ad0a55d44f2d45535b9fc389cd4742e1c8cfeca17c29ac94eb3e6cb8fd34c56d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Size 13.8MB
Sample260727-3fagfstbqa
SHA256 ad0a55d44f2d45535b9fc389cd4742e1c8cfeca17c29ac94eb3e6cb8fd34c56d
MD5 479cf10ecaf19433e06c3b4ad8ad0320
SHA1 2dc5c758d7e8010aa904a827f1158385c73dde94
SHA512 7653fce156a3ea8a78f4da6bbdb4135c15fe4c7e0dd9ce327711fe2f3180996da60cd05a7d65283e787e9fd04a0701f72ea8402324eaea0c8dca91acd6d246bb
SSDEEP 196608:aDVnUKVAYLFjjToD16umqiaiRtOI3VVwVD0u7:aVVA8j3sdmDDRtOI3VyV1
TLSH
T122E69E43EC9151AAC1AEA330C9B35252BA757C459B3263DB3B54F2383F72BC06AB5744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion spyware stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1708	leakless.exe
744	chrome.exe
2188	chrome.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 15 IoCs

pid	Process
1708	leakless.exe
744	chrome.exe
3836	chrome.exe
1612	chrome.exe
2512	chrome.exe
4220	chrome.exe
4268	chrome.exe
2188	chrome.exe
4732	chrome.exe
3600	chrome.exe
5096	chrome.exe
3612	chrome.exe
4672	chrome.exe
4992	chrome.exe
1276	chrome.exe

Loads dropped DLL 33 IoCs

pid	Process
744	chrome.exe
3836	chrome.exe
1612	chrome.exe
744	chrome.exe
2512	chrome.exe
2512	chrome.exe
4220	chrome.exe
4220	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
4268	chrome.exe
4268	chrome.exe
2512	chrome.exe
2512	chrome.exe
2188	chrome.exe
2188	chrome.exe
4732	chrome.exe
4732	chrome.exe
3600	chrome.exe
3600	chrome.exe
5096	chrome.exe
5096	chrome.exe
3612	chrome.exe
3612	chrome.exe
4672	chrome.exe
4672	chrome.exe
4992	chrome.exe
4992	chrome.exe
1276	chrome.exe
1276	chrome.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\manifest.fingerprint	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_419260612\manifest.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_419260612\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\list.pb	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\manifest.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\LICENSE	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_419260612\privacy-sandbox-attestations.dat	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping744_419260612\manifest.fingerprint	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296684617247029"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{EA3FD836-A91F-41EC-884F-60DF6B8978FA}	chrome.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800001900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54367e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1556200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
744	chrome.exe
744	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1708	1524	2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe	97
PID 1708 wrote to memory of 744	1708	leakless.exe	98
PID 744 wrote to memory of 3836	744	chrome.exe	99
PID 3836 wrote to memory of 1612	3836	chrome.exe	100
PID 744 wrote to memory of 2512	744	chrome.exe	101
PID 744 wrote to memory of 4220	744	chrome.exe	102
PID 744 wrote to memory of 4268	744	chrome.exe	103
PID 744 wrote to memory of 2188	744	chrome.exe	104
PID 744 wrote to memory of 4732	744	chrome.exe	105
PID 744 wrote to memory of 3600	744	chrome.exe	108
PID 744 wrote to memory of 5096	744	chrome.exe	109
PID 744 wrote to memory of 3612	744	chrome.exe	111
PID 744 wrote to memory of 4672	744	chrome.exe	112
PID 744 wrote to memory of 4992	744	chrome.exe	116
PID 744 wrote to memory of 1276	744	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_479cf10ecaf19433e06c3b4ad8ad0320_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
  C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe a9beb8071539dd3fbc26358d2449335d 127.0.0.1:50015 C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-features=site-per-process,TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-site-isolation-trials --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --force-color-profile=srgb --metrics-recording-only --no-first-run --no-sandbox --no-startup-window --remote-debugging-port=0 --use-mock-keychain "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340
  2⤵
  - Uses browser remote debugging
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
    C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-features=site-per-process,TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-site-isolation-trials --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --force-color-profile=srgb --metrics-recording-only --no-first-run --no-sandbox --no-startup-window --remote-debugging-port=0 --use-mock-keychain "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340
    3⤵
    - Uses browser remote debugging
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340 /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340 --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Crashpad --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=128.0.6568.0-devel --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff28b8ba18,0x7fff28b8ba28,0x7fff28b8ba38
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340 /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Crashpad --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=128.0.6568.0-devel --initial-client-data=0x1c8,0x1cc,0x1d0,0x1a4,0x1d4,0x7ff66cc40418,0x7ff66cc40428,0x7ff66cc40438
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1612
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --start-stack-profiler --no-subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAMAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --metrics-shmem-handle=1640,i,7187000551603615167,9528604142283400081,262144 --field-trial-handle=1920,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2512
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --start-stack-profiler --no-subproc-heap-profiling --metrics-shmem-handle=2044,i,12726208247872303606,12330476711990309872,524288 --field-trial-handle=2064,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4220
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=2184,i,8576298185120397777,7851517296429885397,524288 --field-trial-handle=2240,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:8
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4268
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=renderer --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --no-sandbox --disable-background-timer-throttling --disable-breakpad --enable-automation --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\gen" --force-color-profile=srgb --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,17193967045923210471,17122346176901238253,2097152 --field-trial-handle=3476,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      Uses browser remote debugging
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2188
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=4688,i,13955759264814933322,3147574759778747670,524288 --field-trial-handle=4712,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4732
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=3628,i,3650029144469737022,17326290972179989006,524288 --field-trial-handle=4268,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3600
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=4692,i,1129218149054758293,12422136167715853511,524288 --field-trial-handle=4836,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:5096
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=5220,i,9380179465072481109,17176100033457638597,524288 --field-trial-handle=4920,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3612
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=5216,i,10242733654797336266,1760478123788298395,524288 --field-trial-handle=5412,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4672
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=768,i,16794650439599536070,17140321259245771371,524288 --field-trial-handle=5388,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4992
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=5140,i,12812010252278568670,6431891975161795444,524288 --field-trial-handle=5432,i,18203124807274684162,14191718424455506054,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping744_1449831074\manifest.json
Size 88B
SHA256 1456d18b5c9e070a1c5fec30730b0e9e2d8ef6b28e9fd2d749dc47489d4f673f
MD5 5e39f4ef617a800f084c55c284151789
SHA1 db311de902d2dd192c609756fe4551213b3d6086
SHA512 cd571ad6f0dc835678f2e2a1c4dbc0526414060315706a2e87b182bda943222e38fa18010ab2e8393237cf996a05c9935bf6ce5addf94eb311814092649e43dc
TLSH
T101B012201901557320804B341033D383AB951C455060A90451A612421244175103232D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping744_419260612\manifest.json
Size 97B
SHA256 335b1566f2a398f764be95e60ea16352e087262dfffa2616576bb22947d7e4bc
MD5 bb2720cb7fa3a5c821be80f5b421e090
SHA1 c969483a66c882a2d99cd35a99954c64e4ccf373
SHA512 b2f326381ec8904a4d193b2dc7c624318c76cf23ac464a03a3f0528dbba54520ae0fce4fc7b914ac2ed7ed380d3616459b7a5754b9748b45507ead051b910739
TLSH
T148B012B56844B27714C403240B328392ABF15D4238237D30150610802164139026726D
MD5 SHA1 SHA512 TLSH

