943fd1ea44266c5d7fa02f2b292db095a4e6ba8027a1f6c73fd60d1165e63aff

Resubmissions

05/08/2026, 01:46

260805-b62j3swbjg8

04/08/2026, 06:37

04/08/2026, 06:31

03/08/2026, 13:01

03/08/2026, 12:56

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Desktop Goose v0.31/DesktopGoose v0.31/GooseDesktop.exe
Size 221KB
Sample260804-hakp1sed69
SHA256 943fd1ea44266c5d7fa02f2b292db095a4e6ba8027a1f6c73fd60d1165e63aff
MD5 c883e2c769ebe56240a71260b17f1b93
SHA1 4a831d4f48f6ea81db508c2a87cf860acd17edb1
SHA512 dae40d442794152285ce484b10095d11592a39cb1968bd38cc70ee23005bd1e04ad4312d7266107bdd375e10fa91ab9fd3d41d4d6ccd2268d052b343528c4376
SSDEEP 3072:gzebbi+ndU/n6u4WhGINz6tFvaxWt5H3ANdl3Mn4bqwyW13B26wqIl9nNwo3WdZj:gzQU/n6unYCW74bqwye3ijlDwocZ
TLSH
T16524BF82E59A4B72CDBE8A3BC87326015A3178AFDD26C79904CCD52C34C35C44E627BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooseDesktop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2196	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302987630671493"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4032	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
2100	GooseDesktop.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE
4032	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4912	4776	chrome.exe	96
PID 4776 wrote to memory of 2196	4776	chrome.exe	97
PID 4776 wrote to memory of 4216	4776	chrome.exe	98
PID 4776 wrote to memory of 4216	4776	chrome.exe	98
PID 4776 wrote to memory of 556	4776	chrome.exe	99
PID 4776 wrote to memory of 556	4776	chrome.exe	99
PID 4776 wrote to memory of 4724	4776	chrome.exe	101
PID 4776 wrote to memory of 4724	4776	chrome.exe	101
PID 4776 wrote to memory of 1640	4776	chrome.exe	102
PID 4776 wrote to memory of 1640	4776	chrome.exe	102
PID 4776 wrote to memory of 4400	4776	chrome.exe	103
PID 4776 wrote to memory of 4400	4776	chrome.exe	103
PID 4776 wrote to memory of 2008	4776	chrome.exe	104
PID 4776 wrote to memory of 2168	4776	chrome.exe	106
PID 4776 wrote to memory of 2168	4776	chrome.exe	106
PID 4776 wrote to memory of 4972	4776	chrome.exe	108
PID 4776 wrote to memory of 3260	4776	chrome.exe	109
PID 4776 wrote to memory of 5076	4776	chrome.exe	110

C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\GooseDesktop.exe
"C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\GooseDesktop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x150
1⤵
PID:1340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd32dbc728,0x7ffd32dbc734,0x7ffd32dbc740
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,13589449084130603725,7895633214048137857,524288 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,12434277729697749743,7929796655174567159,262144 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1604 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,12720113421785913604,3727392814596018889,524288 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,15494045866128664635,12386572501065890889,2097152 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,17581287644675398563,3538565024518569057,2097152 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3988,i,985616535603615928,15335516935176932354,2097152 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,5907171329233131533,9830723613346093016,524288 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5896,i,10137132037709752957,11118855597945462819,2097152 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,12101703385999560201,8732072802570703901,524288 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4020,i,11184602298887603354,7182390900582607914,524288 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,16015449070950490357,1286013391231759433,524288 --field-trial-handle=1992,i,8344046517831324669,2807167699275241123,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1616

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\UseSplit.xlt"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f44d9ec6b5c1548662fb6afb4361759eae8860f2b549bcc992f6ad50aad53885
MD5 47d1d2c40e51fac3902a5dc77a2d3e98
SHA1 55636a6dfd6a93ff162dab80bc9fafbf46b63fde
SHA512 a733a276b270a77b32eaed3f5b7acaaad466de1a279d5ff5020f2dad062b39f997a08893a879daf56967b014c3a9ee4695cedf54a74307d6d3c7d9f90ef9b2f5
TLSH
T112E02BBAD931AC2B1CF90B6C60400B46E651139B3B80C95F363CD109CFF4A3A4245D1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 ba07d42391d3847deba1be9d9b7bcb8f01039700c75e5f7b0f67166a4f6f7fa7
MD5 268282b7f71532c7df3609a48a787817
SHA1 e59f2a8a5050eaadd57c8557b537523f2fb788f1
SHA512 c0bf4af9c07063323b721d29ff61a88f0acbe7b3ccc97d933bedf57d96c28bf8825b1d70d34e7bb8d90f95d620a3e8e1430250f08c6563483ba91b820f73e5d0
TLSH
T103C092284044005AEB5C85B331B24243F1B33D260A92E9DAA08000CD8C237E6023641A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 03bb259ec5e539e4a3bf5b43b95980703e7d89b1276d9736e4b1ea0c0e717d61
MD5 ddc86c015b25a71d6997614d0aef4afc
SHA1 c3777f7ced90555d97e90edf06f6d8954201e868
SHA512 9a7218c2f564c15230dadb277cea80101a03434f3ce9a42a999bf563db0ad2034755fe40f61c54db6d0bf4f49d5aa8c569a5cba223690fbf3b7118815109137f
SSDEEP 3:MsEllllkEthXllkl2zEklUsy:/M/xT02znUs
TLSH
T1944404047FC0CF05C50030344031C3504370D4150555D74334750413DCC5F400C50045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 268bde9907f94d989d7fe9990cfa3e7580a75f68cecbac1478f312da45bdd7a7
MD5 2fdfdea3babe72829e3017ae6b2faf2a
SHA1 5722bd5efb3e6c65f5527a45ecbb13b3613f1aa7
SHA512 f0b39c54394d8832b127c0ffc45f0f5dc7b98cdfa3d01ade60ec7dd559563c49003dbcbb4e6f304d594872960d39bc6c954c7d2c201b35f68428b3f0b5020d6f
TLSH
T1F86179F7C7D4D67DC91156F49B216E1FCE2E0A28522C3C2688D8AE5B93E2472D21534E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e05488c94d79bf40bb84cb00dfd7bcc7f31a73d4d6bd6f857101cd092b7a73fc
MD5 015d60a78bfcb43e6b02ed760aea7591
SHA1 82b5c25f798b0877147cc2bf9cba06a077d2d0d9
SHA512 54d7c0bcf5be24f080017288ed735c3688c372bcac0eb9c3c8dcbc80b855479cb83e88ca725c3e842e9343b900022b03d01addde063607d18c762d3a1fe51223
TLSH
T108F059AB9B7EB023517E55BB1E01BC09A5B6B430128568E0DF6A41EDE0910F32F12447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 36c78013342115b5a7e19df5518d0090a37403bb7dc0af860b4536a541403dea
MD5 090b53f6d7d62084c52e1d51afd92085
SHA1 96a1a50d8b6a86c469aa7d7b620ca72f089fff50
SHA512 96c17b372672784e908e51dd9c14583bc6b81665254f048a837fe38bdfecefe66629b407346deac2373f285234e6a99a91a8d4dcde483b49dd933ed1cb2df217
SSDEEP 192:5R0UxsDv78pAPRp2Z5J9DHsb+WNn1z4xv2K12KXvaEjVyIsnAUgtaJ:5R0U+74UXY5wRC262Wa68
TLSH
T11842E72EB910693B6CDBC32AFD657B57D3F6102161952E94EAFC892C05DB9CC322710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 90ab65fdfd3985a82b58a5b63ebe4d3a07a12741720763e698e9a2a65e7d0eca
MD5 fe5361b737c8916b6fea79847506bff2
SHA1 da0441a6ca91dc3bea049eb5d788fcfae3123016
SHA512 4c3483c7eac1f99ec1e5a2b9e006d0d05ef0dd8332699f0a343e9f28ac8d4a5028e96dc513825860ec4d3ada326f1c4a738c61c593b1c41a4ce218b9a8f1f3cd
SSDEEP 6144:doDKf9E9dD6zEYdO44Erpm7Rkm1tYpBeh2BAoh:dmT9kz7O44Erg9oBGcAoh
TLSH
T14B3423365CB06EF319EA636AF49F210E2EB09ED7C516CAA9C4C097007692EDD3C46C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f255ff5e3c59f12221b828def394976157deb1ed2276b340a69ff83132982f0c
MD5 58da06179459b36b11171d4d4cfcc420
SHA1 a35c8d66dfa38b2e2248d2c2da22aa057ca4ef82
SHA512 d3c34964569eaf51d60d61f27939d7f7118a3a1c9c6420f21f4d77a33839f5b713967161afb9a57719fbb79c6dad1e5201cdf891457f8a9946497eef6f1cf1e0
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:qm7Rkm1tYpBeh2BAoO
TLSH
T13CC3123B5D65E9375D79A71EB48E0B1E1EF24DA6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 29fc1830cee009486adfe76c0eebc22e658ac5a14836cacd2043ecf380528575
MD5 8d0b1c11cb247937eb3a12f92b316654
SHA1 1b4694bb6cd645cfb9ef46f8cac7eba851ebf867
SHA512 def5a630f6a5a1ed5e45a078abaf7bf7302198ffcf0f33f486dccc3a79bd8207725a5bbd9f15eb4207eb9d724c65cb93d2c172b8dbb44153259155f0d58c2894
SSDEEP 6144:ToDKf9E9dD6zEYdO44Erpm7Rkm1tYpBeh2BAoh:TmT9kz7O44Erg9oBGcAoh
TLSH
T1E63423365CB06EF319EA636AF49F210E2EB09ED7C516DAA9C4C097007692EDD3C46C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b48305295320108049661b9d8741d701658a7f64861548a75bedc494e048bf51
MD5 d13b50cb535834e2fd9ca833fedb7809
SHA1 1c22ff5c6225d0c85c03ba5da55a2ed3ae2ca273
SHA512 505ed108f114fa8f28f2df245df64653d1daa1fa1caa0aa09ae6c7f9e4d5647098d9f60541ce6da659073bca5d82c4872275b042cda830327b7dcd81cc602c6c
SSDEEP 6144:SoDKf9E9dD6zEYdO44Erpm7Rkm1tYpBeh2BAoh:SmT9kz7O44Erg9oBGcAoh
TLSH
T1DE3423365CB06EF319EA536AF49F220E2EB09ED7C516DAA9C4C097007692EDD3C46C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2100-25-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-6-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-11-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-13-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-14-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-15-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-16-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-18-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-19-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-24-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-23-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-22-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-21-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-20-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-17-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-10-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-26-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-29-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-30-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-33-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-9-0x0000000070979000-0x000000007097A000-memory.dmp

Download

memory/2100-8-0x0000000007DB0000-0x0000000007DC0000-memory.dmp

Download

memory/2100-7-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-12-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-5-0x0000000005150000-0x000000000515A000-memory.dmp

Download

memory/2100-31-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2100-32-0x00000000708B0000-0x0000000070984000-memory.dmp

Download

memory/2100-27-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-28-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-34-0x0000000070979000-0x000000007097A000-memory.dmp

Download

memory/2100-131-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-132-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-133-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-134-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-135-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/2100-4-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Download

memory/2100-3-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2100-2-0x00000000053D0000-0x0000000005974000-memory.dmp

Download

memory/2100-1-0x0000000004D80000-0x0000000004E12000-memory.dmp

Download

memory/2100-0-0x0000000000330000-0x000000000036E000-memory.dmp

Download

memory/4032-239-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/4032-240-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/4032-241-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/4032-242-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/4032-238-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/4032-243-0x00007FFD0E0A0000-0x00007FFD0E0B0000-memory.dmp

Download

memory/4032-244-0x00007FFD0E0A0000-0x00007FFD0E0B0000-memory.dmp

Download