hxxps://cdn[.]discordapp[.]com/attachments/1484000984396206213/1554603422391472298/Debug[.]rar?backend=b2&ex=6abd7cc3&is=6abc2b43&hm=87007d00e10690b5e56fb77e5b27943b21dd402adf764465abafc30855a50948&

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1484000984396206213/1554603422391472298/Debug.rar?backend=b2&ex=6abd7cc3&is=6abc2b43&hm=87007d00e10690b5e56fb77e5b27943b21dd402adf764465abafc30855a50948&
Sample260930-jreqrsxsc1

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3152	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4380	4344	chrome.exe	83
PID 4344 wrote to memory of 3152	4344	chrome.exe	84
PID 4344 wrote to memory of 4640	4344	chrome.exe	85
PID 4344 wrote to memory of 4640	4344	chrome.exe	85
PID 4344 wrote to memory of 3740	4344	chrome.exe	86
PID 4344 wrote to memory of 3740	4344	chrome.exe	86
PID 4344 wrote to memory of 2636	4344	chrome.exe	88
PID 4344 wrote to memory of 2796	4344	chrome.exe	89
PID 4344 wrote to memory of 2636	4344	chrome.exe	88
PID 4344 wrote to memory of 2796	4344	chrome.exe	89
PID 4344 wrote to memory of 1868	4344	chrome.exe	90
PID 4344 wrote to memory of 1868	4344	chrome.exe	90
PID 4344 wrote to memory of 372	4344	chrome.exe	91
PID 4344 wrote to memory of 2376	4344	chrome.exe	92
PID 4344 wrote to memory of 752	4344	chrome.exe	102
PID 4344 wrote to memory of 824	4344	chrome.exe	103
PID 4344 wrote to memory of 5072	4344	chrome.exe	104
PID 4344 wrote to memory of 4084	4344	chrome.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1484000984396206213/1554603422391472298/Debug.rar?backend=b2&ex=6abd7cc3&is=6abc2b43&hm=87007d00e10690b5e56fb77e5b27943b21dd402adf764465abafc30855a50948&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe161dc728,0x7ffe161dc734,0x7ffe161dc740
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10702372775056655920,14353966008363435344,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,17140244830149971635,18224303432884594775,262144 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,12623553359073131035,17935483524673257105,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,2308359965156593797,11763334925853299317,2097152 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,9738613053805768064,7302476470904840781,2097152 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,11332898446582290370,13071581176527624762,2097152 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3780 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,15670216821786577838,16964135107717739033,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,1455790287269900212,4131858073073665834,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,16875525653960736944,2984410269802519651,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,1030809084673546696,6273725069888054553,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,14381825209365223928,17486125478928571003,524288 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5756,i,15966104616283248027,3170629172759083017,262144 --field-trial-handle=2056,i,1866829279861174073,6148561241038930667,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a5e1b49e36c7886a698b2133336fff07c10502df85f1f3f84d2f2df69e486682
MD5 3a06bea83ce6d675faa1ff5ad5382731
SHA1 a1849820156810a9b578c05a97fbf9973d9a6509
SHA512 d80bff0a50990759c67d5eb0701a92887af822ba1672e194ea73cd0a98c98e10cd903fe7c49761574ce8d8d4a1b1781a21e8f3314a4bac38ff58ef4ecb308abe
TLSH
T103F028BEC931EC3718FD0B186099478BE751132B2B80894F3B3D920C8FB0A3B458682C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a93d7b43c148130b9f708f2fcf857f12a39478cbca06c6e89e45acd38019645e
MD5 c043bb8507399109f441bddc8257fde0
SHA1 fa4c97ca094c2818cb6f7607fe92c574881b287e
SHA512 2eaa846ecc1c5ad4e7e03d85bfae084ee814f3b2450b5c6dbd6508d5958ea9bc12aeba459d31c8f4be32008f8ab7254dcd95b5ac86fc45ece56a977f98fe7477
TLSH
T1C7519EF3C3D8CA7D891156F5AB252E1BCE2D0A58532C3C57C8D4AE5F97E28B1D20154E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 282b2eee776e78d3884372919e2c10ab4f65904fde49f6bdf60b6a97b673c5b7
MD5 48c19a8915b825caf8a330e0646d5e3c
SHA1 6b72cefc231ec642b3d210b6c879329e7dd229e7
SHA512 abda0cea44c16ed969ac5a85af8c6b9ee1cd0428c8c72963f8afeec6f72b7a869df07d1797e2267c0941b0ca38cfa6e726b4c15ef6136f7d2d127fd3c85aae94
SSDEEP 192:VRqz6XN6nG1v7MpAPRp2t9tHsb+WNn1DPmbe0X20d3Nf+VyIsnAUge:VRqzkFFwUXOvwZPA2WZ2e
TLSH
T19242852DAD60797B5CDAC21AF9A57793E7F5202130942E84EBFC892C25DB5CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 bc874b5dfd433743339ca27fbc016d54b007fab3e56af9f017a931025cb0f537
MD5 8d3394a14b12f06ecbe650f06b4881fa
SHA1 d4c8ccc659c5c983f73adedfc2f5491607ac031e
SHA512 5052397393a9e12e611402bc4ac104433e8a02a13f8c7f9236e7f653a48cb0a7aaac61660c212ab456241d0ca72e689c0cbd6c0186b51f3570b8c09ec3b374b4
SSDEEP 384:K0juV7KxkXqKf/pUZNCgVLH2HfgslRU7pLuLceScdXODu1+ErU3pfHGeXTuxL:KYuV7KxkXqKf/pUZNCgVLH2HfgsDU7p0
TLSH
T15972E967AC4CAA3B0FD4CACCD8277F4FEDB5025A65D9886443FA982503D5ACB11061E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c77542778e45303ab9d98ad9659b020a35ac773496a6521c5a9e1814100cc48b
MD5 e09cb1adf45eb99f0a88deb4b8ea2840
SHA1 7ed48674344bb30a635608f9bac15d4c5e9e94a3
SHA512 c15f5717c6e624af6563f6230345460cb872f404f42daffe26bc3198b9cd5a02b6a4672566b3a8f4d0a941a7e3f6fec4339325c41c9583f8bd7e7d1a960e944c
TLSH
T19BB012CDC4415701C01603F4155424887195DF14A605570251F40D059C359A0802B174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca6f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ca6f.TMP
Size 96B
SHA256 de7733c3923eb5014e5ca9aeafc7d4834aaaeddfb3dccb38fc319482cbeabf54
MD5 7c699da88aa4e284ff05ab97e12c5a22
SHA1 5359711da081b0972618e99481f00c308683ee01
SHA512 876393bae1d741a865b813f0b7b55289318d4a4b0bf565668b76f77aac14b0e30c449206ed37e183037763ce3fc0719b0598eabde160c63f7998b4c0387320af
TLSH
T122B02288C00A3282E0A203B028C8A0EC3222FFA0CA83022A8BE00A22EC202300028030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 312bcecb59bbb04de471c5f74fde10c69c1c13f1ee6a4923f63d3fe34c192d66
MD5 92f6d0ad23c19145f9ac750742712be9
SHA1 003aa82725968d593a72fd26f8f942962f0e888e
SHA512 fb485070070ca3dc1aae11fa0610b68a9b0b58e469d7eb8b23a54cd59fab9b97fa91e057f66e0f314486f12243b4a7e57eb0799d87525b9f91494409b44fc9bb
SSDEEP 3072:kJIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:k1Ptbmf1K49XLWbEPi4NTKlLzh
TLSH
T161D312217D05BCB8A9EEDB61A1802E16A5B8D90F953D3BE55CDE3F8805A36DDC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 1c84974018577e9909cb73d51c55f8bc9551ba6063f5eff4742c9a22d057b805
MD5 ef3df061b08e16f24c8d28293eef2b65
SHA1 451cb0c08c7e3589f231312fa84dfb5eb3d08207
SHA512 3f773dba1b0bf7735328acc9fda0c289e4b3f3eeb3a7c785fdcf12000f183f03f36c698898d49d213539c7658cb05f7ee023c7987f3b6fda0b8a24ad0f1c8c0d
SSDEEP 3072:xIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:dPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T1B0D312217D05BCB4A9EEDB21A1901A16EAF8D90F953D3BE65CDE3F4806E3699C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 e731778b1fef6a57f91e75e34b7165a9833527b5da9bd23be25757e9a1583dbb
MD5 d295870804aa9f3629bf609eb43bc1cc
SHA1 5830a34ca42095bab7d280c1d35e1a6e7ccdf5c5
SHA512 9f1fdd04d3a28219ddb429ef67da473aea9b72f5ee3f44f50e2e33d8b4d59202d7e584ebff2e380b3157df68b8bb9c2d888a3de19552d0af7dd57703bb393cf5
SSDEEP 3072:SIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:yPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T12BD312217D05BCB4A9EEDB21A1901A16EAF8D90F953D3BE65CDE3F4805E3699C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 bb79ee9c70beec64a71819911b006c76c166f12a8d0478ae98bfce5068e0df50
MD5 30fcdb50483403868fd595c28bbf098a
SHA1 4e30fe82738460d6d6865de67bd9a2dc1a63f689
SHA512 4e5b8fe94c2ae33fdcc90cddb9858ddce92f3a8fe4440215536078a4e067f3b444ed6a998e1fa89c6b23c061ad4b2405f88d0b1f2a32b77812a86ada7ccf7f68
SSDEEP 3072:4IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:UPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T1C2D312217D01BCB8E9EEDB22B1901A15EAB4D94BD5397BE61CDE3F4805A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download