Submit Download

leakless.exe

Path C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
Size 2.0MB
SHA256 1d11bec16a63d85a386c47fb97914ad13318f7fdcbf399c5a895cf642307f115
MD5 f64c225477245d8cd25625fe4d453f62
SHA1 2dea714253f18838babeacff346f33774d764bd9
SHA512 f272c1239bd251e4995e2ec76538ac98d6ca118ec61054cc36b630f2bbf04b51df0ed85d7141cb74594ea2790df38d3c79624ddfd900a6e3d216db58764cda9e
SSDEEP 49152:7bdVK53nuhrb/TkvO90dL3BmAFd4A64nsfJwdv9oiogf8+WhMCIwYvD1:g3VhY
TLSH
T1E8A52947FC9190A5C0AED23089669292BA307C890F3163D73F50B7B92FB6BD85E79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2847f64d6aa8fc1ee73516155958be8163716cfa771b1f8bf20d545ff688c031
MD5 3c5652e1ce00e149753e1114d079109d
SHA1 47b306adcdbd36a16e968d03ccf7bfe4409a514c
SHA512 c0aaa6b690d8760312d136ca7fc17878892cbbf374eb13ecbee1c7ab89a1afe3a4df6f87d0d9c234558fe1b3ebe475a43e1c650093dec65f3353b5d616a30ee6
SSDEEP 3:MsEllllk9/YtlGallwtlllNhCG7//dmR0IEKYLmNOrSLrK8BEXA/ll:/M/PXGuaYQ/7IEK8mNOGLrK8L
TLSH
T1184492BB9641450DEBE988F82B00A6AEA3F69265DCEB4FEEB25102964840A290952019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000002
Size 52KB
SHA256 53fc640108eeef6b3a7251132577e7b07deb60e8135597be9978147d32db315c
MD5 fdcfc451fe046fec83efa1c489c13d58
SHA1 546d637f5da0990e2755af16146f3cba528ee1b5
SHA512 cc5ad298491bf230ba4eadca202b9cce58c5fc5899b5aa8f560546299747588c6610cb680794bbf312846ebaa05d21ea332c86f92a00814606b3eddcdee5c827
SSDEEP 1536:4ea3DrUQ5CGGgogq6N1C29JrifEId8okaUh:4lMECGVZN1CYMl8okaUh
TLSH
T15B33F18451426BABBECD436F8BBE09C714FB9B444142C4E4C76E540E0E61BB658C9E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000003
Size 75KB
SHA256 2a89d948fe7ddb2b4a1893fdc060d4e552258a584af6cbe733e9b84c799a153a
MD5 cb7e38bc592992f5c12dae3f8a1879b5
SHA1 a5b109ab0722d630950a0aed5945335cf0317c70
SHA512 7032227f4650845d7ce1ef48a2099a3f5c518a9fd8832558b0bc686ffdff48e33ae4ccb4ca1ebccf7c5d487bc6294bf2701302f4b674567efbc8cb0af144745e
SSDEEP 1536:Pk2TOneuZff+WXhYBw1fwa5GOUphjJfKD2iBY3VsbDxf0Nk14f60Pg:8eM+WRdFwa5GrtKD2itbDxfV4S0Y
TLSH
T1E473129B0D476186522F0A833A07C69EA506E51EB412703BCBFF92E3C86F51C78A75DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000004
Size 28KB
SHA256 34bef9893b62a053bbe65084037f2fd097cde4177bf6995490bcc0135ac655b3
MD5 936ed835362aad91e53958d3e9a69dae
SHA1 80d645a9c8f2dca399153031d8d83b6f8d94e298
SHA512 2590ad854bb77267187676b16427a3ec13afd4db20bd071b9a9988d5d1b09d7a082c2d6a5db5a5c13d71effb6794e31e19efc4126152420a402a9ea2ea6d6205
SSDEEP 768:2awamnBHFdMOmYrVkZaFmdN0Ypvget7F3bZdH9lnrU:2awaIrrqaW0Cget7F3DfrU
TLSH
T14DD2E194CAA3B5E899F6F6B8D348D164407A5001D738187F6D56A3BAE4E0C4FA4DCFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000005
Size 65KB
SHA256 093c8c2c7f30093ab46738887f05ae602770df8ee49bd8ced448c6f8e0be69ff
MD5 4369e8462cfdd7ccc69392d8efd3c8ad
SHA1 f425851bc38562213e928766866592dc8d6b2de6
SHA512 28b4a96537187bab23f1cbc311b31cf6a0aadcf309477d0f3368bc6f9933c9e65d5c3b319adeaf28a23fd383afcaf54fbab50986b6bbfd08df727d821e2b5a4c
SSDEEP 1536:3VB4XY4cIptMRTnDqcE5ABuSWZe+Ym9U/1H7m:FmY4nX+Tn+oBuSYcmyHK
TLSH
