0f058f66e58e1cd18e60cb6a66f0eda5b85de0ad7950f20bfe36e4261b98b411

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
obfffffmach0000.exe
Size 2.8MB
Sample260924-dpr1esysc1
SHA256 0f058f66e58e1cd18e60cb6a66f0eda5b85de0ad7950f20bfe36e4261b98b411
MD5 7af420cbe052a5955acba49535afb76f
SHA1 ee1d3603676e08ec0649cbacc005ecc28843c68b
SHA512 fcfa2ca7f364a9bc1bc121f4b559368699a4b751e6c40f5cba6762368dbe4d61d9eeec4188ba68d4f8c841a4876266ba3cba5e68062e24b512ca9012adb4652c
SSDEEP 49152:H1ODYAaXvbHFcpSUxRaDWaWifZE0wqaT4wxoWSf8zWWgNy6hdG879HTY:IkAaXpcpSUzaDWap60w9KG6NjHTY
TLSH
T100D533870E86912FEC9E6D3D08A86B572E488F5BA7575D88BAFF00C40105F8DEF659D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	obfffffmach0000.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	obfffffmach0000.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	obfffffmach0000.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2212-0-0x00007FF6064A0000-0x00007FF606C2C000-memory.dmp	themida
behavioral1/memory/2212-1-0x00007FF6064A0000-0x00007FF606C2C000-memory.dmp	themida
behavioral1/memory/2212-48-0x00007FF6064A0000-0x00007FF606C2C000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	obfffffmach0000.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2212	obfffffmach0000.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3516	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346930935160777"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
1532	chrome.exe
1532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe
Token: SeShutdownPrivilege	4812	chrome.exe
Token: SeCreatePagefilePrivilege	4812	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe
4812	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4564	4812	chrome.exe	95
PID 4812 wrote to memory of 3516	4812	chrome.exe	99
PID 4812 wrote to memory of 3748	4812	chrome.exe	100
PID 4812 wrote to memory of 3748	4812	chrome.exe	100
PID 4812 wrote to memory of 1072	4812	chrome.exe	101
PID 4812 wrote to memory of 1072	4812	chrome.exe	101
PID 4812 wrote to memory of 2016	4812	chrome.exe	103
PID 4812 wrote to memory of 3316	4812	chrome.exe	102
PID 4812 wrote to memory of 2016	4812	chrome.exe	103
PID 4812 wrote to memory of 3316	4812	chrome.exe	102
PID 4812 wrote to memory of 4228	4812	chrome.exe	104
PID 4812 wrote to memory of 4228	4812	chrome.exe	104
PID 4812 wrote to memory of 3348	4812	chrome.exe	105
PID 4812 wrote to memory of 3348	4812	chrome.exe	105
PID 4812 wrote to memory of 544	4812	chrome.exe	113
PID 4812 wrote to memory of 4444	4812	chrome.exe	118
PID 4812 wrote to memory of 4360	4812	chrome.exe	119
PID 4812 wrote to memory of 116	4812	chrome.exe	120
PID 4812 wrote to memory of 1532	4812	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\obfffffmach0000.exe
"C:\Users\Admin\AppData\Local\Temp\obfffffmach0000.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb5972c728,0x7ffb5972c734,0x7ffb5972c740
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13926238775343536733,14087549178594013906,524288 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,12643658988869238713,6628735198004287411,262144 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,15718904247771645336,6085745928738921379,524288 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,1796459632203364356,12155228038971649515,2097152 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,16802311785726602713,11842008572788289916,2097152 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,3775148455227252877,3102034983629331623,2097152 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4524,i,1385515447364811011,2357935206091814596,2097152 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,6664657368145383310,925275059371144953,524288 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,18230233003823266503,15887002163210571502,524288 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,11798556849970471374,17962721582965172348,524288 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,2238881508246643976,10686646974768825562,524288 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5788,i,8399793188713860730,13180923107820406120,262144 --field-trial-handle=2120,i,13230160525863464246,11189517775479522945,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2328

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 168f70e4094d9426ec802454d06588558133a363db9b03c265711e20743263fc
MD5 a5f5fb94340e86a34d02d0384f9e654c
SHA1 fcea581a2456a16fc31bb78eb8c05e332bd4e4b3
SHA512 33e5d592249170eb69dae30eb81ab8c541b61161332b1c23556066a658001bf3896cee0807f47ef567901a5f2a325dcd6dc1549dd1f2eaf58acf5714ac9f6bec
TLSH
T16AF02DB9DC21BC3B18FD1B6A60A40B4AFB5113672741894B773D820D4FB053B464691C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 beb5dbafbea5cd7c99c352144c7e8defdbd071a79ed977e7d86dbac0ad77aad5
MD5 85a57eebfd20d9b7a41ae73c1cc09c15
SHA1 dea337800686097bc663310b3768b66db8df3709
SHA512 1a49d94aa5313ce2451d501f884919426100241b4b7162df18f030fd5e717fa47c6852d73e306a38f46c745583239e262bac4433763a834adc56e2ac463209d0
TLSH
T114619BF7C7D8866DC80196F49B217E2FCE3D0A58532C3C5688D8AE4B53E29B2D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 17c6bddde32affb9082280a0b95480eb44087d840c653a49f8b3ec5616166f26
MD5 1671883c6d061f1ee143a6a230c1e625
SHA1 a4d5252b3b8feeeb94bcf3532285e88140f9910b
SHA512 320ba9f78d36c68e9dd8fce982411afc0168546cf2172815cb6251bd5cc7459b422f151af00eec48b45dd4d44f49514eb8d312a3c41d3f68bf825d7e3a7fcd8c
SSDEEP 192:WRQKFFufGg37aepv7VJpAPRp2B9fHsb+WNnlz0cNzb2fe4ZyDVyIsnAUgtaJ:WRQK3QBZpvUXGhw90cF2ql8
TLSH
T1DD42922DBE10753B5CDBD71AFA657A63D7F6102221942E84EAF8C93D11E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 40ae9e03f0f00d8b2b98c5e1a9818c2d52abf6e70aa45defa88b1a192ea8ee69
MD5 6dc736b7c563874644835b211ae2a978
SHA1 7c1ac26683378bc23fc5fd9b6c176416263520a9
SHA512 dbe90ef9be20e8ef0510a55bd12d863880ac6a494c9347816470f56cf0beeaf5450482e342fc8c29566caf5ee008d4848475d923cacbb632e8789a77418a7842
SSDEEP 192:WRQKFFufGg37aezv7VJpAPRp2B9fHsb+WNnlz0cYzb2fe4Z+DVyIsnAUgraJ:WRQK3QBZLvUXGhw90cK2Wle
TLSH
T12742932DBE10753BACDBD71AFA257A63E7F6102221942E84E6F8C93D11E75CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0d9cc92e4a485c65497ae1f486f381b78b2427b11790f55f14161175faa9d66c
MD5 f2b270bd17c2d50bd9fe43f3091d10c1
SHA1 ca473c24613b776e27072c8cb0066f772ec3f0dc
SHA512 3fd5d6c7a90aeec71358e1dab136c574ad1a782435012bbc5e182fc2455bd67473784f6e94d737cd96a4310b4a36ddc4aaa0594baecc5b3b95ef0551127d28d0
SSDEEP 192:WRQKFFufGg37aemv7VJpaPRp0B9fHsb+WNnlz0cSzb2fe4ZiDVyIsnAUgraJ:WRQK3QBZSv6XYhw90cU2Kle
TLSH
T1F742922DBD10753BACDBD71AF9657B62E7F5102221902E84E6F8CA3D21EB9CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b5cfbf151232352540f3bca6b16065fd4643d80db2cff3a14eaf90e5637c38e3
MD5 da156159ca7af8ef056178eed46c6964
SHA1 52e37e31e46668347a357596b228c682cf664396
SHA512 c6c39d6104d55c271e7c252e276e5ae4d98742294b65086bf932a0f50558ccafc09c03cb719e17024ad5600b8b3548ab024497643a9622505b8bec80cecc6106
TLSH
T1C9B0120480429316C08A02F012A414887164DF68B706170251F01D06C835161811F054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5945aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5945aa.TMP
Size 96B
SHA256 c9f68f187865602c935393c6d3311964abcb074e376e4d4cd71566e9b038bae3
MD5 0072dfdec8962ce669c48474ff0f1767
SHA1 77e3fdb99498a8aa1c770d34adf4c82a43a7f14b
SHA512 c6b16216be789b5bc55a4dbbaa0b250fd079cbce1320930dd1eadee73f91320642177c6cbeea00e6e02b4c27a50379997453698baf3926823d60d978f4ae89c7
TLSH
T1EEB02200C002E202C08203F02280ACC8B0A0CF2AC3030A02E2E00A33CC20330003A0B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 fbaa9d331e123ecbbadede9febc09042951eb4ecfa19cdf80e1fdac28cc43752
MD5 3cf58aae527f699a18d370e5f21c2049
SHA1 65e03b81823e79e54fc9d7143873d5e77e111771
SHA512 5db2d0796a06bd5b818f6197e7ea36e4064c9a4e15921167049212bdbbefe1aa85b6cddd075a1a0bddc4c1e15c1584b37612886a2903692881d4bb51f3968589
SSDEEP 6144:a7z+6Sb0mt8VJJT6qU/AXGUUQF+hFD+7t56OD9ZfSApprR:kzcVyX6RAnyFSXD9ZfS4n
TLSH
T15E442333BEC99D77ECFC25859102A5505DF45FFD82CCAA0844A66BC9B28FA980773913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 98559d74ed0d956106ffbdab3391ff1c3ba162ed19f95c54d278fcaee10825b2
MD5 5b7fb490a92d12b8e793716be0e7ee4f
SHA1 673f5aa52b8e88a9f46b8349efef3b2e257811e1
SHA512 777015315ae142aa4b76a52bd32c2c42a98278c11cdde833f9c05b5bd62b42ce6db6fdaff721255b5ff3939322f01ff81492095e48d16435ca8fa35f00ad57d8
SSDEEP 3072:wJf+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wd+hFD+7t56OD9ZfSAppr3
TLSH
T1DCD31232AA94C8BBC9BD6541F157A300DE626CED45DE7A09444A9F8EE09FC5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 eb1a8156543b3fefdf4ba36af7239c8aca38c598152e6564b209303346190975
MD5 0e23dcb4840c56b7bb6a8246416aa094
SHA1 f1e08e44b27aff8c2ef335c37cf6011225b0bc05
SHA512 5e554db767f3916ca4d9cf36cb71bf9e6c1ac9af01c4f390ffc47d1210c63fd00564b154dc23d3887051432b84f4bf13a8510226acbee2f3e646429e9ad44ded
SSDEEP 6144:lR+6Sb0mt8VJJT6qU/AXGUUQF+hFD+7t56OD9ZfSApprR:fzcVyX6RAnyFSXD9ZfS4n
TLSH
T15D442333BEDDDD77ECBC2581911395905DB45DFC42CCB61844A2ABCAB28FA980772A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 7478f8106d73c9f1179a5f02a821be7e4169e61535e0fd52c11ee4b5aa9a83db
MD5 709f9491ca5906c8a899cf5be59893f0
SHA1 175fd03e74eb2ece0ef8255435703838acef03ff
SHA512 12eb06169a99adac09fdd6fcf356a1a792087069fae667be7fe79ee05c024cffe6762d6f3e945d7d2ca5f5f3091e9922f78f4ebdd304c3d066b84677c0f510d5
SSDEEP 6144:aR+6Sb0mt8VJJT6qU/AXGUUQF+hFD+7t56OD9ZfSApprR:CzcVyX6RAnyFSXD9ZfS4n
TLSH
T151442333BEDDDD77ECBC2581911395905DB45DFC42CCB61844A2ABCAB28FA980772A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2212-48-0x00007FF6064A0000-0x00007FF606C2C000-memory.dmp

Download

memory/2212-0-0x00007FF6064A0000-0x00007FF606C2C000-memory.dmp

Download

memory/2212-1-0x00007FF6064A0000-0x00007FF606C2C000-memory.dmp

Download