d7909629d2732ec6931346f557cc39407a092c7173ee773bdd6e2264fd6c1da5

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/08/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWorm 7.4.zip
Size 72.1MB
Sample260830-29pmssdg87
SHA256 d7909629d2732ec6931346f557cc39407a092c7173ee773bdd6e2264fd6c1da5
MD5 66ac7a169475d98712fdb9235ef07309
SHA1 d8fff891f9adbe4011040af7ba8b4e4f8a425a5e
SHA512 021d20a068d4e8dde0fdf66fca66ff163584f95ec679d4e173568da1c25e3985a55c58ceb13e656df720d42efe84504dd25d7a1e5bcb96176c930b18cb0b3bb1
SSDEEP 1572864:/W41gqym7U6yGVTWRI/61oHoJJWiYy5grcjgrSkD9/U1K7mNuWnMqp:Okgqym2GcR46YoJJIy5gcjgrSa9/jCEy
TLSH
T167F7333D49B07A95E832BD39575E5EBFD2094C9C6B04B0DC2A4CD0EC786C7297EA910E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1904	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326055490518596"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 5080	3652	chrome.exe	86
PID 3652 wrote to memory of 3468	3652	chrome.exe	87
PID 3652 wrote to memory of 3468	3652	chrome.exe	87
PID 3652 wrote to memory of 1904	3652	chrome.exe	88
PID 3652 wrote to memory of 3940	3652	chrome.exe	89
PID 3652 wrote to memory of 3940	3652	chrome.exe	89
PID 3652 wrote to memory of 3784	3652	chrome.exe	91
PID 3652 wrote to memory of 3784	3652	chrome.exe	91
PID 3652 wrote to memory of 1696	3652	chrome.exe	92
PID 3652 wrote to memory of 1696	3652	chrome.exe	92
PID 3652 wrote to memory of 396	3652	chrome.exe	94
PID 3652 wrote to memory of 396	3652	chrome.exe	94
PID 3652 wrote to memory of 3168	3652	chrome.exe	95
PID 3652 wrote to memory of 3168	3652	chrome.exe	95
PID 3652 wrote to memory of 1292	3652	chrome.exe	96
PID 3652 wrote to memory of 4360	3652	chrome.exe	98
PID 3652 wrote to memory of 4556	3652	chrome.exe	99
PID 3652 wrote to memory of 776	3652	chrome.exe	100

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\XWorm 7.4.zip"
1⤵
PID:3576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2187c728,0x7ffa2187c734,0x7ffa2187c740
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,9279985576716246992,443227059495679489,262144 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,6950621125612865413,6908598037343979311,524288 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,9067763581265666310,10710644457730918105,524288 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,14169152935046122512,3265040710181609276,2097152 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,14232902787276006412,15193322576312359944,2097152 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,3240103365097370806,6597783353992762085,2097152 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,14964120087948011655,12074848905508889937,2097152 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,6126526942552451348,4678750693669938311,524288 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,12078912443376087294,6648216026613902262,524288 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,625708521361676649,2590631118519037727,524288 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,2406243693538925041,18297911477621253157,524288 --field-trial-handle=1948,i,13099322827952027043,16143134674476685196,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25e39bad-7c13-4679-a761-58d1d9c498e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\25e39bad-7c13-4679-a761-58d1d9c498e4.tmp
Size 414B
SHA256 be055605637d28973f9159d9efc14b92228a3d37b918467079331a6e4a40bb72
MD5 510c0daf04578f19380dff5c5ff5393d
SHA1 cc536c5ee19e6ee32fc3422a2e88c92ee7ff0e82
SHA512 f16f448c865b375d3088b413add1c3b056322cb097b9bf7110abbdb61de207c8969b399d648b035d20a8d7a052c7191cb841a75a8281d6d2cf040a35dcd976b8
TLSH
T17CE02BA9CC60AC7B08FE075C61540683F611032B3A404D5F363C850D8FB077F418685C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6f6fbb184952795b6692321dd546757a30229ec94a616168977f1d7854bf1d39
MD5 e9cb9a9cd42a6460f7c87de3690816bf
SHA1 c2480da12e937fe4e56b8b32107cac1380a94d97
SHA512 dfacf4912118d0a08d67b9ad9bc4053ba31f3dc5e01e8cfa1bf300da5f91c66defeb3dd43df2fdb35a0f67643f23f3fbdab06d7de8437143e26a86b79b8c1c7f
SSDEEP 192:dRLVaaPAiv6jUgv7+hAPRp279uHsb+WNniQ0vH26niJkwuelVyIsnAUgraJ:dRLVHyo868XkUwl0f26nQDTe
TLSH
T1C642D66EAA50753B9CDBD31AF9217B53E7F5112221841E84FAFC8A2C19E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3f68f972091286296c2da995267bf16f8a560935e3cb8503f80247c23fb39cc2
MD5 886267770eb83b62e28c1496cb1b133a
SHA1 60918e26a6e5e41b78e3cd23e6d95eac6d8f6c5e
SHA512 690fb372aa77f3d716b6e20b1f861f7b0dd6f8aab8637a522609ca9ed5bbb66728dc7f6099b40d24111428a9a69ee866a2ee90db43a334b0af3ba70b23a868ac
SSDEEP 192:dRLVaaPAiv6jUCv7+hAPRp279uHsb+WNniQ0UH26niJkwFelVyIsnAUgtaJ:dRLVHyoO68XkUwl0W26nQ0T8
TLSH
T14D42D62EAE50753B5CDBC32AF9217B53E7F5112221851E84FAFC892C19E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 911ed1ba919186860989d929f1f692eff765bccc9a04daac4aaa4bda98261d02
MD5 d89e3be75e7760fe0ff1af343223fbee
SHA1 d7f2ed4d48aae2eaf86a13aa837f2e934202ff92
SHA512 b833a795d53725b8ba2b27639d2e4f4b05569a077114f99f029ff74e403f03e0c7d3809bd585cc4f15c5b3363b3ca46cd5b4d50e8f0242fa8f107f639d698a1c
TLSH
T1E5B0128184417102C0030BF4114735887154DF10D60A170343E069728C3565194152E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c0c6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c0c6.TMP
Size 96B
SHA256 f5f1cd8033f1c5a5573301ae1b8225073186b2159b03d5c9f2013faa2c2f6ee4
MD5 e80f626ce7928a62a9527bb0c6352363
SHA1 db528c9903f5585cc364f8e018847374bf0b08fa
SHA512 0ca0b2feb9ff59a5405cb61e90e5e5da458f1c28974fbede56a6c90a4cd05aa50e943e362eb8f10475ebe822a95375f3f2125499f66c8c702caeee5d7b370b0b
TLSH
T1A4B02282C203B202C00303B0E88A80CCB020CF22C2032302C2E02F33EC38F208A28230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 a6f4a4743ccae832244d9def93d93f43c16d860122edabd49c113e4d037d90e7
MD5 96c8dcc03c86507e2b40eb1515ad682c
SHA1 e12f9a7688d223b0d21947954a5f26507a46c294
SHA512 d7d7580a9ee05a8efa5530bf8c561793d2adcc61a7fbd92e309d89cb608f8bc7e2c912a4e07d39a8f2b68d479addf01e04e6257f1090754627b6d4995f20653f
SSDEEP 3072:btMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgI8uwLcXcgVXruSixWgL0rF6jh9JDvee:o0mAIpUNVS6OwCcmXKegIh6jh9Jvexhm
TLSH
T13D34127A6CA33D3A25DE7EF3B8423764406346E19808B15C84D5AF4B6DCFEA5241BC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 1f3d082cc0bc8a175694ac343444aa7130a1ebe2f7b84d5d3eb9c51d29bc1a9f
MD5 f67437bcbbeb6da937dd17498335777d
SHA1 0d6d21a73b8931c957b116354abb7ca539d6b838
SHA512 027051465b9dee4751c43d699c3503534cd08f7f4559982ca758a2125e75ea3df973ad0a7ddaf7d83c37400e59753d48a43beb6d14452138c51b738916e5b89d
SSDEEP 3072:otMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgI8uwLcXcgVXruSixWgL0rF6jh9JDvee:p0mAIpUNVS6OwCcmXKegIh6jh9Jvexhm
TLSH
T1E034127A6CA33D3A25DE7EF3B8423764406346E1A808B15C84D5AF4B6DCFEA5241BC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2d0458e838d9a24a36bd6561474adecc93134cf3d26f1b64eea42f9c23f2dd49
MD5 417a0d1e6d22d6b593993513881f5eb0
SHA1 a90b8a91fe2dae66f667a393b8b6cf737d79af9f
SHA512 81d526de2a73bd7ff412a17ff01d2c5c52fe1683caec96233efa95d3bf6818f2d405727c590459da1c09f047b3d235f867e4c7b79c65216725a90553ef6ed689
SSDEEP 3072:n8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:xwCcmXKegIh6jh9JvexhQ
TLSH
T129B3125A29273DA68CBD6EB3B453338286A353A26C05F14E90CCDF0A45DDDB415EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download