T1F16302E7757C4D8A16F8B1183E268D2CED2154A46EBF53B130A3DBBB048705A87F9670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000006
Size 52KB
SHA256 d3cc739f2f0ff453ab55e02ca1c57220a96743780914de457003fb02013fa000
MD5 e78e9c0344e8e2302d872b018b0159e0
SHA1 8adc2e2824f230055ee3a7671adce83bc48368c5
SHA512 62d7eca86490c7a2e365348def84812e6c980a2e1e69df0958266bbcf233e2c614867854da110387cd46ea063326a1356965997fb86409ef5e227adad80ce3be
SSDEEP 1536:t0MCvuYMzodlyFycEl7oLa8JmzDrkOdoowT:t0MCvuYM2lbcEl70gDkOlg
TLSH
T12F33021C19C77A8690C1873E6867BC2FBE6EBF1E414432E24946708BCBE7B557281573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000007
Size 311KB
SHA256 586303825680853be16810e1f6c29fcbe01f7a257961c7f93ee348534e2b6828
MD5 9ec2106db21091feea5e4128d1bf6ee2
SHA1 4cdbeb54cf256da838699e17fb56f98fb2a03ce3
SHA512 e8931b0042d0b2d2aa69a134f38b55283d678a6ddc9af4b3f84e41a246a1ddbb33fd520144e1bf3201c8482a098aeb5202426ef67f14c4223ebbcb179448cb05
SSDEEP 6144:HMGI1SliM/lWHSPp+xI0WNFm156kxXfVQQ7w1eCsDBbKK3CTxUi5o:sCxWHbKA5RZVQQHTDBPC5o
TLSH
T17364233CAE1B58ABBC1F7D0D018A0AF4235939A337B5C54C6D93BB3E06742694A1F536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000008
Size 413KB
SHA256 6a18965ae1f36e5df21b720e433bb7c9578d78a35a9183088c76fcba9615a7db
MD5 7e6b27550f74a15b639f6457a72fe5f8
SHA1 53d3cb44950d0fd295d402a1025dfca70c19a2f9
SHA512 8ce8234c69a55d35a3c3b75aaf8d90f373757f012cb2e7bed6e65f42e4602bc77c7eba12b91c8ece5ec9e831238d31f42fa54939eb17b342c407f3ee9a7980b1
SSDEEP 6144:TkDOFwnXrMg50ayoUOHUA21cbW0aG8TCXhrFoPwiFZJ5KheWD6u1qtf7IrvESFyA:TJm7McioUE21uW0gSNiFweWAZIrpFyA
TLSH
T15494230F0845777CF076895F29C37CBA8891D399CE429496D3EBCFAC4E4667686209EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Cache\Cache_Data\f_000009
Size 728KB
SHA256 601690fb5ceb02b456bcb47a8a75880021d9cbf4676eab4dee6c23a8f78327fe
MD5 c21cf2cbeca489a6940031f8140b8f90
SHA1 5a41e1760867f4ca51151c71cd85497d23fd2f59
SHA512 b505477cda5576473600039212bfbe0f9ebb547716b7290f91ff53b62a0fdba257082a5f938d6530832ea460064d8f9d473408c77cc8b993c6092f9c1ac2ccda
SSDEEP 12288:IBdJawFpuyh6QTb1gT7poFNjZ4bmF4iiZ67rzD+GR7porAIbFC9LW88NU8KsSoif:TwNb1wpoFNjabmSi97rvfdOrZbY9LCtS
TLSH
T100F4333A73BD34EA691ED350413B23558CD89D7C8F95EADC170BA62C78B28811B5BE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d69d8d5803f3fe0748e2fced9997efbb35e1c8721bb5de1ad09c6d2e52cb3212
MD5 1c314dcde8d6466ca449b4271e6821c8
SHA1 cd7236732fa85098bcba6f5619554d53d71a2481
SHA512 87ea5704da22bb6daab4934d64c623b2dd79a2e2e2165c5c19656caaa169b31d32dbfecafc9a8922eca8153a26151bd0035ea1542465bac462cc914d48c7c3ee
TLSH
T1F021ADA0D8400B14FB9FFD3C30DAE47931BD47A0758B1DC2299887709047BB395C618E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b9d2b1511f506a1e188c0c615684d3c86d2d923ce69904e96eafab5e9cae4f00
MD5 79326986971e5fcb54466bfee9db014d
SHA1 24f6a26cfe171fe5c5dd7de7e7751c3ddaa47985
SHA512 524959aceb9592d6b1c551cbf32cc1fe0891cc6fe98138c98df9b5665766e931f1382f48712832e0f5ad296b6d026df6746be0f253bbaec28245c4c37ce8f499
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Network\Network Persistent State
Size 3KB
SHA256 918be9299784f95a8be2a0ebf76b33050e130a4b6f53f046b8bc60b65fa76f8a
MD5 8744db0139d2e1e4bd5816acdf8dfe9e
SHA1 5f8e778554d3a4758a20a26501bfbefb7833874b
SHA512 6a535162fb0ce0449c4ec24fd4548aeec4652636a0ddd0e8ca91b2ec6ccf356a570fa30c116e7ff5d977356d832d7d9544dc03f3c090082f26af5f34538b9657
TLSH
T122719DB382F4496E8E615DF47B18BD1BCE6D0618871C799F85C86F4793D2422E20198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Network\Network Persistent State
Size 3KB
SHA256 07978f70437f74ea0e41b2151f49d98d670a96ac98220d799db5432d0d7aae5a
MD5 d6be80c87b933dc0878eeef113e1da1a
SHA1 5a2b66c6e15c28ec64ed0cd55c35818d69ce4fc6
SHA512 dfc68e74f099470c6d406dd112d5bc19fa853487fe5d843625ba65b67732e96f5712ba3ff8b0c676c8cb1304d809503efb0e820c3a14528b0ced844b0746ce46
TLSH
T121719EB382F4496E8E615DF47B18BD1BCE6D061C871D799F85C86F4793D2422E20198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe594135.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Network\Network Persistent State~RFe594135.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Preferences
Size 7KB
SHA256 a2e848095cf228bd0492a82be912853a704b9609250411ec0df1e5190862d52d
MD5 83905e66a0742dde441ff6a8c5a2a6e4
SHA1 69914db6b6128fbb4d0b5b6ff983d3e89a4c0697
SHA512 98f5b12fbd624b0a6c7d04a3d5d6fff114ef9958285f7db6eb2199e54e4cd1408951e4aab8aabdda93bf737a80c4c4627f832ef948b3b42d6fb54d4a4f84febc
SSDEEP 96:rwC7/6KItLqD1XDyzNkdMe8E0Ri0WEu6bVXCm9IH7/x+WVHMSm+ueY6sMkoXX8vt:rwc6TR6qe8PRp/zdf9IHV+Wiz6sEHguU
TLSH
T16BF1892B6D1169374CDBD52DBA257FA7E6F52031A5C40E48E6FCCB1C05AAADD2307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Preferences
Size 7KB
SHA256 6191f9277f24bea047617e8c0ef72788d8a7bc5b20fc2fe93345384357cdab3d
MD5 b9dfa9995bacd2a6e2d504be96041f34
SHA1 ab5f9847804807b3cf057acab9d74d5e89b0d836
SHA512 081aee766d7074a08b0f237b128d33582bfc39458254c9a7b09d74aeac4464a033ab9ad54506281ede114574563691b4c9fdcede125073c1c9296d19641fc4a3
SSDEEP 96:rwC7/6KItLqD1XDyzNkdMe8E0Ri0WEu6ZXCm9IH7/x+WVHMSm+ueY6sMkoX/8kuG:rwc6TR6qe8PRp/hf9IHV+Wiz6sEv7uG
TLSH
T17FE1872BAD1569374CCBD52DBA257FA7E9F52031A5C40E48A6FCCB1C059EADD2307C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5937fe.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Preferences~RFe5937fe.TMP
Size 7KB
SHA256 ca74e3b7aad7a09f74c19099495779705ea30b6ce81e173d61b72c007104f37d
MD5 c4da441a432cded0ba207905241ce1f6
SHA1 f00a483f6de86929a56164172e1d0714240b1235
SHA512 fa0897c494388729d935f244670fbfdedc6ef42ee992d5f5237abd1273a4a1245beee7049f1f79079b310b7261bc08d1d1d8b7a5b512871dc58e8fd3bf214b15
SSDEEP 96:rwC7/6KItLqD1XDbNkse8E0Ri0WEu6ZXdm9IH7/x+WVHMSm+ueYmo1CXv8kuY7:rwc6Tdse8PRp/hg9IHV+Wizmokf7uG
TLSH
T1BEE1872BAD54A9374CCBD62DBA257FA7D5F52031A6C40E48A7FCCB1C059EADD2307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9dae0a70109a070a774333a3f7bc7efffcfad5a57331c7b65d43ed3024e66096
MD5 c76ddac028386bebf4a0dc317d1d9c81
SHA1 9b4dfd3bc5fc0f904c1c331bd872e4af17a17d5d
SHA512 097ff445bd001058c66706e3e3420ea31d86437b1fbd719d49853e4afb281be6352370720da73a77cb97532250abbd6f7144312293e83a7edd2ff87522193cbf
TLSH
T1D8A002220EC51757D31443B22046169626545A3A76419A2953A0029D8D901584D31145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59674b.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59674b.TMP
Size 48B
SHA256 41e0973ccf66e3f50a3a0b30a48015ee439b693563b579b1d8b5133e68b376f4
MD5 9c55a7a9d909c64045109f03e46ea0e3
SHA1 c133a9b17290805d7d12cc533e1ed77d2d66942e
SHA512 cb870771d3e6d7130f1c32317b04a1a7c73a1d34e6c0670f95ee72668e7f71eda09cbec606ad6586cfdcd4b828c8be1ad30a66aa368defc9a984dc364469c50c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Local State
Size 7KB
SHA256 4b673f33b49d6c8c0c7f831f389d5f80d993758d82f6fdbeabf5f099daf5327b
MD5 940610dae4b211b7b97e01f94716e93d
SHA1 96ab18d57b36ae88ec659afbafd4c6053c05f0cb
SHA512 3ac63e03914db6948f97c7f0ec5bc7f9a637fe56cd6851671f81d7100f0e99b640ba7fd08df9cf7e167ecc23faad3efb1e152df03b166e8a94490f07b55a6c22
SSDEEP 96:DWbJFfR0FTfhRDotoj5yKBBmEG+i9R/Q9QzywbBiKn6Etg/JJtx9WQGQMwNDrN2X:KtwF3DUmrW+EI9QzVLnZtAtx9WQGCNO
TLSH
T134F1C83AE686CD27FCD789C066817687DF9C021489745EC4AFE65D8D098FBEE630181B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Local State
Size 7KB
SHA256 eaa13671ed7a927006f04c68c9dc353d2296f197a85ff5e6aa0ff4b2e6f9c1c5
MD5 2ff279f842c4674f5131838bbb4c85ad
SHA1 5e89dbe750b748db1acdd927fa12c3a9b5260fce
SHA512 57c65a472fdfba5710e273deff12c0659e81be6cc21e80acc4b5cbeb9dc25468bb3c6ab56a27432e6751ad640090cc78459ebcc2d290b286901023dc53ea1aa8
SSDEEP 96:DWbJFfR0FTfhRDotoj5yKBBmEG+i9X/Q9QzywbBiKn6Etg/JJtx9WQGQMwNDrN2X:KtwF3DUmrW+0I9QzVLnZtAtx9WQGCNO
TLSH
T1DAE1D73AE686CD27FCD785C066817687DF9C021489745EC46FE65D8D098FBEE630181B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Local State
Size 1013B
SHA256 bd525820a6c979969269ad26e0915726f44423f90463076891e85666d8c905e5
MD5 7ef31e76cbfe23317998f16538ba266b
SHA1 f273fc5840a1f6ef61b7f2d6c0a88131a44e4ca0
SHA512 790bf3fde5c5d6e3467145c6b876ca859f4086ac659459c697176ef8af5eb19924aa273d30244d30c32f758eef2c33855642fce18bc99bc9cbef4323fa9954c8
TLSH
T11A11C873DE502A72D3A34D247F553B470F301565C1A40FD8A1CE031841E3E0C1325C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Local State
Size 4KB
SHA256 42e3045cf88eb52982cf207a0ae4b2a17ee897d2190804fb7d2a67de19a3a703
MD5 dec28c07138f97b1ebc7a9b3afc85438
SHA1 85a59c0e4ff252d8133b3b989f1565a536c6e2d6
SHA512 d4041c70f17e60f8501e808c4a82d247a42702f8f303c41fa6533ba03436553c380856608eb53c739a8201dfb73aa33e66d0e3ba500b84fb11f94aa33ca97bf9
SSDEEP 96:DWbJFfR0FTfhRDotoj5yKBBmEG+ijEtg/JJtx9WQGQMwNDrN2upa:KtwF3DUmrW+dtAtx9WQGCNO
TLSH
T11E91E936A7D98C334967D98079423E438F7C1555DC64AE88B7DE4E4C069BBDE0342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58ea3c.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\Local State~RFe58ea3c.TMP
Size 846B
SHA256 6b3c450f0c012dbdaa796f98e52e06f2e6813f38d6773ebd8a122d5b11cd5027
MD5 7315f7dbe3ed10e572c04050b7c4eee6
SHA1 2f129270ff3a7ee8cfe3ea57cfa385fc97e197b4
SHA512 a8b0cccd5f422ff193d6b2c796f3dd209b794dac061fa13378cefea9117a80d28fa8fc0e81c9cdd367fb2c8346f6b37830e9e298a298bff61dd77a8108db9358
TLSH
T1FB01CAB3CD502A71E3A208247F553B470E200996C1640F9CF1CD020404F7A1C5321D3A
MD5 SHA1 SHA512 TLSH

Submit Download

list.pb

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\MaskedDomainListPreloaded\2023.7.28.10\list.pb
Size 5KB
SHA256 eaf45560ce1cfe4b7860d5bdb5596665ebd92173a189c906182400d32777c43d
MD5 c0a98f1a5a230e83d9111edfefc9c2aa
SHA1 c1bc8f7415e276d71db24aeb740e12b075907517
SHA512 0edc4b233e354d87e05132072218e73392f96c2a4d12acd8de240faad784dba00f304b386638b38c6e3da3d52979e717fbcb6f94d8948f537e49049f15b90d81
SSDEEP 96:lT9C0Lanfes+gEJ9Ak1d4lC+6xagnCsYqfPwwKx28vaRXG:Bi+7A+NCsYqfOvyRXG
TLSH
T157B173733E44452761FDE61DA84470BE1E3283CA88CCEEE49354AA7B6BC8D4D98C81F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

privacy-sandbox-attestations.dat

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\bb762da438dbc340\PrivacySandboxAttestationsPreloaded\2025.6.16.0\privacy-sandbox-attestations.dat
Size 7KB
SHA256 d5fbb03c2733c6670d21968bd057f315d56640f4e9dc3333f60e0b81fe3920d9
MD5 7e4a457babea8ae2a1bc06c33fc769db
SHA1 abe16daf9d7610f19042daaae3a5ba60100f3ed0
SHA512 f4072490ae4a0697a9e64ec7b8b9a9d3c182f03cc61be76c9ea5b20199f197f0ddd6c772485822c5a68e75958bee63bac529e18095eb0d861425255951e23e97
SSDEEP 192:I+0f6YueVE96ihN65bUgscC3Jl51qiUNUYUBWGupiYlgTVx1yD2Am:R0f6Yud4c65QgXOT1qXNUYYGpLgTf1hn
TLSH
T128F155FF213061144F5101C7B657BACFEA57421C8EEECAE9C7A0D5A622C12B5A9C3399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\D3DCompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\MEIPreload\manifest.json
Size 238B
SHA256 44844cf3dde6e80087ae0e6bf0d9326d7ef7d23326d24ac83af0850be26923d2
MD5 442699c95b20a60470421c6a4d29960f
SHA1 c7317f2d2414c991c21205ba3c68a187b997e3c1
SHA512 c89cf089f7feeb80c6ded11f1fce84287abe8216a6e05723d1a7faf567c501c043cd1246ff8dbee1240d2d79c41b698ef4cc3459589e68e5bfc5bed7fc3a150b
TLSH
T127D0A7633841CD770198AA993D31AC0A73BB3F0B58429C1722B3100D80D5BB6206575F
MD5 SHA1 SHA512 TLSH

Submit Download

preloaded_data.pb

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\MEIPreload\preloaded_data.pb
Size 8KB
SHA256 c6070a157b4e28d16fbccbd233e93846ddb070c85e1a1bc64469b7a5f1424fad
MD5 d5e4c2634eff8a9b3faf432bf406d6d1
SHA1 a691f5c9877079193c1f7dfb16dbc30bb0372ec9
SHA512 b264e28ac8f111df01c553445aadc7bcdb3f32a38a1a19d3f9d458270dfeaf80efa7144407bd999892022af9dde9dbf8a0e19e7212720e1c6511ea9125afb166
SSDEEP 192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
TLSH
T177029EA4A364287B0D3921C74860A75D3BB2EFAED6D67C98CB190B015413D4C3C25F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\PrivacySandboxAttestationsPreloaded\manifest.json
Size 121B
SHA256 300385cfb80f9f3b5b2d186f25b4dbb076471047b5531c0820ffd3482a743b6a
MD5 c660694e3c9f23c0e7d32b8f234a3ec8
SHA1 77c4658572391faa1cdf7a6703460e9dad3381ec
SHA512 0ceecf2e827b6a0a32a70333b0890fbcbc79f7c59944b15ef9446b89f16be95b473a3c8ae50845ec9d180516898d3badf393afbee6ea52224b1784e8e42e9c0a
TLSH
T1DBB012B56D04B2B728C103B50B7683935BF19D576C237D38A7071441217973B7277A1D
MD5 SHA1 SHA512 TLSH

Submit Download

privacy-sandbox-attestations.dat

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat
Size 6KB
SHA256 ec7bb86c6cff06847fa597946fc38375ccc6dd09871f0388acd8583b8088769f
MD5 73b706daa7f90a56249ac27d72b22460
SHA1 475b770a5374678a4678f2f6d6d92aab9df0e679
SHA512 d8c94ee1ea1965803a956e11648d79f5dad85f3a3efbd31bc75828f55b0dca71f2182983ded1f5067998d907f377e2a357def8656a74b4a154043310c4a6f003
SSDEEP 192:F+0we/ueVGHhNtZbCkWgxxaNv/xGg6unJ26YYb:s0we/u5btZGRgxxaNv/ggZ2fYb
TLSH
T11CD156FF213065144F5101C7B24BBECFEA57021C8EDEDAE9C7A0D59622C52B6A9C3395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
Size 2.4MB
SHA256 089abfebea2302c5e31f84c9d9658408f87ee1b647464d2067d706aaba251ed3
MD5 ae279e4010dbffa62c9293b24aa77780
SHA1 4a04933e501a6315c65bfabc7fe46bb94d0a4c6b
SHA512 cee24ea9466c6c0f2a6be977da2a1feaf7da601a9631a300731a50f78ba14c1e10c996dbdd359c603244fe7bad396afdf962929f3a388cbcde134ded39ba9650
SSDEEP 49152:i6r6K9VH5Xa04VmjaMPm5SLIPehx0gxrQRM8y8jwHGgIKlzO2K:KKYR60jRMPGWzK
TLSH
T1FAC56C17B2AA50E9D02ED1B8C7469232F9717C450B3479EF0390BB252E77BE42B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome_100_percent.pak
Size 660KB
SHA256 c08e5a9065d56c734995bdb2ac92e152bd3a2ef777bf76b286541eec203d15b4
MD5 ae59e72e9ccf0f13f49df1c70a7dc985
SHA1 dba44aed170b48e2389e6636f79f3c467b190c87
SHA512 98b8fd0cdbd7abf89339c6fd6e62f5fa625bf74d5297eca68c9cdc3cbb537cffae7c55ed37f0af2897ab70afa0b1d342e215dfae12fc0b834431f0a7b70e5df5
SSDEEP 12288:iI3H1fJljzgsz5B0GDJQrnKs8SNP+QSsSilxNzJ0D+wIivWPKkxuoO0TehEr2:l3VBl7zEEmPLSUNzJ0KwpvWPXuoO0TO5
TLSH
T126E412D773B4EC7DEEAB167B926504B0EC7349281A92010B179EE8796A53748D8CD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome_200_percent.pak
Size 1.0MB
SHA256 4629c33e1ec805c72096906c93d5f4cd8a7da9c66a6856c0d7bd0a5ad03e0336
MD5 e0696b9fac7c6a753817a18e1a7b717e
SHA1 5c6362a6b9fad8df3d209d8ecd044c9c8bcef2b0
SHA512 35ff86a51deafe32f225e0d9e0fc1679d64b78b93d54aa8d99c3d0f4054777b2a765bb1c17f5a19715077f75a78beb089f805bdb1e15452d62140a35c450003a
SSDEEP 24576:C3zB69v5zLmmibkFR8+mZZhQumegvQtCP0KhwvABEbafXa6edhOLoe4:C3m53mNbkFRJmPhQRhQsP0KCvABLajrR
TLSH
T1183512D7E3B4DCBDCD630AB3925A05F0FDB510360AB6100F076AAD79395678899CA6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome_elf.dll
Size 1.4MB
SHA256 20ee07a524b25e6c16986191f3bc5a61a4d91ceceda6b0ca4742bfc25a72d8fd
MD5 d339c9bb3545b4fa11d1441f4a204c23
SHA1 72377e9a0160fd898aba346457129ceec335ff08
SHA512 d5d20c09df8bf0de2ebe1e831f1ed9e5f2f8d26a164923cd47bfb2691a25afd4e2a616dfb15c785bd93bd8f546f04c7c3fb54fbf031be06140311dadc5ef09e8
SSDEEP 24576:d1cIqyWzIxdfQ6x+5uGCFscTjRdiOiffEmxeSItlcS:ncIqyWzIxdrL7FZRdiOQffAzc
TLSH
T16C656C17B29640A8D06ED1B4C7575936FA727C450B20BAFF0390B6292E77BE06B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\dxcompiler.dll
Size 20.3MB
SHA256 1ad75abefadb0c1e9127f9a8c63308d9591e36d875f60fb264b0b3327eaee640
MD5 297f78ef0a7e1b15079bc6f307d24d1d
SHA1 cc8524c3250b8446655422a24bb1b58d5fb59339
SHA512 3056adfb77ab3576495b165bbaf7a4940a24e2990dae7ac364154418aae707237157b0d48aa05ae0505e14a593ee9afb4303a7c2074fcb54ab0255e8086124b8
SSDEEP 393216:W9CDBWwHQrln2ki9ghM26Z2KuQU0/iSIIeWtFqoj68lhSCBJB36YQoufwQCK4wJw:JNsRdMbkL
TLSH
T130273A12268654ADF45AC4B083478963DA6434CB0F39BDFF44D892392F7BBF41B39629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\dxil.dll
Size 1.4MB
SHA256 a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68
MD5 30da04b06e0abec33fecc55db1aa9b95
SHA1 de711585acfe49c510b500328803d3a411a4e515
SHA512 67790874377e308d1448d0e41df9dd353a5f63686df4eb9a8e70a4da449b0c63a5d3655ab38d24b145ad3c57971b1c6793ea6c5ac2257b6eb2e8964a44ab0f08
SSDEEP 24576:+Cfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrt:+Cfhbh3v3mtEAQrW41obCraeRhy9ou6f
TLSH
T18F658D1B629801B5D4BBD178DE578E0BE6B2B41503709BCF12F006A62F2BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\libEGL.dll
Size 520KB
SHA256 4cf555f3789b44bc4fb831d0eb51c7bc9a11a1509a79ac210cb3b0ea7e3a3dd9
MD5 936596178cccb2bdef662ef83f6200fb
SHA1 60430aa94c4461ef1e6c2d2b14d30740db075f8a
SHA512 1e35b2d124217af114f023882d57c086ca3d3fd330225dfd0e03834752e8ae1f794dd734aced48003e4fb30848bc2d524d76acc12b8a6b85a0ce273022d49629
SSDEEP 6144:DMru5W0SIj5FKo+KKEA6e3CpE7xMY/t0lNIc1N0nwIM2eaaZj4A:U/fI7Ko+vE63Ce7xMY0xN0n3MF
TLSH
T13FB47D25B6999BB9E426D174CA134552FB3174821F70BADF03E082792F773F85A3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\libGLESv2.dll
Size 8.3MB
SHA256 d1a7a3b587b4d6c358754aa70a4166a9464bebb0a6c3b20b08ca71692af1ee3e
MD5 e14357fa6d1ee8d5ee9cef79e8415bd0
SHA1 1970dc8094cb98c0c5a7d6d6a28f9d8f6af1f419
SHA512 cb8aeb0e3361996fb1dfd62d1a9a3afc2df60c43ef5c11f88b6117534be34da9549c523980b5039e80a64369fd0b37459e507ac29a071c3bbc30a505b9878e34
SSDEEP 196608:JL/ydVV3+rNHzuJA3FdA5R5Sx7MgmNwmD:JL/ydVV3+rNHzuJA3FdCR5Sx7MgmD
TLSH
T19D965A03F29680DDC019E1B88757A226F731788907347ADF279497292F77BE0A73AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\locales\en-US.pak
Size 478KB
SHA256 2c5f8d8b53972f0d9f8935339d563d815fa2362d156c0824a3e0bf014267ba4b
MD5 bb412b5c0eb3021c1e0be2b725dd4fa5
SHA1 e63bb90c6c747df2fc55a21ef7ae74ef0b6a7921
SHA512 431d3a3fbda0b357e772d1b13292a590919294cf549d92f3f9b911aafa0aad2537ce3d22b37000190113e988af3a8f8117dfd00f4bb9ebaf868a10b88417a174
SSDEEP 6144:m/qoMkbhamyJf5dJhBMP9eBQgDJfaY1se95g+xkngdH/xF+wB:wMk16fbBMkQgDJ/55x3+wB
TLSH
T10EA44B1FF744126A069352A27F0995B2BF32D06CA36112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\resources.pak
Size 9.6MB
SHA256 3573d8ea4f51e7afeb3f02da2cd2e7079c88487bfe91cd8c4f5690de34325919
MD5 9cfb3304873b07923a26008bf12255b2
SHA1 d10ca85990d69cb420ec93b452659fc679628af9
SHA512 f05691978e73be2bb39485f9b089f0d461d87047181e33d0e6e52ddc8341f56184ed0e3f2b5a7ea937425bbd570cdb072f4697c2f74887508b056adae4aa8b4c
SSDEEP 196608:QeyiEFrbGpD0EwEwRLn1gG1wPqK4fkrP5rJN5laMySqLpR3:QeyiEFrW0Ln6PdMkrP5rn5QM4pt
TLSH
T1D4A633E3759D6C7FDC88437A41CC84BE137D21AA1651B9A6100CBB6DFA212495FC827F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\v8_context_snapshot.bin
Size 648KB
SHA256 d130ad63b7f92fa8c79e7983de05de66fa3106c7adfb1b4ccbd1984f94ff74dc
MD5 bb45bf12b3f984e67b7f91918a8f6d4d
SHA1 ea0d3404b1146b0e75ea6166f5981fd13f0e5fc1
SHA512 6b84e90759727a0ed7f3be45d665b5285179f50e015a551dc203fbe7718261bf7df36d92f748d7035a1d97e808f8b99d6ac638fa4551c0f799665150670c84b7
SSDEEP 6144:iBaCPhFiw3TawqezYbz8bkSHGWDgqcAc9WjSvwSrHDZgx9iqOblE7FkojA8hoHk:gaCPXiwTkGGWDAfFjVeVObUFkX8hoHk
TLSH
T12AE484A2B784DF56E2E95EB09EFED6A23674F18E9E0A515B3107232D353D3242F4424C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\vk_swiftshader.dll
Size 5.3MB
SHA256 8778d3406ae70efe5cc54c9375a98cc7e5b03a38adc3f1aa6d7e007ae8076a3c
MD5 ef56eca347d99d712883974e6a6ab443
SHA1 d7ba934a3deadecdecea2a75342a8bd2ca6e37a8
SHA512 d4b4b81fa2384fe03e3c006e90a9d90dbfea1155462f6ae2da875e72f6b6bcdfe8996dd92a4053fb8cf4aa74bf309b3d4822659e3327fffe1ccb8b33633f5c92
SSDEEP 49152:9/Z5yatXkVpvq+hPB8IQ3OyszrnB/hjR+cOB2N/Pq8JyqSUtEtyaEfzD99+WyaMo:kkKfNBkqntbMgP5FuV
TLSH
T159463A43B25291D9E00DD179835B9633F231BC881B727AEF4AA44F252E37BE06739B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\vulkan-1.dll
Size 914KB
SHA256 8cfdbcd4a90fea5893c0ca144dbaf6c5d8f5ed0dc84a93c6ec40ba822dea8abb
MD5 e84050828d8cb51552fdf81c904f1112
SHA1 a53135639dfc2e16b013615c1f2229a1c4cc4eaa
SHA512 01c8a10897fb25cb96a4d0a7fa13ef393f74ecd71d875860c04e9d889ba856fd0103ae1d7702c19588f37c798421dee2d08c79e5019abcad9536131bc59abfe2
SSDEEP 24576:YtvYt/pajevU8ulbVZQTTP2Kw6Z5W1DYsHq6g3P0zAk7Gch:YtvQgjevUFlbVZQ/2Kw6Z5W1DYsHq6gx
TLSH
T161157D22E555856AD976C034E9828703DA7174822322F9DF02E897187F6BFF47B3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads