7c21de7f2a7e29408d25ee9
SHA512 349b21ed55502fa3439d34dfff2ff1ecbd828e3fd02fda86bb4dd113bc2f526b59ca9e2ac8340a2077bb222196238dba3f19262ef11d39414234fd2545242a17
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 285b9fb6691e7588d42a385236380eb6b8418931ba2bacf6b680f2c054506ff3
MD5 4254fd9c77266e7c7956d1a033b44887
SHA1 dd585cfe3aaa439fbba8025b26e9b14beb181099
SHA512 47350a6b08478d0c6964e13dceaaa80ee315fe9ccd6e4eb3f8541a79ded09bc706cbc09408cf9da745d42800bc39b5969bfa0cacad740996522717737cd13523
TLSH
T193E02BAEC8619C6709F91B2C20544B49E75403167F90C81F3E3DC20C8FB5B3B4266C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 32KB
SHA256 1fd4ec32a8d8e2c9d933ce909fe8ff29113d5087d49d77889de075e0b66d1c57
MD5 3625e5fc23a08b19188b5e9b84c36a44
SHA1 2af5be445b2834b2d8e950aee72c8f4ad367f191
SHA512 d5a833a41871413da0f4639e30f77b0edd7662a7bd8e7dd2fd4dd8b81e2ffd4218c084064ebda0301ac43891277d2d0d19d3197aa7318df704032ca4bc8fee9c
SSDEEP 768:jsYMPappFaq0x2BJeFS8fzidu1r/QJvICY4RZizInFBxZkYBy7Z:zMPap/a7vFS8f+8byv3FB3e
TLSH
T130E2F102741E8D433FB26AF8AB4CF4E6563B4F446EF8BE745F909E405C089858699F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 21KB
SHA256 ddfc772d3e514eb86fdf926b6cd0ecee8fa54299b32e771c9d24fed72065543b
MD5 d322d730b0991da1ae55e68586ff40e3
SHA1 f2b22344bffe05f8e0fd5842a70ee344943c3e0a
SHA512 fe42468a82420539d6b755d5427fd35de61deaad6db4a5b52a14f0a8454933ddf329a5d345c438d8e8ac4a522dbb8a145be17702b01e8920f4b49339d5508211
SSDEEP 384:V+scj/sKzh4oD+DiQQhavQW/ifvUAarVEWp67PibgPkqkDF8jZ+YHHIuWye:ZcjUHi1hnciEtCWpy6bUi8j6ye
TLSH
T126A2E1A557AE1210D0B6796436FB4054228939FB16B0732BE6F1CA46F7A41F8CF0B90C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 42KB
SHA256 3ef639cb811d22764660fc39517971f4109ee97aa0a442228c70dfbf3df9529c
MD5 c6d1d82e03f1afbb5597ce9f4bdc7b81
SHA1 999b71de05e9ce8da9ca9fc2b894058cfdfe57b4
SHA512 11d46e5fffe07e20e290a75a2797a442c5cdc52273c423670dbeb0c50184729773c639471ea27192bb685b070eea734e72035828c9806767bd1cf0ef61eb2d5a
SSDEEP 768:PZP8ym3DbsmYp5DuvGKQPwKLvEzVm0jAYY9W4DZelgQjK9cV92F44U54rc:PZPybsmk5DuQPzLyVm0jXlgoKI92YSc
TLSH
T1F213E0A5AAD591421BB04162E55A3C52B2ECE73140E8C8F7B76CECEB20E5BC676E10C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 39KB
SHA256 d3b01a436d8c47526cb86702e468a993d48af863313c29ff1fbe786202e21183
MD5 0e6d04d83d9fa335a476c01c22eed726
SHA1 00e9cf69ac4ddb0ae56713fe3d98c56ba49b68c5
SHA512 c2d12d86f002d11af1c2f61f30d54c9a75791309ddabf7534e79fb0b85388df6b19cff2f138c194be701521b08164ff4d298b2503814213560d71f44276526b8
SSDEEP 768:Fq43SPSNmSBZkv8YVLm1Is0QbZAouxmU67IqYfRPaObel6kW2FaPOXk:zwSqXLmVlAoux88U2keP0k
TLSH
T1C50302B2D90289D07133BD965DCA35CDCAFFAE81A397DD40D9B0E10615E9F8A40D439E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 78KB
SHA256 e09dd333219dd5de9b14552552e85d1e511cf136c6dd93aab3f044620efde320
MD5 d7554be2b5c9d11681f6a7de5d081173
SHA1 9d0abcd80c95d58e865a0eb1c40e518e9c34066c
SHA512 4c8a83ace476ec0fda29bbd92b854812a9d2770bda2202ca778ae29a490eb1b74e41001bbd145b41a1835f0598b1b2c46aa01b699aeb059af00b8ebaabbb11fe
SSDEEP 1536:3hOOTwWYai0Tx5f0+vuovZUrSZwwAXiWAU6sXNIR6z3sWT3Hk:dK0Tx5f0+vuohgSywAXiW68xg
TLSH
T10A731286E53A1D0BC6EF4802E01932B41C9F0A41D4F22E763D2BA80A7FDC59675F3AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 87KB
SHA256 067aeee8080d01a70c23bb894c9833f14864638f7e4e8598c2a2bfb80cda2fe2
MD5 1e506739e92f9da66fafbd094458aff0
SHA1 2734ee8f985ec0bed8e12e8deb272c4ee677cfdf
SHA512 ebcfb5e5064c06a6bd016fe91209ec2ef52eda88bbf14660157588e556796414a7e083c7a04da0911279f057f2a9517ec2b6a373ec75d0bd6a657a8bf1628e07
SSDEEP 1536:KiBVJsE3Xx2NZhFFiuciDWXBO66jFuWeQV7oX9HLHHXxSjjGgIPRT2A:KiR8DF1c3sE5O0tH7HX43GBRT2A
TLSH
T15F931283E89D503534D559129FFE76E2A91F2E283AE3995EC1846143E613CBDA330A7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 18KB
SHA256 8ce7989894aba12400cdac54c6c2055c4879ccfcee0218209fb7cd5e36a208bc
MD5 b6e5ab95ff97c757c70258b33753c6c2
SHA1 c4f3005f58790871f549f2cdd5ae9f8a18766635
SHA512 0f5d9f1de2a1f79a1c32d5af167cffea8214c203f77dfe2bb5ad9383e85197d25a0a7b47d50fb37fac59c1a6f9b95b68598459014ae87f2688a36af7fe9d9eb9
SSDEEP 384:byPugLfq8OzKgFeIu33cAOU0EPTDNPsHF3ESOZwwQ32N86a:u1LSbeh33cAFTRPaOZwZi9a
TLSH
T10B82E043B66C3B9284DD7074CD4E9ACAEB59CDC0F8918B3858CEAF03644C3C95112BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 26KB
SHA256 3c996d83615cf2cf8f2add9e2db89faa006761d3715fc98d1fe93125e577a95c
MD5 7f176fe662dc7c73bd7caae5a69c7322
SHA1 4fc2e0ed42f46c5e7cdace756744d774edb52ce8
SHA512 333edcbe338b55b0b8cc1b834eeca392d1a252886a6ce41a5e8789636902629b28651278c5f6e58956eca3c959da2093a0cafe11ac486d7aa793714a6209f311
SSDEEP 768:Wc/Qdkmzi0vkz2K17doZYePlsuYfWZzNs:WcAhzi08KZTPlCb
TLSH
T1DCC2D0073FF8B93367C00B5A471689304FF8B505E4065BAB6D659E39681FB21B493C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 30KB
SHA256 30537782cd680a4287577e1a938cf415fe85db833c3a04821a810316fd2e551a
MD5 70575ccf7f96d1c7081587ec79975108
SHA1 e19c57758a50f25ae977634d0141120e703dfdd8
SHA512 361c1f86e8f184907eda226eaa8c8bb8e2e092c454ff97268f7293cc0241c1b8dd80b603928cd32214ab7d9646a49fac72c45f500ddc6065a0ea935fc0239cb1
SSDEEP 768:234b9w9Qi3M9wAGxy+W3hiS9hU7NKHfsWR1fJ0eQ0n:24p/i3oaIB5iNK/sM1f+eQ+
TLSH
T13EE2E1653EF647D665BE13CB23849210ECE7862A1DD5309E4850906C3DDBA1EE0CB7FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 22KB
SHA256 3c7f47d80347e2e75d44bd1693cf41ee80cc08ac654fe2346267f5db237bd08f
MD5 254af1da20595ce60a8aa9efd1056e6d
SHA1 8ed77d71cb095f743c8981b3cbce1ffbafaaa69b
SHA512 772a175de37005f84e33bcc1faa0fd225641d0776d2299c34a52959dc981af4876afbade4f26c1f179eec70db64b0735be52d8408438325bc52635a914672bbe
SSDEEP 384:DGAkRj46adbdUODBIGdLpULaD0VLQecaDmeCJp0egAn4e7srMGhhIQ/xbm7Ex6XC:aj4ldLDBIGbUL40ZQxW8uNAn4nrTIQ/h
TLSH
T17EB2E12986C1CEDC0FD2E00B7478492557D4A827665B795A4C7632F0E9F8CBEC68E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 25KB
SHA256 61aa56bfd1fd32378edc32fc760587f9cbdf2d3765f576c40fc28a6fe8239516
MD5 5485c3e7fca00afcdff3e42840d749da
SHA1 c96f7b4fb1dd7539549a07a72c8e3716330979f7
SHA512 4e1682a9552d22608d7b70b04fa973c1512ba830df716e24c32a4d3c40a6f646f9ee5d2a054f6d074b6b4bcf27b504942333fae26b5ed932f47df5f9b73148a3
SSDEEP 768:XOc8PYVudXLnhGja85KXpP29Ki8DEflWL1bZHE9vGwgy:+FfLhyZ5K8b8Dg0L1xEZGw5
TLSH
T1A5C2E094324B818A3C325ACF0FAE49DFB113E189268C2893DF3251FE191404F96F9A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 17KB
SHA256 b6874019cc939c7e727e56bded1ded78213002b48136849a128d4ea90613c465
MD5 1b84863e9e8e249867b26553a39827a5
SHA1 40b0fd0a94362b1d013ff42dcf825439d962ecca
SHA512 39bbc043a3e5356e3f36bbbe62035f424b9f889620bacdac2abb6e6c50c689b1474f652fc50b526de680271fd958591aeda2ffe05578e4b8c7919621d7d48a1d
SSDEEP 384:BGAW3o9l7StLb1W2p4UuFzKgy4IqiZtizz9GWaE+FD:BGpc2pG8Fqk4gWaEc
TLSH
T10782E0351411653AA3918E437A540F84ECF6FE9E4B363EA530E6B7E2F80F3B06455064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 25KB
SHA256 55994756f41a1a55112fcf3352e415e1db6e9cf943554bb0e7f7982a0f09c321
MD5 947ee747b7c5b47ce82a4c0409b4774f
SHA1 407b4c5a736fe5b13c164df6cbf27f316f482e16
SHA512 f6f8f29cfe11a442a515ae1dad27d31f66065fa80027eda3e3a31f13efd54b5ab37301b27b9ca899c35a1eb97b045ef7d322abdfe26e4da13e9d1a73d02a609f
SSDEEP 768:jwVR0vqCZj+g1fltbOTOYcoTiLXlVyVNA:HnZaG9ttYLTiLX8A
TLSH
T1B9C2E006418B7629EDFCE208426847DBC369C5D28328CE8E2EBB2550DF177EC0652A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 20KB
SHA256 6c4e20fe54f9393f4f4bbee2728a92c589a7e03a9a35efd339e655bd57fe0f38
MD5 cef4362e9d0f99fd7d5b3a4004d5be0d
SHA1 3eeb039ea5f19100cb4d31a66209224323ddcb8c
SHA512 5711369069937ca8f3d80466ccc15f3400873194b1f7b6a1c5ad3399af0899449a151481110a5b47f06f8f664f1a4ba8d52baf4a9e575f3a268b42d7f9205370
SSDEEP 384:PsPUn5zuORx4kuF/+HTzTM4KNF+CGiW0PyFFQ7c30rdJXdMPLCkH:kPs5COgF/+zzTM4K/+CswUO7c30rdoPp
TLSH
T1AF92E1AF99C35940C2F4B9C0D99E22D4FB5D6044C624F56CAA81D4E6ADC2C6BBF47F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 55KB
SHA256 7edf13054a01c6a382c2e37a73e49015929b390af0e40aa86d50a2cd5d6c4c55
MD5 c29ae5128e72dcb85fd11487d8810061
SHA1 cf29d97f7e3b4ec34542b5f3565836d85b55f51b
SHA512 8dba380a5570aaa0563e131bfbc9c075125ac6f7a8d1f272fdfe7bfc5d2f5c1f48340d8a04eb341541eb57baa54259b98a69e3cfead2728a1069397ce090aefc
SSDEEP 1536:HZXWDqwq1kIPT9O5Aev2S+BDv774GBvSoJXR78hsZ:H5kqmIPT9O5v2S2D9BvjWA
TLSH
T1C64302E598B185E92647633C8863B863CC6A7DEAE037EE12E87448D3B4F48D854D317C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 30KB
SHA256 340e89f457d96357e5ce95d9f63f4432149ffe51ab7f72c4c671403806f0381c
MD5 421382895ce63b5c9ab695bc6a1b975b
SHA1 83159ce5df6cdf083dc6269a54d0ce10494eb1ac
SHA512 1f6f88fd415e1dbbb451fdb4cb23359fd549d259c9a876b9238d0f38c29440b2f80621f6ec4f014e2410b6c4e50943e524384111a008e6f1e1477c5fef589bc9
SSDEEP 384:myMG9v1lWvb3Z5UHuLwPXkkm+D3RVHPFP+srgpP0GeZzfU9wE8dc7TxxKAzqOePR:myMG9viF+HuL4LRVvdlUiEjhxNkR
TLSH
T1AAE2F13E0F5815148EE9DD4B4B1E6FB6C093179CCBB8A78D83185E21892458DDB3A7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 26KB
SHA256 a7e748b512ca3014f071a65444ad72aedf82ee0f0d2b55e0506bfe5046466b6f
MD5 861ec5f6a869adb1a549c425640a7659
SHA1 f786c6a590acefb616984a956fe7cdf340d6e736
SHA512 72b652cbaf172cb57f155448c8b741863ec0ff3c20f7ff6f7ba1b4432535fe718a00eb2c3622ec8b6f1252de2ed79e0a6b65141f2ae633877e3b12027c8f0c22
SSDEEP 768:LnLhGqQXRV5TTMLMqGPqxPFp9BFB1t7LGUtPlZ6TJqx:LLhvQXRTTTMxFxPF1XKUtP+JM
TLSH
T18DC2D01AFC111EA8E34C0F27559AFBF4078FFA89F364FE0655A83D43C44619ADA6184B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 20KB
SHA256 3bb2db1ca44103ab049880e03c7e2b4fa5582620dd20ba9e0682face7f90d828
MD5 268a331dc09a35c72d5f0e2cc1dc79ae
SHA1 d4b60c457e8f28b6d3d19d766a6c691ec5b14fec
SHA512 8ea9e043b7c269d5d7f841aaaed1014c90da6840ac9fbf19c64c9ddc1745e464b321bbf857a1c48604b3a90140e47c9b89799d05e0ac99ca550bc3f2209f9055
SSDEEP 384:mJvZhHsy9ScrhuvWqGfKPXQu2oVXb1al3HVkkeYhfLX5U/i04+IbSVX:mt5gihuOq5PLRtoHy2hCi1fSVX
TLSH
T1C592E15B0EAA76B528F3ECD2AB08E95A42D3694C2D30E3F07605297CBD04D9138F29D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 153KB
SHA256 4b17453253a2819e4ca5ed880f222c5c33d3dcefdb1c2b85ec6dfbf7d7644ecc
MD5 b2da2e73f2bfc4c25662779b11fe2628
SHA1 4b628d44306c7517ba5db59e6ff7cb8eca408982
SHA512 5e0e331597e90e629e7ab4845168dbab92fdee84b6b1a3b193bbacca139ff28345f7219513cb36fcfb20c9ba7a4295618afcef0ed51167d4308736b43f7a0515
SSDEEP 3072:siUzTx2z3/k+zbwGwCkguMdl3AtWjsqHGGvJnxpMiLxSm:siUfx2z3/kwwfCVuQ1jFHNxx7Sm
TLSH
T137F313A6568EB539A8135AC339D8814F741928E9D04B8F5E7EBD7F01D2F953220A0E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 134KB
SHA256 1d5e5c26bfab30f20aeb49a9f368d7d8577ee3e2b9f1666e57e107d586a90273
MD5 df888a32436bbb8d9dcc54d220691f40
SHA1 352b5ead10cf5ae737825d9e13b7b65e4a0832a9
SHA512 8b3793ced7a4ebd3144fb70fc6807d5694545d583b4c245b6a4833a416a82f82a8c870e2b5a53739f67ff33cb3077ba9b6607d80ae7304693ac307fc05977aba
SSDEEP 3072:KllvWDxCWKOnW8A2JekkWR0GjwLTBYubUleUqPQCqoGA4+4Rdi026TRFo:qvgIWPnWctx0GjZuY8XRhGA4+4i0Vo
TLSH
T181D312F5D1DD1EE066A78BE51C9BECDBEFDD5B09A20C09026CC000D23AFB9649DA25C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 103KB
SHA256 f657ad5c29f5882345068a667a990bf0ecac335b8573f4d330c6887739306ec7
MD5 37f8eb389065368d9dfc7bb4f0476267
SHA1 e6871976730dcd069f99a902dc8f7c6f2504fca7
SHA512 28f5a0a4fb33f78dd72a97efc7bbc19ba7af25b362a3d77084c4380d2b4256d5daa49cfa474dd96059b550d88f3f2bcb07912e7e15656fd05caa0a41f4b33b48
SSDEEP 3072:ys09C1mWXHOhZ7UDO77rEWCTOh8g5MWmW:z0Q1mWXHOP7UDgbMT/W
TLSH
T163A312E8B439B6869B8C7D9ACCCCC6B1AE6D0B393BE05C2114D1E6CB9552E87554F042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 16KB
SHA256 c74178316b5f15a6509c867014914662e091a5890dff0ec570a9b3b509118e78
MD5 cf0f9d7fd8e71ec98cd1613980e0ef07
SHA1 76ebebfc38d3c29d4bf54ea32ac6f73197f4ac44
SHA512 e484e033af5507be9bacb1a1ae72cdc2754694b060ad3c5fb068bf5bf904777c8ee995d1f78a8869367769cf72a3c1beda10fc2a39313d42020d1594c07f1b2f
SSDEEP 384:o04pBsqvQ+LBxgUv5FykBlveFI352VyzaXtI/9zJAXDm8IZ7tMy/F:OB/Q+9xfzBlvGjIYyzt9F
TLSH
T17472DF47533F74D8A38AB429D8DDAFAF20C53D443C919298B4D0DA6A6F04DE23160D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 18KB
SHA256 bab910134aed1c29c8e3257926a6be4d18342686197ce80368de08dae4a2b0f8
MD5 475d4b1b8b7803f2ccde6b6adf3853b7
SHA1 2d050fe23029bc10f0f71f0f9a9722bfc045dc6e
SHA512 efc66ce57e06e92e0b166a020e46f7d4290471b7d08ee17da87d5dbdad750b2a869fb42c27c0b0434c5a6a692268518932642f11253ac4b900b868d5c9c98ecc
SSDEEP 384:xym1vp6k9U0pADYs3OoMzYZGHFiPSFC8BmzBZreT9YnrRr:5vpb8z+dtFiqFCvzBtc9o
TLSH
T11382C120F08D92263CCE7A89E8E14EB6D364DD5B34542958A9C9F6F5440FBA24E2CC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 46KB
SHA256 e7814c95cbbfbcc4d8508b4b97c108b54692bfefe34c4637a604cb2ee0a29663
MD5 29ff967c7b1c86f7ef55dd3e3056a7d9
SHA1 f0681c90ab7dba6a8b8799292c71eebbca93f72e
SHA512 28191e27b08d22311d6218e970d408809fc2bb3fa9b0461a298ae823c342c6e669e8955994fdf0c38fdcd92ee1d34f1f2f7367a0dd69530fad48564e00f4915b
SSDEEP 768:atz7vMjnvMNFToE6GDEkL4xnBpL3+bJWtCcdh8TPrR6ShwwoaEjFQ:ap7EvMFTxEu6B53ftfdURxwwoaqQ
TLSH
T1602302E90F649C72EC17776578F6AD1B15489046C3A84D11628DB0E83D72F860AABB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 223KB
SHA256 817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612
MD5 a7a51358ab9cdf1773b76bc2e25812d9
SHA1 9f3befe37f5fbe58bbb9476a811869c5410ee919
SHA512 3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d
SSDEEP 6144:M9iMNCHRNLhitoVak4jaChlNY4SWn0m3/ottG+DM:7IURthAXk4jBhKWl3/otc+DM
TLSH
T198242240FE3E2397CD6249B9C4C27D521416B98603DDB66613DA602FDB299C13DA72CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a988a46d3a7d46e0d1a574e8a293073f5a272108a251836903e7df91ad737f07
MD5 01ef7962c5e3628a95f4f61c2cd8d903
SHA1 e50b64e363616c03cbd4e596648323b30b08b930
SHA512 e9cf6177f99984b9f9d67cf660563d64b3a8ea7a00ff6eb90bf51aedcf00ea063493b0b86dd82150b1577dd754854a30217c43bcaab79a101d164f6035d4eeff
TLSH
T1ED81F9FCA845BF64FBE0ED32E4990508333C9AB061865EB9447E06FED8477BD0A39541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b198ef4afc0bf97352bd0b3f5fc4e4cdeb2eaeeb017bc2b85303db3bd75b988c
MD5 c636aaf2839dbf3d0dd76e555968dfba
SHA1 38deaed3e236609d9d6e8bd34dfa24cdc2552666
SHA512 cda91533c155aee53eff52012a8927ccf29318cdc9e0d7c320cc50118b258776c659ed9af237de1c2431809ba6a5e393e0975019f3cdeccc5052a5c0708d4e46
SSDEEP 96:ckWYwO/xL3KyWkh77y15g+JMIrUXsIbYEOo7pPXoKm6+we7:cXYwO/RKyWkh77mpys+OsP4Km7
TLSH
T16A910BCC9E45BC22FB7CF132E8A7CC8973349AA451462E75147604FE384E2BD3A56401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 74f6e6bb55b4080ea4f1a2e0114191e321444f8dea2b14443a1ade5f47b7b605
MD5 13a043aedb1855043be5b38f51c82de1
SHA1 680dcb0200f245efa53c734ca34d8f4150c75dfe
SHA512 97849c19857dab91d4ff9ecfe5def3bcf01c26c1e147a9ac30db920da0a381f3f5e31bbef1a5df79727f89ac090deb17252abe515a9d8d5354eaa9e7c34087d0
SSDEEP 3:MsEllllkEthXllkl2zEgltq2Jql:/M/xT02zjNql
TLSH
T11C44041DFFC14505D7401030C733C3507374D4D405115F43347D45175CC75400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 1a28f1afb284fedcd24c8ecb1bcae06b2257c408a27500247f36c3321d2ed5e9
MD5 30c82d38e14edad1d501f333f9b5cc54
SHA1 3108f7ff9998a0d26cc62b95b29172ec4521c204
SHA512 be1a3d5dacd3f01cbab598682977291f4dacb6cc70d4fd981fde4c57d4b317915f74edc50f139207eb789935dac2eb00edc16bde5dd8b8ec11a2fd4ee87403a8
TLSH
T104E0864439DDC27E9055D4A38764E34CCFD4364DF7E83A12270A98A43181505B7E0690
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 32KB
SHA256 0a9689773da979158b9631e72d31a2ec1c1368abc849dc6dbcd9ba4d28cc77e0
MD5 30f0d8f03b485572aa702d2772c4c125
SHA1 a340409fde5e413fd38b51f6bbe9022089ddf27c
SHA512 ee6958dc19abb332bf036328a4ebf338206d1beaa816b2d1ed5be4625d12287a74ec6cd283e41efe5dc051aa377afdd50ea6d265408ed6b3d492dda1f351f262
SSDEEP 192:+cONQpQOLQp+ZQQO+QCQygs7u4JycmzDzRmQRNUAlOPA1dtUoTCeIIhEM0:KWyOUIDOjXtrCuTNUu8KzjmeIzP
TLSH
T1F1E22CE7BA713512DF0DEABB50A5AA489E33D09C8DD88C9A783049273870755512E7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 f49b728e80b6c29d7b6981ff12e481c4cb6dfb94d3b6fed0ababcaf894542624
MD5 2c7df7b18d7cbaa93278d6641061b524
SHA1 60ba1d249ccea0fdad3551a633a4f89a0eb48e08
SHA512 08d1ff7be7757cf290be6f14aaae4ea06a038f1f02fa2c3820238cdf5ca03dc6786a6d741a2bf1058f36036eb66cf49341367734b6ee821ea2e023ea5a17b5b2
SSDEEP 384:BekIO53hMX7/GUh6aA/tIkUI3ijVYWNkqpjGWahwOYZGv8OJvy:CO5xMK+6aO64idkqgWahwOYZGv8OJvy
TLSH
T1CDF3779FFF606301CE6DE1BF98E6898D493EF0A98A894DDBAC3005679D90712614F374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 52KB
SHA256 ec099be6e6dfcad1f128768a730b02da0cd535a1882c5f8332235a4906ebedbb
MD5 0a77067890af86f440b09e643cc6e203
SHA1 6e0dfb7d93dd7bcd30e2014c6904f012a16f713e
SHA512 e2e67ef607ba7caebbb3715a10819db599e3cddc71598bacc8a3dcf196a1b8fc4c03cba2c6c3e332b9555f2acab09879af6fce71bf35ca623eba36622affb798
SSDEEP 768:BRa2mScQtRymSYp+TmSiy191jTgzMDTg33A529:tmSc8ymSYp+TmSim29
TLSH
T157333388FAF84C179F7B971738F23C288876F51164C88C5564764F6D62B6AC0B28B793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 339B
SHA256 f45e8ab33929695a3b3bb4976e1e334531817e5d372fd7c2c3b593320759d42c
MD5 51b95b7561e4612846b124c7499e914f
SHA1 e3f6eb4ad458e0e34c139c450007870d9605f8f1
SHA512 b72d5c3ddc4b138512b4a0810f3c2b720b3f7bc8c6e83a9b5c63504ec1dea80d60be7651927b33d8ea2317dabb304bcb8552e8055bd9a6bc96edc056c2918387
TLSH
T117E0266895C9C6AF611480B75934B70ECAE25A0CD7CC6ECA0F13D834B0C60089AFD3A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 26KB
SHA256 39025c809e82311c03bcfec138da404376492df5e9748a98ed2da22e9215257f
MD5 d18517545acd11f74829e86262127932
SHA1 95a0a12ab1faffffece82b34fe51dd802f6d7338
SHA512 0328dfbebfb60881b33985e48e7dc88a58021ca9ecdbc64485ae9f49cd01fb4666cbb2e728bae519ae03986ee3ea33ef92e009f83dbaf4977c127ad033721ec4
SSDEEP 768:hKxSRArhlrPKhIXlaRMMjRsSSCoS13a3CO:hKxSRUjrP7sRtjq5NT3CO
TLSH
T15AC21F383DFA80197273FE96AFD8759B9D6EF7233B0AA8591051070F4623D41DD9123A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 83a496d71e2981a77fe2e89e900bae44218f4daf50725cd24b55d4e7518c22e2
MD5 4fa9dd7422458662bc97ca9229d0e733
SHA1 98766f65b5a1b24f04c4e528b20a6a613ae30115
SHA512 c561c972b23816054258332272bd87288690cd907230299405589cf5a132ed5d28596686db94724081f1f9dd7e56c6d21ab91cf020448ddfcde9fb7c06de2a25
TLSH
T187E080E219DDC16D1545C0679755770CCFF4364CE6DE3B515B0598DAB1C9408F7D02D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 54c12f2ea9e035df91ccea1f133c8a2f67a897545cf6ab005dc26089676fdfd0
MD5 2cd4093ffb355eb72f5d5d713bf3b17b
SHA1 d4b863c2c54a438f303779ba554a59521133accc
SHA512 5e91d5e1b06bf043b446b1c83e1975b21a077ab48d9f49a6d34b168f2f36ec97096d851b3a9e76b3fc9c95d92b8f7d4c6f2a7facd6bc9f0fa83c95a11a2c074e
SSDEEP 192:DOTdwWxz8CGm9mraIklRfSpFl9RlRI/hNPUfGaPbfPeXVTmcmmmzmgmtm+mu:DOTdwWxz8CGm9mraIk/fSpFl9RlRI/hl
TLSH
T12902BFF7C3D8C52D991156F4AB15AF1FCE2A0924432C3C66C8D8BE4B93E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 5159774edfb6fc98cdf301670e11fc768d52bd4491f3965e578b6a499cb8d58a
MD5 9e5f85ddb9d1aacccbe37fa5aaca8c0e
SHA1 6305c965c3eaae3aa63ab37aaca58a690657f3db
SHA512 0317e5b82446e05048fc78ff57104e9b59ca81e4022929f1823da4a0de6a8d3cb04a0de19480d9f0ad061f42456999181bf5de4053ea54121f50b9637cc99cb7
SSDEEP 192:DOTdwWxz8CGm9m3KaIklRfSpb9RlRI/hNPUfGaPbfPeXVTm/m8mYHmDmRbmDiBmB:DOTdwWxz8CGm9m3KaIk/fSpb9RlRI/hB
TLSH
T17222CFF7C3D9C56D891155F4AB25AF1FCE2A0A24432C3C66C8E8BE4B93E2831D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4da915461b70b30599154b18d060986a52868d64b9892c1a1693b14dd18b4ac4
MD5 cbc1d09e73df2a9ee2487de43d2429f9
SHA1 df2433c0ca78ad68163d20b9d2a9469b0514725c
SHA512 c75a4552d7354920a4fa32f58ea033d1a8f97386b4c15acc66b755458554c6a45ae821b626aa5c5fb919677a31fa76fd67a82ab81d02b2aec78a8768242527cf
TLSH
T13A31BEA7CA7EB55B10390C6B3D5878056D79B4310192A4F9DBAA922CE0C5CFB0F12456
MD5 SHA1 SHA512 TLSH

Submit Download

cf0737d8-712c-42ce-a053-37428a1ac4ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cf0737d8-712c-42ce-a053-37428a1ac4ab.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f15331880c3616804b218feaa18d74697ad5dca08b42c90f9797b6491ebeca75
MD5 0fc153a0a2b77d2469af06db227169e0
SHA1 5aff4ee3c8883d407a978d144f655c4ae3c9d665
SHA512 a544a0e60898782d400f165d145f6b5cc8118549aa92d3d7c92af4f9154339c1c96f8ab3cba72cf13ab9275adc95cc628302627e91745fe5aa50d23faf565c41
SSDEEP 192:HRfzw0wEkAygYtmv7cpAPRp2qg9BHsb+WNnPI40xklk20eYPaM7fVyIsnAUgtaJ:HRfzw0wbTSwUXlgrwPv0mlk22a858
TLSH
T1F142E82EEE60687B5DDAD21AF92A7B53D7F5102125D02D84FAFC8A2C15E75CD231700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0d62f032022be5c2ae1dadd147356b7178f15f82468d60bbc01f8fdec9431111
MD5 2eedb2a8312fb856708d1c43d03e6baa
SHA1 82b76a02b211fc91f4c769db139f7cc90aaf64c6
SHA512 c9cfbc74d97b2f9459e7d719ac7b2c69c78d4d016ab0d8a149134a3201acb034902dfdc90b99a30db716f12912580483015011560146b8f60fae7ba5b2f1ea1b
SSDEEP 384:HRfzYmz0WbR+EwBXnuKjkyrwk68vrsedlk22aE5e:NYmz0WbRo5HrwkzU2ZEE
TLSH
T13A62B52FE96029779DDAD21AF919BB1BD3F5102166D02D84FAFC8A2C15E76CD2317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 339b7880c195934f33029d95683dd7625f2330cddc63cfe64144c0345953a29f
MD5 3ffb0094f6691f1a28788eef6365ab4c
SHA1 c434ba0708fefb256fe8c846f41a94a666fb943c
SHA512 a47c22e063f189310ebc7e6ab72d9c247f983ab931e90b1ada892882d57dfe5e6897c829622f97b96336fee7ad16e5854319be890b7935a290e6aa0d7cdb7d6a
SSDEEP 384:HRfzw0wbR+EwUXlpxyrw+8GseElk22aI5e:Nw0wbRo0Krwad2ZIE
TLSH
T18552E62FEA6069775DDAD21AF92A7B17D3F5102226C02D84FAF88A2C15E76CD2317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1cada94a7331b761432ec85c4d1de1410b2bbe252a927ac5aa7a7a049418b8e7
MD5 b6dd3dfe5597c6f09257a21ec1969686
SHA1 462a6ec831f8422986e403816bec97e7bb91b707
SHA512 edb0d2e69312e3a725a1c28c1c0b77da2284d2f8a578956bcb8d1fd28f75ff117bc1f272b05a4503b2de635d2d2f6880e0d92e4c706e92f2508c2cb2ea24098b
SSDEEP 384:HRfzYmz0wbR+EwUXl3jkyrwk68GseElk22aI5e:NYmz0wbRo0Vrwk2d2ZIE
TLSH
T13C52B52FEA6029775DDAD21AF91ABB17D3F5102266D02D84FAF8CA2C15E76CD2317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3a0dbd3b4ed1447e415ecadb1df651d2e4a40e81ec7d966c4fe28bdf9c87df53
MD5 0fcec0d9f57967848f476340f75d19bf
SHA1 1bfaffd43b07677432c8a01650e18c6cb904d219
SHA512 98792bd49c7bc57d7c594385511c04d813399d347a2529b8e0b0d476cd5e1ebb7a557d2bf1bade11ac8358281aeaff799a070cfa854e64812f76da9e6103192a
SSDEEP 384:3iRfzYmz0/b/YwBXnuXrwUaZEqlk22aEi22e:8Ymz0/b/N5OrwQj2ZEvj
TLSH
T10E62A22FE920197B5DDAD21AF91ABB16D3F5102266D02D84FAFCCA2C15EB6CD6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f3c736b00f22e489e67dbee31377d2cc639ca6fdd9ff6478644793d15c88b83d
MD5 d1d97a5d59e1ee79e4f173510a69bfeb
SHA1 8d2d590ca215c301fbef4d9f98a18db2ce5ec76f
SHA512 4e83bcccbd433121bcde6d408d99a04c5d0676984afefd2e1df8646323d05274f95fb82e0428ea3ceab84d1c3eab60670333cd481f6086c1020d622b9f37623d
SSDEEP 384:HRfzYmz0WbR+EwBXnuKjkyrwU684vseYlk22aEQe:NYmz0WbRo5HrwUeJ2ZEZ
TLSH
T11A62A51FE960197B9DDAD219F919BB1BD3F5202266D02D84FAFC8A2C15E76CD2317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 92ff5e740865aabe1f3f5def78c28ccf1668cc4948561371e803e6cfb60ee703
MD5 d02891e440a702f2a68c10f2bc8f2fe6
SHA1 0c45c2227961b2d1521848e21c9bb16e8f670f9b
SHA512 199a04f0f04730db69a11fe61236ed3ff091aa906fab9446e0b8125423c7ecf3c8cc9c6153cc4d3a2bb35abe7d55aa1d1e389d7cf662b87ae25d2af017bc8bdf
SSDEEP 384:HRfzw0wbRUEwUXlpxyrw+8VF2olk22a858:Nw0wbRK0Krw652Z8e
TLSH
T1A052D62FEA60697B5DDAD21AF9297B17D3F5102226D02D84FAFC8A2C14E76CD2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1668ee959f7730acd06319a635d3809b5509c85b0cd5db8975c5b1c955f473c1
MD5 dda059df6281794e8ce3e8682866d169
SHA1 6ec1d5fe939cbb156c5e8b3f6599f25adbf86098
SHA512 31a9db8dbdc967d859b3fe3ffe3b59cc67e7e24b5be0583675293a4f20aefc2e97cb8860914d5017dfa620e5310a0f4400c45cd4089723c4329344286cbb9d3c
SSDEEP 384:3iRfzYmz0Wb/VwBXnuNrwUhTEhlk22aEi22e:8Ymz0Wb/+5Urw7w2ZEvj
TLSH
T1E662A32FE920197B9DDAD219F919BB16D3F5202266D02D84FAFC8A2C15E76CE2307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d14f347982bd7ab3df456178becfaf12cb6e15fc821583537881636ee7218467
MD5 bca53dd5713ce25c653740a7967eb278
SHA1 68087292aac1de101e37cb9c079065d17849de06
SHA512 8366dc554313954187637dfefb724fb236309a3da828dd20136afc4f77ae376fee00079e77404dba8bf670d69526460ec52491b8b09cf8550ea332e7a9a6d401
SSDEEP 384:3iRfzYmz0Wb/wywBXnuKjkyrwUwhvse9lk22aEi22e:8Ymz0Wb/25HrwUM02ZEvj
TLSH
T1F462A42FE960197B9DDAD219F919BB1BD3F5202266D02D84FAFC8A2C15E76CD2307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 65def1438376d3c82515abce7ca5424828f3fcf4f2cabae4ebed3adc19832fa1
MD5 ec8b6e42505c0aafc5663e23c49896e0
SHA1 90d071764faead7b17b3195db144d22979373d06
SHA512 ff361b9302bc54ef660039256d89bbfba6ad4f34f4a27b9512d95875d6f6caa7ee105ca409bff74b2d2e2c7202fb1e64042175c621ad79cd7a2ed7b93dcec416
SSDEEP 384:3iRfzYmz0Wb/YwBXnuXrwUhTEhlk22aEi22e:8Ymz0Wb/N5Orw7w2ZEvj
TLSH
T10E62A32FE960197B9DDAD219F919BB17D3F5202266D02D84FAFC8A2C15E76CE2307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e002563538877a95f2bfd0bbde99f49ef9f4458e43cfb906163ae9ec767a5904
MD5 9828dc00f813429e5d2664ee1bb19c4f
SHA1 4b7e5eb84eee77783274ec349ffcc4ecf8c1a035
SHA512 00b549d1a53f1147a419fa2743889ec29d12649382b01772bb80cf56790d2ae6f32b1d32ba34600b043a2d773048e791539d8770dfdff977c721e6e3622f9152
SSDEEP 384:3iRfzYmz04b/YwBXnuXrwUyrE3lk22aEi22e:8Ymz04b/N5Orwu+2ZEvj
TLSH
T13B62A32FE920197B5DDAD21AF919BB17E3F5102266D02D84FAFC8A2C15E76CD6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 80859524dbff11f209b0235fbf3033cf58b8366e43041bdd377517333f5240d1
MD5 658172cc15627d6b46f4b8a6736473a6
SHA1 d6b471b3a502ca587ea3bc1d95ba520c873f31b4
SHA512 1d53f1a870a0782f2b762d0ee9c5cb2bb57cfbc0078768bc48a902883818ffd22002eb52f8c10bc5b9b9b2a20add6dbe6ca47d42358b620ecb6233bed125109c
SSDEEP 96:F1mKjMyRwcnDh1JA5SLXbXFXKXTiqFXSXTqXFXKXTlqxhXsXT0XbXNXKXT+uZXIF:F13ItmDhocL1ajikCjq1ajlM8YL9ajxo
TLSH
T149A16D6EB509184EE4AD4936CD78571B6F69CF0C27FE3767A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 fb8df366c7459087e8f5bf416225da644a4e18f88230679d9897254774ccfa5e
MD5 e5c5d5b224a446bd7fe437be8f8e3d58
SHA1 9b97f303a2b3722ff8ae220661a0bb8c8bdc6302
SHA512 16c00a6c39877562f6a189b50b1d40a98005ec268421a87a1010c0647423f226f8ce806b2cfc4f49c59ac9f3659d61d2325dda3d7785d457b63e77fdb8fd74e6
TLSH
T155E0865426D9C1BD2055D05B0B61A34CCFE8760FD6ED3A122F4AEDD411C5909B7F12D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 43171db9dd3835423655522e96f422cc5cd6bddf469499b6bcd30695dbebe105
MD5 28a692c1c7aebb22b981f339e8a7f442
SHA1 db898157607c5c3345b0a74229ae5dd4652f9f76
SHA512 9f17f4aeaf9d93f7ec2c4f9d35ea235f147ee453be9862b187153bbf96a28c54c134f15b7720249ccfcf2b0b17dea915896126446915915edbeedb6a4018ce13
TLSH
T1D2B01211C0019201C0830AB0118724C871149F10D60A3741C3F0EA76C825162C415051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a812.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a812.TMP
Size 96B
SHA256 0b93a135b999d75d40f4153f5e676cdad48d3dfdab55530c2fbc73f130ff5183
MD5 a428d518524b2fe5c3030a793baca0d6
SHA1 002304b00aa97a4f25b59777297604758bd54bd3
SHA512 c6456d37d07ae3d0dc910aa3c470056de537e76030cdb45165eac10eff636e17c04a63aba20bf07101a02e00c144c4871a5c816a56584064ce949a82661d3189
TLSH
T1A3B00266C603A326E14243B065DAA5F87270DF39C6473613D2E02A76DD256718D292A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 ce41bd31f54b8034df3a4c29439938c9fbac05d29d911056795900b8d3861174
MD5 6b0b9fa094594f95e2f05985f92a75e9
SHA1 072a944ed297799be021951f91d5fa07ad23a0cf
SHA512 de867f38bb6946327d4d63ee9ebf05c84fc28391ee7e7326fe2fd17480c5112771b40e75c5ce287b8ac2f4443e5704bc171d430b84a1cfc975f7266d8919987b
TLSH
T189E04FA525C9C17D1554C0675664730CCEE6B64CE6AD2D222B069C987289805B7E1291
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13429374187213162

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13429374187213162
Size 26KB
SHA256 b473cea2a3816e20bef5142a0a8d5d8734b803b53a20f94f80d3d588b8d7ad8c
MD5 a845b20a6a30bb1f8653f9942e519aad
SHA1 88f0d75134a67e5cc042ad3bd3db9389f6fb0765
SHA512 c117b05ae9d9900aa2fc4f92dfc9e6753ddb9428ae61081762c2e45cd5b47f798d534c0871f1034a91db0612d03a24b6b7641d2f433ed7cffd65712d97b8be41
SSDEEP 384:5jleV6cuJVq0nBIZDJEzgCxlfe/VDcuEqytlCrEQLb260i72cH9Alqq9A87J+:vHvn+JErfetHEq/LrEcdAnAx
TLSH
T1CBC272517AE9113DF27FAE799AF571B46E3AB6523990CD0E00A043090832B81DF71F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 28a73534a66b25674db3a2abaee36e58c7817727dcbd7ee62f279e0a56bf2b51
MD5 35b918f9b455fa03cc30e2369f411b0a
SHA1 175e9cfa6852c9811ebdba8804656327f00a08bd
SHA512 19e0f86c708067d175b4ca746d54a6009ed7e4dd2a1477c4b8a8718a20cee5655716f92f90a0b23ebc99816ae3a07331a35ebe977b25a13e356ab51bbff0a58d
TLSH
T1D2B00228D9020562D6341BB4A9C3095133760C5403920107E19708E696B32E45E57911
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 a82c76e25f0639f17d483e402ccc54195c82aacb70d796550e7c4c3248bc7cc3
MD5 0a4727ecee67047240e4b85f6088039c
SHA1 23613fb234ce9b8084e7bf4cfcf243ca483daa5a
SHA512 4d5f92a1a39505773f32b939c345d4f77c41da5475a89ae5b4c921843ed8aef56647c1bf71bc238c08a9036b6773deef7de4e5fc26e48c89b836ec763d52fcb8
TLSH
T182C02BE43B61500FFD8E1135024247C41F08F823C0915173E95556288F4AF715DD07C9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 d7b6ebe76307a5a9b72c30a4d9ceeb7c65f5c0a76cfd71d81d2258186665d4ab
MD5 3bac4077021e117d6ca83dc9dd294861
SHA1 0858da676873212c22b8f63f195aa8b50c9c496c
SHA512 6b9b42edc90eddc5d61ae475a40d8749ebcd446a5c0c01ea6713a176d6c476cfb8552029d86c1603667973792d6954645e6c7d5bebc162d2444f519df2615f31
TLSH
T160E0D82126CDC66E6186D0575728F30C8DE27608D6ED15226B09E4885285404B3D1680
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 b361b903bd35e981b147eb54441cbbdb6547b6f060479ff30d370ebe74661e7f
MD5 b5a4b5a78f52e936a6c8f0d9869c41e8
SHA1 52478d0f3def0cc383f1af0cd9b0690241405e2e
SHA512 845124c66d3ffba6de199d001c9fa8c821bed847e47ca08ef9bce4b495435cf64708f99d4305250d5309d65041f41c020a09103999c7a75db4372fdf71797edd
TLSH
T142E0267126CAC27D2048C0874370B34E8EF07A0C93EA36026B0D98A8A280404B7F5AC0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 dff0f363cc0861c86f7df2c014dc3e0cd27c5a73c8d1999ce2941d954ec4808a
MD5 5f6cd086a61ad12e76d72e44d8537ec1
SHA1 e4a48be8281eb986ff1e84c3499c534415a176b6
SHA512 46cd80e93c858afa1f0bdc0aefa5a1b10bf4f898a51f746d485e71a37870f533550bb8693bf89940af18fc38a60b131bfa7e3f75713075b2e47e983eee400f14
TLSH
T1E8C08CD32A208A8B4A38DED83068322CD52B854C8CC8CCFC890941861078A63C002438
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c4b87.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5c4b87.TMP
Size 157B
SHA256 09a0c9a0cd3ea93e948134139d75b3bc38deb1804ad78152c52fc4f4cfe865b4
MD5 55a50e2320ed4d9b3716a348ef31db33
SHA1 4f632fce2b086b786784218576a7dc7cb95f9773
SHA512 7bbc3285da3646d76e2d9b3fec86d41952c338027bebd1f23c632bc3151f63d9467c111ee5f1c1de1e9473e7b342857ba3a02fd1377f2e311c0333c5c4a84f63
TLSH
T13EC08CD329218A874B3499D43038322CD53B8C5C8CC8CCEC890A71862078A63C401438
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 d48558a75a3ed4c5c6a4c16016882849c52d70300c8052b67474c4884fe3a76a
MD5 201797394adf2a30f532f529f8643467
SHA1 01b283aaa42cadd5ae3d6e0e95d4d20b93765d8a
SHA512 eb3bf11661e0a47e3742efd53be6e372ed572980492ac3e2641d16355d70b6b670fad141a874051364361a09ba6923edd614492e0de2be7d29adac387346b9e8
SSDEEP 96:f7doKsKuKZKlZNmu46yjU+VXwX4W+X4Xmw:7ZT0nzX+VguId
TLSH
T15803528FA66880F3D4B6C53EDDD649D6FC78150CA727BDD500F907624DAC03391492A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 143ad04675133f9e8133f6c541067cd5cee1bc9f3f72b9ee2b841aca2cdb2d6e
MD5 58d74a8944b9d20b8817d5e24a0ec89f
SHA1 f5350228f8dc3df4644ac3bfe3f40ef5ec296f24
SHA512 dfa5c7d43931a6fe6e5bcc1c99d942a113525c77720894266c966b7ce61e01d75c15a1aad7e0ed7270182da93cb53eba08dbda4336f9ee1b65aeae1bc4b904c9
SSDEEP 12:tllkikFdgmpnnPtdJ2kQivVXXwX4O0FHmLULIGXV:t/hQpnldqoXXwX4O0dmLUL9XV
TLSH
T1F3022BDFB4418489ED191CFDC79D9CD769250A483FEFF95E11E54906587C513800B357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 30KB
SHA256 ce692f8692169c69c3d989a0fc00dcad0aac3abe2f33d2cba96e207b3fab8c55
MD5 8c203758e419ac7b954f420f5c76935a
SHA1 5330161a5fbe4c4bd2aabc54485d8d5b2b451b87
SHA512 6c0cd629907242c6f29b9b978cc289be200cd4e0d3075fbaa28a385013d567679fff470a23ab252cac7005d245ef8b840c7eeeb54facd4b19b2188bb820b58a8
SSDEEP 384:I7UJsdGNbtQXIIImbGMIMNB1hCBsdGH2IEVsdGSlqE3sdGrdGPiev9Ixwkcr0zg5:7btQOfWd9IxXhQq6
TLSH
T181D2B7B6A3B01A85CC8FE7FFFC54CDEE1772DC4946950001A4A396FA2873E165D8135A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 e808b16c1b96d59f1761235e9af2f43b2febe37c4fa7b56f19f3a8e9efe0e0d5
MD5 8570a586ad910d05c8d50b9e5f37980a
SHA1 f68a45d54aa8a543daac88b94b10a7007920bf7f
SHA512 32f1d7039e3db1ce77c59c3e0206cdacb74f6d8c03d9707dc0a278a2d8866cddb0e975ce82661e625a313fc0dd10d9777bc61ecdcabf3cbf43a324b717a0b7bf
TLSH
T1C3E026007AC8C1BEA025D0A74324A38DCFC43E0EEBE816262F06C8AC7080804B7E0280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 57a974a6babd110d27425d4159abc6cd01583809ed33f0e212e6119a46ae71eb
MD5 67ec453095e872bfa7b65d9ce5b3b280
SHA1 4f1ba3b01d4fa4be037fd5c50d22f1c740505a3a
SHA512 b3b6bf3187df1d4727916044613c783a71d1bfd6cb9de16741a87ce6256562e589280cdd053cd779801157ca6dd862eb33d8acb926585bb15d82ba1544c9bdd7
TLSH
T1D6212855F332C104D649877A247EAB290334C8679FF8ED0F25B524687FB2E540D472EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 ff29b6bc1b09a6cda83763cf992ba3979e9566ecd161195246ab2bd385c640e1
MD5 b4fb860a310800d06aacca2267f37181
SHA1 2decc32ed6c5ca78b93defdbf12b117f922d4ddf
SHA512 2127181f36b4522ef86195951521fa1427e111ac4b637d94bb76ea245b6f5c9605e1cae0bea51e3cc506dd94d6bf1af3986c82e9349bd69a3a4e9b9612dff3b7
TLSH
T1DAE0DF0479C8C1BF4029D0934360E34CCE943E4EEBED2F022F0ACCAC7180205B7E1280
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 44eca4b05e7a297b950ffbfee9cb6d4accdcb806ea48fba0ff89734fb3e1b938
MD5 01a1dd9517202283236253a7ec542bdb
SHA1 a692adf441be9c30e2ed24aba3da895698e152da
SHA512 ba54aa39ee20f2f532d67a9f2b8434b94371b30ab14adae0319fa83b694b003ca8f402766d4f296ce941b848d79ff143e00949bfe0dfb8bd9e05825df5cf8f89
SSDEEP 3:MsEllllkEthXllkl2zEgltZrl:/M/xT02zjrl
TLSH
T15044043DFFC0440DD5105035C433C3513370F454051157C3347D05175CC55410C40110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 dbd9d8ba4256667bd6e9a90a058a9c1d9a37a9ec5b3b8e0b83b7cd698bf4ed4f
MD5 f3c62cdd775166afd033a89e0d04d229
SHA1 33e6882aab3b83325a98a5c1528576940530da21
SHA512 51cd3c83b9cb0c02a221de24d2fd433dfd9deb68261318e2d88992c8c8e1c29ff951c7ad9e9368190df6fd4472abc3befdc825b4f032900de5fd5cbacc5211df
SSDEEP 3072:SXFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:eFmUi21rSm8uUVNSlzY/
TLSH
T1B3C31204BAE3E8F2EE5930447BEE2A145D6C0D818291C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 8e55385b97e1781ac75e0324f1c96aa107d9921690209fd2b13e5c1f24949944
MD5 8773d676b347121631b8885999c2092a
SHA1 bbfbdec7d511d039e1900d1a730651be6e441ce1
SHA512 9268f345ebe57459fdacd7a24f5e92c9fc15d2cc9d3884a688b743cacd684240bcbf472ed5fffef656f1fdbca6afc4a9058e3812204daf85baf4f8e63f4f0ca8
SSDEEP 6144:0A3tbrNApjCVBhWpl2tuFqCAwFmUi21rSm8uUVNSlzYO:0uFNg2rhw2tuFRfi21b8j8zf
TLSH
T1823422046DB7BD739A1D60013DF9BA379DA50EE1C644C88882879E825DDA3C64F5AE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 7c5b37aa182c59fed60d0541074af709d8d36993257e318effa45a00c3fa291c
MD5 909a884fb5e017d470d1db7a2c832e4e
SHA1 1660fe0dbd3e950a96ad0f1772329843714cdb8c
SHA512 9e3b34b28dba4033e9a88e082741b8ea0ec725f8795559499ac1cbf10dbf99ebb6183d741e81c4182ad9fb83cf67f18c5b799e78495bb41af407d6c177a45e7f
SSDEEP 6144:0b33tbrNApjCVBhWpl2tuFqCAwFmUi21rSm8uUVNSlzYO:0LFNg2rhw2tuFRfi21b8j8zf
TLSH
T1413422246DB7BCB39A1970403DA97B374DA94ED2CB44C88885439E825DDE3C64F56E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 767953d6c7e266a1b746e466b1f32ef40431953b9f26e18ed8c02f873682030e
MD5 1373f0e966d3218de7ac13c889a76f3d
SHA1 bbb460e47000b85f70042dedd967240256a74a51
SHA512 e3881d1b684b59b29dc2b3126e88c6c38b5562a942e57da5a421010c645e1f4cafcd5e35b01e3eeca49dca94afb5b28ba0ac42760e152eaa85c9767d012e6b6b
SSDEEP 6144:0e33tbrNApjCVBhWpl2tuFqCAwFmUi21rSm8uUVNSlzYO:0eFNg2rhw2tuFRfi21b8j8zf
TLSH
T1F53422246DB7BCB39A1970403DA97B374DA94ED2CB44C88885439E825DDE3C64F56E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 160KB
SHA256 3014132b52eca2affae5eb0d1fd3bf71f9c0db53cc7c4bd9352542f988e43383
MD5 dbc91b40ca81fbc8ccf57f9d739558e5
SHA1 721e214359b06c1afb1196b666d28b1644f37608
SHA512 adb4862002085bfa87b795100112a3edcd7439645ae9a300c104fb1655d3d123b6e884a562798164dbe5062ee1d451570d1e83864d4b5f066975b2fbdfdc9969
SSDEEP 3072:SWfpngJwzHP3t2MtgujtnItzAApjnCVBhlA9yhUl2fBbuFqC9eT:RBgJIHP3tbrNApjCVBhWpl2tuFqCAT
TLSH
T1C0F31268797A6D335118A0133CB1FB374CA15AE2DA48D9ACC4C99FCA55C5BDA0B43D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 83d0e9044bd717e27d8c0869f7ead2e9fb780418931010b7e7fdb2c3f16028c1
MD5 0453578a6d51bb7263885d47c2f7e92a
SHA1 cdce865ef1596ffa4002ca85709856ca15ba1a76
SHA512 eb3a8c4214ee33c1399da0f9e11a69c8a9ea7a62946d9921bf64e4b2b42f14300509f47b7428571d7d651b3708d3e54e9b79246bf836113cf37da8748c3f736e
SSDEEP 6144:BA3tbrNApjCVBhWpl2tuFqCAwFmUi21rSm8uUVNSlzYO:BuFNg2rhw2tuFRfi21b8j8zf
TLSH
T1ED3423046DB7BD739F1D60013DF9BA378DA50EE1C644C88882879E825DDA3C64F56E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 272KB
SHA256 af31dc4f9de1dc725193fda8ff4ef670b3fe556c846e264f220f7178817651cf
MD5 f3aed309f56ffbff9d61b6c3ca6f0e3a
SHA1 5f1beda3a63f3c7ca219e30d55be03317a0de69a
SHA512 cb76f8462a8daa41f6817c0f3fc6d2407f9f1113689f9f4c75f387f5aea7bd3db6e1d0b2c6eabd2ceaa17e599d901d9983ef03dd9ba33a0de5037455aed529b8
SSDEEP 6144:0ggJIHHN3tbrNApjCVBhWpl2tuFqCAwFmUi21rSm8uUVNSlzYO:0gvHJFNg2rhw2tuFRfi21b8j8zf
TLSH
T1545413247AB26D739A1830013DEABB374C954ED3CA44C549C542AF866DCA3C75F97E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 98065266640c176865d2d06645005615f6cd33973c910aa6ffd78ae0ccd6d926
MD5 2cc49d17bfc61d1c83ef8cfae52db1a1
SHA1 ef5f7f7fb8a50a3580703d0dcf182fcf9fa18092
SHA512 8a2fdca399f51db27306bc8bdc189192ac1658dc279b5096397c15b69004351d9e3aca013ff490877e3316c2c45be8723947bb7f456d32521c900ad8a0818001
SSDEEP 3:MsEllllkEthXllkl2zEgltS+Bl/l:/M/xT02zjs+Btl
TLSH
T1E544043DFFC04405D5301034C433C3703370D45405315743347705177DF55400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 4cc1fd903185a0b7018367f21ea51ae210a908cc8548b4be82fdfb7ca2280b70
MD5 42c050c9410de246b0a0a12c50bc5907
SHA1 0954d114fb1d4f6da82c304f600e0ff7cfe9a293
SHA512 0d215a7e3726c93a71583b17a6576dcfe33207c0596c15b9a4e5859f3c4f1a8771f79ac5a851a730b41b20ba9b5634db6ec608027263c3203d58b7574953136e
SSDEEP 48:TkkhCU2QB2zbBxxZDiNLnJY4+LVwQMrCiPIQSJHHQX5u3z5aU51dmh4WpcZM:QUcfyNLKlZwQOUQ8HQJu3z5x51d4pb
TLSH
T1CF23944FB7521285D950A93FFDE38D843D3D6B98C95E98C618B00D732CE02A9601F278
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecoveryStore.{BA897EC9-8765-11F1-B05C-C2D11B6ECFEC}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BA897EC9-8765-11F1-B05C-C2D11B6ECFEC}.dat
Size 5KB
SHA256 84b2801cceeeff09cceafa55e1098e4b66a49d2815d6ded8efe177516d8c683e
MD5 286b2d6bba43dbe9950382c89adcad6b
SHA1 44bec277accc6d5a1009edab918f1e7810a16831
SHA512 8819f7250fad2299d446195e9b9ccc361a3e96d360ed02a22db192e1982e497b13efd996f8a9a1758d8aa30721fadce528493a7ee9273bc190b834b56991b535
SSDEEP 24:rcG//SXmXqGW/SXmXEXmXqMJvXmXk9lW5zjw:rcG/b6GWbBarZ5
TLSH
T1E2B1B2B1B1A1C101D3A69FB3DD99E6C46B2ABD41AE91D50336E1370F89365C06DCA021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecoveryStore.{CEBD04AE-8765-11F1-B05C-C2D11B6ECFEC}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CEBD04AE-8765-11F1-B05C-C2D11B6ECFEC}.dat
Size 5KB
SHA256 35565c135ec094caa5ad36577c7804a24c9da7ef1ef153a6f5e75d3bec92cc19
MD5 d2650ded4035baf508ab824423f4a086
SHA1 47f8ba21115f3fcdc321b6674df6372e69e1e0de
SHA512 f34a13fbd7e24ef3066ae8df25c0ded09ae4eb0bb3e905f1616c030933e641e4c7d29e149503d19cc5be13f79fac58078f54dc0ef91942bc36033465268cc30d
SSDEEP 24:rQG//3mXWGW/3mXAKmXqMJ5KmXk9lW0Ice0484:rQG/emGWeQlaylZ0
TLSH
T1A7B1E775B651C001E1269F73CD99E2C4672ABE60AE95E54738D1371F49376C0ADD6022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemodInstaller_1.6.20-0lozco.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G2JLN.tmp\VoicemodInstaller_1.6.20-0lozco.tmp
Size 2.6MB
SHA256 e0b0fcae5fd1d9685d949f7dfa4c41c03ca903e084452e58c00293a5a2e3047e
MD5 a9b88f3c1fbdd2d0420e0581a406dee0
SHA1 dc701263e0d43a542ed9a819c118f262e139a95e
SHA512 56677c4fbf2dfacefbd2c2013190720fe5a1ee048b783c3e9a4d0379d1b7fcd05a9a32f88edfb95e9ed4af66a30153fc9f770fd9bd4eff9a0e37bfd113dc6078
SSDEEP 49152:g/bMELtKnwSaPuqrUJlORnUjzV8VkLwkM:gjMzVPeVCk
TLSH
T1DFC54B12B384B13FD06B2A35643BC670993FBE5179B3CD166BF41D0DAF355802B2AA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DFFCE17F3990E724B2.TMP

Path C:\Users\Admin\AppData\Local\Temp\~DFFCE17F3990E724B2.TMP
Size 16KB
SHA256 0325728128f7578dc54225fe482c7cf6dad115be464278862311b3e5628e89ee
MD5 acff954c343f4c854aa9fc3258fc7a85
SHA1 2e93194d51f190b52c0f4662bf3083466a91ea8c
SHA512 540124844896730a144f4c38c29bddf72bad537c66d0eb4e665a2e155885cf56d66deb7f52eed1bbde961114e522ac597389c3b535d54152c61b0732a6e06f4d
SSDEEP 3:V00MWlVUqU0KAbuztglclllv/nt+lybltll1lRslkhlEkllU+NG600O:0WPyAbuxgUFAlkxMn6Y
TLSH
T1B4724CE3C5118701C7D3D375659D2F90223270811D610E5015353834D631AD55E9B510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Petya.A.zip

Path C:\Users\Admin\Downloads\Petya.A.zip
Size 128KB
SHA256 e99651aa5c5dcf9128adc8da685f1295b959f640a173098d07018b030d529509
MD5 1559522c34054e5144fe68ee98c29e61
SHA1 ff80eeb6bcf4498c9ff38c252be2726e65c10c34
SHA512 6dab1f391ab1bea12b799fcfb56d70cfbdbde05ad350b53fcb782418495fad1c275fe1a40f9edd238473c3d532b4d87948bddd140e5912f14aff4293be6e4b4c
SSDEEP 3072:7P2YmowJWNmYv5lnTc8R+igbpBgBXtzXW4Dg/PJLDEuUYBAald:r2YnzNmYBlI8hgdBgBXpXxDg/PJLDEH4
TLSH
T1F6D313ED9206C475E89CADEB550981451DD673BAFE842B4382093ED7F8306FC9E60AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProgramOverflow.zip.crdownload

Path C:\Users\Admin\Downloads\ProgramOverflow.zip.crdownload
Size 560KB
SHA256 7b8632db07cb8693963402624e6ad884187b23f81ec7968fba2631909d5919b2
MD5 44481efd4f9a861444aa0aa05421a52e
SHA1 22e9b061f8fc3147dd0ec8a088a38272b0d30bcf
SHA512 819cf783345751f6fb000142b59ebac5b72c8878adfaec1c9472bf242d7a469cdf21a2d89c6e292599606f19782c1951752f763bd89efed35e1b0f2d2fd52827
SSDEEP 12288:WEFL1PRkKXm5t+HE4400xZbEAizJuwY4LMUPKrDYUrKWlQ4qpK2Bds:WOLvk4m6HET00/E1zJuAivYgY7fs
TLSH
T192C42389D84CC305A56EF2109A961D28AB495D485372FBF7838D4FDD2C2CBD23687BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-7-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/1196-5-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/4344-1370-0x0000000005360000-0x000000000536A000-memory.dmp

Download

memory/4344-1369-0x0000000005180000-0x00000000051D6000-memory.dmp

Download

memory/4344-1368-0x0000000005110000-0x000000000511A000-memory.dmp

Download

memory/4344-1367-0x0000000004F80000-0x0000000005012000-memory.dmp

Download

memory/4344-1366-0x0000000005530000-0x0000000005AD4000-memory.dmp

Download

memory/4344-1365-0x0000000004EC0000-0x0000000004F5C000-memory.dmp

Download

memory/4344-1364-0x00000000005A0000-0x0000000000612000-memory.dmp

Download

memory/4968-8-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/4968-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads