Overview

overview

8

Static

static

1

Captura de...52.png

windows10-2004-x64

8

Captura de...52.png

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    880s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 04:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Captura de tela 2026-09-28 012252.png
  • Size 62KB
  • Sample260928-e4cdysvclh
  • SHA256 dce198445789295f1932ce3d1ee8748b8206853e1c11eabc0096b20b77eeb621
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstaller

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs
    defense_evasion
  • Drops file in Program Files directory 46 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Captura de tela 2026-09-28 012252.png"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4724
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
      PID:4088
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0xf4,0x7ffb5f51c728,0x7ffb5f51c734,0x7ffb5f51c740
        2⤵
          PID:3480
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,9517302524366441225,15494271139949522690,262144 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2036 /prefetch:2
          2⤵
            PID:2132
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,5112569873580290432,11166832763131452717,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:3
            2⤵
            • Downloads MZ/PE file
            • System Time Discovery
            PID:4296
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,2883109870203042179,17037753106893403561,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2604 /prefetch:8
            2⤵
              PID:4896
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,6689458857773932854,16011722299363109056,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
              2⤵
                PID:4744
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3416,i,10017220771521067424,621396231633365306,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3440 /prefetch:1
                2⤵
                  PID:2240
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,6157221425594446448,72199624218338012,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:1
                  2⤵
                    PID:2112
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,11521407604889423101,15786494709583425743,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:8
                    2⤵
                      PID:3504
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5392,i,12745966743485610182,16434918554734506536,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:1
                      2⤵
                        PID:2428
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4680,i,15590520099521093635,13211187710343577818,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5808 /prefetch:1
                        2⤵
                          PID:1364
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4700,i,15093298686571577918,14477861244118921878,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4480 /prefetch:1
                          2⤵
                            PID:3904
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3592,i,1325284512809294262,10373719052243477726,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3588 /prefetch:1
                            2⤵
                              PID:4916
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6044,i,17719108729579000065,16458412534515158411,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2848 /prefetch:1
                              2⤵
                                PID:4892
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5396,i,4211014010019822684,13356778844155711126,2097152 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:1
                                2⤵
                                  PID:4324
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1204,i,5307856046629090874,11172017562549181487,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3532 /prefetch:8
                                  2⤵
                                    PID:364
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3412,i,2178206940813003033,847767668300738485,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:8
                                    2⤵
                                      PID:1788
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,3690784505158328692,11073714173399167282,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4596 /prefetch:8
                                      2⤵
                                        PID:4040
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,4456335127799076663,9845602614794376849,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:8
                                        2⤵
                                          PID:3300
                                        • C:\Users\Admin\Downloads\VMProtect Ultimate 3.8.6.1926.exe
                                          "C:\Users\Admin\Downloads\VMProtect Ultimate 3.8.6.1926.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1168
                                          • C:\Users\Admin\AppData\Local\Temp\is-4KKA6.tmp\VMProtect Ultimate 3.8.6.1926.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-4KKA6.tmp\VMProtect Ultimate 3.8.6.1926.tmp" /SL5="$E021E,97503962,119296,C:\Users\Admin\Downloads\VMProtect Ultimate 3.8.6.1926.exe"
                                            3⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Drops file in Program Files directory
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of WriteProcessMemory
                                            PID:4856
                                            • C:\Users\Admin\AppData\Local\Temp\is-03P90.tmp\_isetup\_setup64.tmp
                                              helper 105 0x278
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2196
                                            • C:\Program Files\VMProtect Ultimate\VMProtect.exe
                                              "C:\Program Files\VMProtect Ultimate\VMProtect.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Suspicious behavior: AddClipboardFormatListener
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: GetForegroundWindowSpam
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1944
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6220,i,8541483981067087581,2835691258796878811,262144 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6164 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3008
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3144,i,5379217863323660183,11827954191631664047,524288 --field-trial-handle=2040,i,11331101606886210027,14138446237912434751,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:8
                                          2⤵
                                            PID:3504
                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                          1⤵
                                            PID:3920
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:2452
                                            • C:\Windows\System32\rundll32.exe
                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                              1⤵
                                                PID:1984
                                              • C:\Program Files\VMProtect Ultimate\VMProtect.exe
                                                "C:\Program Files\VMProtect Ultimate\VMProtect.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Modifies registry class
                                                • Suspicious behavior: AddClipboardFormatListener
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1244
                                              • C:\Program Files\VMProtect Ultimate\VMProtect.exe
                                                "C:\Program Files\VMProtect Ultimate\VMProtect.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: AddClipboardFormatListener
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4304

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    VMProtect.exe
                                                    • Path C:\Program Files\VMProtect Ultimate\VMProtect.exe
                                                    • Size 29.9MB
                                                    • SHA256 951f9bc353fb7e6b20d4ea6395ac000a22c264dda86ff09872225b8e062c5ac2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtect_Con.exe
                                                    • Path C:\Program Files\VMProtect Ultimate\VMProtect_Con.exe
                                                    • Size 20.9MB
                                                    • SHA256 ab07118d87b23fef6c1f7f65240756a409e57cce8901a964002270349130588f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    en.lng
                                                    • Path C:\Program Files\VMProtect Ultimate\langs\en.lng
                                                    • Size 9KB
                                                    • SHA256 a7b508ca5a0bd7b6c12a4d4388eccd5df51545d35a34308310852a3824978b33
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    unins000.exe
                                                    • Path C:\Program Files\VMProtect Ultimate\unins000.exe
                                                    • Size 1.1MB
                                                    • SHA256 c7edadd58b4ac762efab9f07959d2e540bf40e74c0715d9b825a99ddd61c6c10
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtect.dat
                                                    • Path C:\ProgramData\VMProtect Software\VMProtect\VMProtect.dat
                                                    • Size 251B
                                                    • SHA256 2fe0c58c50da3f99bc6c0119f61dea98b86941f23a99e9d09304e1205982226e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    styles.qss.tmp
                                                    • Path C:\ProgramData\VMProtect Software\VMProtect\styles.qss.tmp
                                                    • Size 13KB
                                                    • SHA256 751598840ec9270fd7ac6132cf07465a665315287cba2ae7bce60de766fa7b24
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    BookmarkMergedSurfaceOrdering
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                    • Size 6B
                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    BrowsingTopicsState
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                    • Size 649B
                                                    • SHA256 10aed877161f62ae6afa2604e659eda3b4828384594bb33263fb781ac7e24fcc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 480B
                                                    • SHA256 7cd4bd02c17706832d8c2acc39efbef6a7909e57ae36878bbd0484dfffdacb59
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 528B
                                                    • SHA256 dd94f3253a7d3121c001cca8d9cd196cd1047f741a516754646ff901e0b1e2ec
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 9KB
                                                    • SHA256 a659024277b9c46537b2fd4e90179c08d6d7f91ed99a66893cc0cfbc7f90e057
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 7KB
                                                    • SHA256 e35b671683d1c13a9781816b6904497f01e063d99949c4caa37aa010024eb5e7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 7KB
                                                    • SHA256 751c90d7b4761d645a7453bb4df7dd429117d54d2ba283ced23fa612ed7dd800
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    TransportSecurity
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                    • Size 1KB
                                                    • SHA256 de0ac7d6518f4666255f49c9f09b34c5edb1b6e3c21586db4ec90e3f50eb811b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 11KB
                                                    • SHA256 c83be86e7856d60df26f0361dea221a72866b246f2da05f8a3ac07cf3d92d6a2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 4d695c68e725f170e942ab0d30e2821455d1f85387c284c3301f566b112a2490
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 e3c05bf7459dbb7a3acc8fec79c6f83c54af2a4f7ed0b5f00361ab71f467271e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 679e88c28652eb09098e09d0f0708002d2d1af0993023e9464785d070db3a0ef
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 dbfcc000e62d9cbeb1f69a20a331586a78dbfa90280f2ad219b2fed83f0807d6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 c7c52ae6f581b319d5a8e6d17f9fbc57c2344cf8b78f46783cb2aa460f73c078
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                    • Size 13KB
                                                    • SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 263KB
                                                    • SHA256 b69ab0dfc8a70bb4285dacc1235a6d1a312d20a8413e40e01a1ac0ecb55267da
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 264KB
                                                    • SHA256 a8940eeca0a537f4396cbe1c768a9af400bc32a587bf22843747f13ff5bcd3d6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 263KB
                                                    • SHA256 9406d3bb2e6c94d5d79c14db78f875ff3289f096f67f46ada2a2ce14059ad2c1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 130KB
                                                    • SHA256 6d7771e3c65cac9ab2e8efc1b5ab207a90988c250fefc3ffc52f8ad080a3177d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 264KB
                                                    • SHA256 7baa82c35689c57fbdbe965fee86a43d4621d1bd64c9a5fb8823082a5acd83d8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    _iscrypt.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-03P90.tmp\_isetup\_iscrypt.dll
                                                    • Size 2KB
                                                    • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    _setup64.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-03P90.tmp\_isetup\_setup64.tmp
                                                    • Size 6KB
                                                    • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtect Ultimate 3.8.6.1926.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-4KKA6.tmp\VMProtect Ultimate 3.8.6.1926.tmp
                                                    • Size 1.1MB
                                                    • SHA256 cb095356ddcfcbace96c6252fb73a267ed011c15ff206a7a9302007baa68a783
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectSDK.h
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\BCB\VMProtectSDK.h
                                                    • Size 3KB
                                                    • SHA256 2300b7b4bb6bbf9cfa08013ec2d9b2fdceb3dfd2e603cd1e24a493de4d165b15
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    VMProtectSDK.pas
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\Delphi\VMProtectSDK.pas
                                                    • Size 9KB
                                                    • SHA256 935c599b59ef4e70eeb3c87a05a6cb7351e0820ecbe4b425b86d47301b1dffa9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libVMProtectSDK.dylib
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\GCC\libVMProtectSDK.dylib
                                                    • Size 49KB
                                                    • SHA256 27e726386a83680917d72557adc5b271fd3446103826c3b290e85daee9f70777
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-T75AQ.tmp
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\Lazarus\is-T75AQ.tmp
                                                    • Size 804B
                                                    • SHA256 50f1d138f273381a9f20e5de3ae21e863196b632baa6953e54f4b2316569c535
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    VMProtectSDK.inc
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK.inc
                                                    • Size 2KB
                                                    • SHA256 9d41f7bf8f220e721e34f54665db9b63caca9ea00fc650f81492736a196f731e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    VMProtectSDK32.dll
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK32.dll
                                                    • Size 98KB
                                                    • SHA256 d53173dca9ff097049fa9b81acd177ffc9de0ff577a59efd320b630f678079a9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectSDK32.lib
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK32.lib
                                                    • Size 7KB
                                                    • SHA256 ee09a629c0066ae175caf97ee92bfd7bcfa58e12b29b7aa62cc88fd3f097ef4f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectSDK64.dll
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK64.dll
                                                    • Size 116KB
                                                    • SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectSDK64.lib
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\MASM\VMProtectSDK64.lib
                                                    • Size 7KB
                                                    • SHA256 5f7fea4dedcb9c0fb061ba7e7e27f53e3a0fe9e3a304be3d21514f751b14a791
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectSDK32.a
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\MinGW\VMProtectSDK32.a
                                                    • Size 18KB
                                                    • SHA256 e9ec7953b54c24c2cdfe2f4bd0a2feb288445ecc9d577c2e0edc4bb1f8d380c6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtect.SDK.dll
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\Net\bin\VMProtect.SDK.dll
                                                    • Size 10KB
                                                    • SHA256 b8ff4bb2b247b67d707c77d32f4541c4de99ac8213aebc411fd36ab0dbd201da
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectSDK.bas
                                                    • Path C:\Users\Public\Documents\VMProtect\Code Markers\VB6\VMProtectSDK.bas
                                                    • Size 3KB
                                                    • SHA256 d2c1334fd893071b3b7e42d0817cbd37310c831af2af12ee1f94e8f654eff403
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    VMProtectDDK.h
                                                    • Path C:\Users\Public\Documents\VMProtect\Licensing\DDK\VMProtectDDK.h
                                                    • Size 3KB
                                                    • SHA256 e98615fe5506da30061c63a3c6a3b1dfd23892f783d1aa6a9e4fe891a59f2283
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    VMProtectDDK32.lib
                                                    • Path C:\Users\Public\Documents\VMProtect\Licensing\DDK\VMProtectDDK32.lib
                                                    • Size 7KB
                                                    • SHA256 7850eacfcecbac9b0f9b9335060f53c5b17a8d817222a0b3065c83a22d1c831d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VMProtectDDK64.lib
                                                    • Path C:\Users\Public\Documents\VMProtect\Licensing\DDK\VMProtectDDK64.lib
                                                    • Size 7KB
                                                    • SHA256 2f5c114bf3bd77c53d5d493d9fd6269c0bd19674321e680da973551389d5fd90
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-01QIG.tmp
                                                    • Path C:\Users\Public\Documents\VMProtect\Licensing\Xcode\en.lproj\is-01QIG.tmp
                                                    • Size 47B
                                                    • SHA256 2a7f77dd390052d5407e2b494b173a9fc6b671ab757d25b79ed23352361dce5c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    is-KGTOM.tmp
                                                    • Path C:\Users\Public\Documents\VMProtect\Scripts\External DLL\is-KGTOM.tmp
                                                    • Size 3KB
                                                    • SHA256 7e90ae83789d2a44ec9c5ee5b38586e5898dcbfefb0e754af6fd0720eea21dde
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    memory/1168-203-0x0000000000400000-0x0000000000428000-memory.dmp
                                                    Download

                                                    memory/1168-950-0x0000000000400000-0x0000000000428000-memory.dmp
                                                    Download

                                                    memory/1168-176-0x0000000000400000-0x0000000000428000-memory.dmp
                                                    Download

                                                    memory/1244-953-0x00007FF6E7EA0000-0x00007FF6ECC32000-memory.dmp
                                                    Download

                                                    memory/1244-952-0x00007FFB7B6C0000-0x00007FFB7B6C2000-memory.dmp
                                                    Download

                                                    memory/1244-951-0x00007FFB7B6B0000-0x00007FFB7B6B2000-memory.dmp
                                                    Download

                                                    memory/1944-969-0x00007FF6E7EA0000-0x00007FF6ECC32000-memory.dmp
                                                    Download

                                                    memory/4304-996-0x00007FF6E7EA0000-0x00007FF6ECC32000-memory.dmp
                                                    Download

                                                    memory/4856-949-0x0000000000400000-0x000000000052C000-memory.dmp
                                                    Download

                                                    memory/4856-948-0x0000000000400000-0x000000000052C000-memory.dmp
                                                    Download

                                                    memory/4856-930-0x0000000000400000-0x000000000052C000-memory.dmp
                                                    Download

                                                    memory/4856-261-0x0000000000400000-0x000000000052C000-memory.dmp
                                                    Download

                                                    memory/4856-204-0x0000000000400000-0x000000000052C000-memory.dmp
                                                    Download