158f4730fbfe1f989e72d8233e422d2282f0a2cdaa45959fabdf3607c8b28247

Analysis

user interaction
yes
max time kernel
899s
max time network
900s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fresh Vocal Setup.exe
Size 4.4MB
Sample260930-ns91hsvarb
SHA256 158f4730fbfe1f989e72d8233e422d2282f0a2cdaa45959fabdf3607c8b28247
MD5 52705332e3d7065be103a3fb8b4bede4
SHA1 45a69cffd990548125850a689aa350acc0996571
SHA512 d1ed073e9a583422e0867e967cb202d93989357ee556b6e1480f9a57063acec2fefd50653c636efabc1aebcb95d689557eba3edea40449ed6c995fba808af85e
SSDEEP 98304:R5OQ9j6NMXuFKOqvFNmlh6+2NbLxGKQRiKzX/gL7kBO5WIw0XDR6Pkth:LqmsKOqI6+P/XI3kG9t6Pkth
TLSH
T13E26023BF28BA53EE46A1A363AB2D610543B7A6165034C1696ECF48CCF351711E3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5840	Fresh Vocal Setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\Fresh Vocal.vst3\Contents\Resources\is-1G9U4Z478B.tmp	Fresh Vocal Setup.tmp
File created	C:\Program Files\Common Files\VST3\Fresh Vocal.vst3\Contents\x86_64-win\is-AD5TDXEI67.tmp	Fresh Vocal Setup.tmp
File opened for modification	C:\Program Files\Fresh Vocal\unins000.dat	Fresh Vocal Setup.tmp
File created	C:\Program Files\Fresh Vocal\unins000.dat	Fresh Vocal Setup.tmp
File created	C:\Program Files\Fresh Vocal\is-2JVUD10C99.tmp	Fresh Vocal Setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fresh Vocal Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fresh Vocal Setup.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4640	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5064-0-0x0000000000780000-0x0000000000869000-memory.dmp	innosetup
behavioral1/memory/5064-16-0x0000000000780000-0x0000000000869000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{826255B1-07E3-4ACC-8E8F-1713E1D01706}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
4580	chrome.exe
4580	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe
Token: SeShutdownPrivilege	972	chrome.exe
Token: SeCreatePagefilePrivilege	972	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
5840	Fresh Vocal Setup.tmp
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe
972	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5840	5064	Fresh Vocal Setup.exe	80
PID 972 wrote to memory of 2324	972	chrome.exe	83
PID 972 wrote to memory of 3172	972	chrome.exe	84
PID 972 wrote to memory of 3172	972	chrome.exe	84
PID 972 wrote to memory of 4640	972	chrome.exe	85
PID 972 wrote to memory of 4000	972	chrome.exe	86
PID 972 wrote to memory of 4000	972	chrome.exe	86
PID 972 wrote to memory of 4348	972	chrome.exe	87
PID 972 wrote to memory of 3728	972	chrome.exe	88
PID 972 wrote to memory of 4348	972	chrome.exe	87
PID 972 wrote to memory of 3728	972	chrome.exe	88
PID 972 wrote to memory of 5244	972	chrome.exe	89
PID 972 wrote to memory of 5244	972	chrome.exe	89
PID 972 wrote to memory of 5496	972	chrome.exe	92
PID 972 wrote to memory of 5496	972	chrome.exe	92
PID 972 wrote to memory of 2552	972	chrome.exe	93
PID 972 wrote to memory of 5376	972	chrome.exe	95
PID 972 wrote to memory of 5376	972	chrome.exe	95
PID 972 wrote to memory of 5516	972	chrome.exe	96
PID 972 wrote to memory of 5516	972	chrome.exe	96
PID 972 wrote to memory of 2308	972	chrome.exe	97
PID 972 wrote to memory of 3428	972	chrome.exe	98
PID 972 wrote to memory of 3428	972	chrome.exe	98
PID 972 wrote to memory of 3404	972	chrome.exe	99
PID 972 wrote to memory of 3404	972	chrome.exe	99
PID 972 wrote to memory of 2172	972	chrome.exe	100
PID 972 wrote to memory of 2172	972	chrome.exe	100
PID 972 wrote to memory of 3544	972	chrome.exe	103
PID 972 wrote to memory of 8	972	chrome.exe	104
PID 972 wrote to memory of 2084	972	chrome.exe	105
PID 972 wrote to memory of 2368	972	chrome.exe	107
PID 972 wrote to memory of 2368	972	chrome.exe	107
PID 972 wrote to memory of 1716	972	chrome.exe	108
PID 972 wrote to memory of 5600	972	chrome.exe	110
PID 972 wrote to memory of 5600	972	chrome.exe	110
PID 972 wrote to memory of 1668	972	chrome.exe	111
PID 972 wrote to memory of 1668	972	chrome.exe	111
PID 972 wrote to memory of 4580	972	chrome.exe	112
PID 972 wrote to memory of 992	972	chrome.exe	113
PID 972 wrote to memory of 992	972	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\Fresh Vocal Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Fresh Vocal Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\is-NCRHRRAWJ0.tmp\Fresh Vocal Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NCRHRRAWJ0.tmp\Fresh Vocal Setup.tmp" /SL5="$4022A,3448700,893952,C:\Users\Admin\AppData\Local\Temp\Fresh Vocal Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff966c3c728,0x7ff966c3c734,0x7ff966c3c740
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,8412497289908454567,6858731852017616794,262144 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,7359772269307770391,16176339427348566229,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,12363942246017166200,13276252096678527350,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,12181180747714375101,15822243919747000157,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,13384599721118420162,4614934586750879185,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,6837508083271172159,5447974946693266057,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,8136710648212515044,7352958012919829004,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,6308712867739097776,4666125849679132656,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5420,i,7818117372625043075,11146869441929522551,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5924,i,46290720588148870,17053974914301617265,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,10676832992000509087,8789166709534913017,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3636 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3600,i,3162429968136431236,6605427342476067149,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3620 /prefetch:12
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5876,i,2746884225432742993,3015460148553518320,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6160,i,3996459928325905552,4289200776463014220,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,1124388898583359775,3695408021133701689,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,14394444849102878063,7369854530854377341,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,5758469770100950325,12650170807623115676,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6296,i,5340673513139639226,15428335070097753026,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,10223883721214762006,11559884303469926295,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6208,i,17481180320276807272,14435779704100656743,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6652,i,8657660818036529683,11976734913453703028,2097152 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6436,i,14093377734507552731,9604988757314537320,262144 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6752 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3092,i,9445170244677547306,2553794029267412821,524288 --field-trial-handle=1960,i,10444534730984643447,11859704864977995959,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c5c59ba4d9da68349065f700736b069f1a68984a138e826f7dbcd1244c9529f5
MD5 cf51af07b3826953398d9e01e4e13780
SHA1 9ee44455b432dd8a34c22e749145d7bad99cce04
SHA512 eff0269c217855ea8b110e519edcbb58ca5e81bfc1c8432176698fce3c822cd48e86bb3a6251689453dde5761ac488094241886968218e5a7d8ff2db3e9084d2
TLSH
T1AEF028B5DC21AC7B1CFC0B2964A54B4AE7A5136B2680894F3B3D510D4FB067B868685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 23KB
SHA256 6323c9aef98808354c05595c17f7862b7d628a6306cbdde8a0e63442d3dfda88
MD5 b0b097c87d61c854926b824f20efc0b9
SHA1 99449a9c3c2cd283ef78dbac33343231b751b32e
SHA512 4d92e22cd8e70faa5b4c72cdc3889d75ca974fee59961c5c653829656feed1aff021d3a88f2b09dbfdb7f4c3df46ef886cbd4499915a8720ac0cef18de33c0ff
SSDEEP 384:nnPnYyJWvtQUw5cRgCX9MX0HW4crugOqfNJmMBXOEgsfSMM8KOyuFYksce4Vw5uN:nvnJqtwO2DMvqfNMM9OEvSMM8KOyuOZ8
TLSH
T1CEB2D00B8A13C6B7C6BB660C868223B0AF77DD894D2B173278416D1199B93FDE6D0871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4fe134a9b59c3a351b838a6798bd192a39fd2c29eae72b8b2ea77c46b4f71051
MD5 c271356f2a7202e55b6599e7e6f05872
SHA1 d0810a8e2ac4dd4b1c0122e4a7917cbfd20a8990
SHA512 326c58fbd4cacf55558ab8ab76c085a6fb60c5130425d99ad6cac9e4932c2bea03ea31d00649a9d01313faec6c524153524a8c2ebdb28d2c3b967e1eb48d1e31
TLSH
T18F31EB1BE9B2FC01EF5645331EDB6888B4B7E691A1C73E6E0CA04EF3BC763648001125
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b6e87046ddc6d3912d5117f6000fe747c7c9166438ba3895538e7b2080440f7e
MD5 21e4f5eedfc4c1ffd655db0d238a4ec9
SHA1 920c0f59760de61a9b8a82e60f9aa66c0d3c0a15
SHA512 091cea45e7cc57401a4208dec2e58f8f992f75aa92e7ec9c46df3f3b4c825a854ff57463fd033e103ff0956f8f8087de9df69e30f7728090eecca6d2667740b0
TLSH
T13C11891AF9B5FC01EF9959735EC76888787BDA80B1C73E5D40764AF23C267708101219
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.mediafire.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_app.mediafire.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 a73fb704504f2c11d647a60f6c3d8435c482fe40dfdaa02725901f1fbfeda3f7
MD5 84f3bab2c288ab1d763c6f49184b3dab
SHA1 a72c6bb02b119484e25483e8727dc7ab6bde6a71
SHA512 b0a20851cca3805fb29b400d67b3758005b8a3f35547052a9fb625a58531654730fc7374f17c62c8225895ce52cba9077834b762598d9777e063290878c8b0a9
SSDEEP 384:DzKhyqbvFJLLp0J+Jdewnrwk3D7r1rd1DdYxwIJIuIsNFaEf47xYma4GG/nTDJH0:3yR8o4hOdbUz
TLSH
T1F782AEF7C3D9C62E881156F897246E5BCE1D0A18432D3C26C8D9EE4BE3E2472D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 977d27e2de29d28ada24a32d07f3ebce7614a71760b49753359b8a787781d896
MD5 786122337ca6b2dcd54ffa7611f45db5
SHA1 4d87787be08cb5b06ff44594f06d0272e3d40197
SHA512 69a4f3a3bc97d46031344e1e47ca03d20ff328455850197d8dcc24048a5adc1e650464e109b3770b0fe47ab8ad4a6cc4b5dccc717c3615c5afa05588d00cb966
SSDEEP 384:DOh1HtitH9WdU4GqoeB1Od+pEg6akf7r1rd1DSZxwIJIuIsNFaEfq7xYma4GG/n/:IyR8o4DOJZ1
TLSH
T1AD62ACF793E5C56E890156F89B24AE1FCE2D0628432C3C2688D5EE47E3E2473D16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 34c4213ef0089b28506a3c63d6fe2f28da748f4791505df93168adb8cf888826
MD5 868ea54d66cd70697bd0da696aaf80df
SHA1 610e7bb9e206808dd432f4b23418a0f9dfbd5df2
SHA512 5c0b4ca88baa55c0c22d6dc12bf714e5b9a8db18c1b15cca5e3760729ec0a790677f6528f3dbbbbf643ff7d078c94f433928a024551fca50c9f81664c9919acb
SSDEEP 384:DOh1HtitH79WdU4+Jdewnrwk3Cg6aN7r1rd1DSZxwIJIuIsNFaEfq7xYma4GG/nL:OyR8o4DOdBh
TLSH
T1C572AFF7C3D5C66E891156F89724AE1BCE1D0A28432C3C26C8D9EE4BD3E2472D15964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 9870e6640df507dde9848eba79b285b98357cff0796adda5b9c40cb1f38353f4
MD5 3df10a13fc1a8165a17a59fece6241ef
SHA1 17b6d6fd16a92510b3cefe392caff9a6f29fadbc
SHA512 7c131212035106aff9968127f4d384e52f32648073f80e2118ebb7aabc3f175b31c44e7e1177bcc91a7ddbb139140d24f34b88f6fff0d6720541eda098684d5d
SSDEEP 384:DzKhyqbvFJLLp0J+JdewnrB7r1r08TM1DdYxwIJIuIsNFaEf4fYxYma4GG/nTDJ3:CyR8o4cOdbC8
TLSH
T162729EF7C3D9C62E881156F897246E6BCE1D0A18432D3C26C8D9EE4B93E2472D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 af5611cbf6c3acfbdc05792681ff5d68a869a59115ce0a4e3e6e1b93d6a5adac
MD5 4669d93eeeb603cf147b18edf80692fe
SHA1 aea9d86d43c0425c8e1215ee7b8988efa064afaf
SHA512 ec394dfff029f5b65923c597f0e06e189922a9f07398b2555f3e10857cf91829d6b0a0215682b8ecd35a4b806e952f85557c75ad968faf32004a2ebcd5ead1dc
TLSH
T15341BC9FD2BFB537106A08FB1D5878451EB9B8322251A0F9DEA7922C70D94F71B06437
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 03dc156dea07fece490f47382572b0b6482cb1855b45da7754e98c0446004076
MD5 ca2147d59eb170994a5fdafd3d0b9f66
SHA1 a447dcb83d6dfc03352a33504e5505d5f145f596
SHA512 ccf973cf36702f844f3c24e555f9ef96b627a3a52fd51d22ee2ef6fffd9773d888b0f2db7816aa050f64e11d20ff5239a22fd8dd06103d2f3015debb037de3a6
SSDEEP 192:ARhcBzwg62VySRA9pT9L8nkMacJpv79fGpAPRp281E9+Hsb+WNnDL7Nx2lD2JeIK:ARhmz36+JpNGUXEowHr2x2T8
TLSH
T11442C62DAD50797B5CEAC21AF9657B6BD7F1102620D42F84EAFC892C11DB6CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 61ae8014f4b622a32ded8ea5a16b8d666dee76276f29eeb006266152d5d959b4
MD5 c0488af10fdbb460df358b9fe9fa57d0
SHA1 79c2bd26e03a047bf5b904e6fddb8a38bd2a0592
SHA512 837ea15c64f2cb5ca674866633f451ca587784cd3c30be4830c9a6929c22ee102a956b5f6231a97832019d34197f1ee6c410f21b284966378c6b2f6d25a84e11
SSDEEP 192:ARhcBz0g62VySRA9pT9L8nkMacJpv7cfGpAPRp281L/9+Hsb+WNgGDL7Nx9VZ2Mo:ARhmzL6+Jp6GUXDowTrJ2i2Oe
TLSH
T13A52C76EAD5079BB5CEAC21AF961776BD7F1102660C42E84E6FC8D2C11E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 998887a4ad185e67059f7aaf91ac8413415d2be873d32545704c2e8d779844e6
MD5 24493db618a2db0503c58ee192e3982b
SHA1 9cc596a67935d1f3d5f14b7fb4871f8bd54c6131
SHA512 0f66c119524a774d0a0612014bc25038cd747f6527f214707640d3fcdf86071177d6903e3951fe367e3be0a0df7723f0f4d3ac3c59e11424f5b880cda335d4ce
SSDEEP 192:ARhcBzwg62VySRA9pT9L8nkMacJpv7cfGpAPRp281L/9+Hsb+WNgGDL7Nx2lD2Jm:ARhmz36+Jp6GUXDowTr2x2T8
TLSH
T13D52C72EAD5079BB5CEBC21BF961776BD7F5102220C42E84E6FC892C11DB6CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 892900fac923b5605be1c9ea2222f3dcce062c6aec0dbf0286bfb5e883960db2
MD5 ca402b8e8c25d44acf4b6aa010f86e1d
SHA1 a74ab386bbb2f8e1fe115b401493a2f9619bb329
SHA512 2a98fbb0fea5ff4d54648b25e686cd4b167893255833942637dec8b9161a915d695f31e11394e7c09cd837fabe93e347167e8dca116d64af9cc1553452571e39
SSDEEP 192:RRhcBz0gX2VyGRA9pT9L8nkMacJpv7cfGp34PRp581Ln9+Hsb+WNgznuVZay+Nxn:RRhmzLb+Jp6GFKXqowDNyJ2N2Me
TLSH
T1AC62B66AAD6079BB5CEBC21AF965776BD7F1102224D02E84EAFC8D2C11D76CD3207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 76c09439dd81cedd90f98bf22c61fcbb7dcc75e2f93ae4c04e4b3c4f8397e48c
MD5 22b61da41d8904540d93ba62a72b9478
SHA1 11ae9d09c68fbd09075393380e88c42a8f5429c3
SHA512 cf06f4916541a53134e5d8e6af34adc75fd2989f1bf66899705f66414c861d1e5834813134c6539221e734db05e9f221cc35c61dc3b6c1c26377d9a3abafc980
SSDEEP 192:ARhcBz0gX2VySRA9pT9L8nkMacJpv7cfGpYPRp581Ln9+Hsb+WNgznDLWay+Nx93:ARhmzLr+Jp6GUXqowQqyJ2N2Oe
TLSH
T11F62C66AAD5079BB5CEAC21BF965776BD7F1102224D02E84EAFC8D2C11D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 52faa1c0a2c145f24cb6bf0e4a48b0237ba969495c82d742d374c6759b4dc290
MD5 10219fe671f251c5a102a95887dac447
SHA1 7f90b76134fd16f85ae158bfb5c71425e83ed0ae
SHA512 caee2e22a50a8965d0fb94b1a22f1071e58b061efd33cb3d9eeb5e5a6d58e48d84366477559486942f9c5103a8a77cad8186aef0b09c97ec8427f2be08e3f9cc
SSDEEP 384:SEjml7KxkXqKf/pUZNCgVLH2HfgsluN7pLuLceSMtXODml+ErU3I6HGCX2v41q:SIml7KxkXqKf/pUZNCgVLH2HfgsAN7pe
TLSH
T18A720A677C4C9E7B4FA4CA8DD8277E4FACB5024B55D9886442FA5C2603D4ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0991022b6c7110fc811cc283fd6072ecca2fdbfba2b2f6705f4a62f6b812021c
MD5 ef154b7c628b5f9938955d66a1d402a1
SHA1 f3b7706bde944836f3668108fd86d5e0c221e437
SHA512 4da2464fc5cf38303b5bf46d1a28dd7121076ce2637b97fbf53c3b1a946d78fd2fec376cdfb2aa60aaed2415eaac0a0dbc9cf7fcde18c13d4533b620826f491f
TLSH
T182B0124580C2B342C04202F5115034883594DF11EE051305A1F07D41A836160801B064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c1c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589c1c.TMP
Size 96B
SHA256 d08b5e6842fe2e9630d4057d6b3e626a39d0e3b9440fbf3701e1ca189ea42ac7
MD5 826c90589ccf691f32bba224c760e0e3
SHA1 3459402f9da7ccb9d0ea7475dda73164ea7ca8df
SHA512 1628f108e8b3e2917297877e4699b03c8cf61351083b98b137c2ca99d92fac10a3f405850c8e36f2cc787be8a3a397cae6d5b24fd283586f6c9ad1742b94cddf
TLSH
T116B00255C102B313C49603B02999D5ECB2A0EF66C74B521792E01EE6EC36760956D570
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0451b215f55c51e1a818b2b3080959872d043475d8bd17d9b32859b63e483569
MD5 f3cba90a356b417e3ae28bf816f79f66
SHA1 aeca7f4d2dc3ddf368f9dc7edcad56745db277d9
SHA512 32cc800ac7cf0c962f32c55a21f83da43d4d76feaba7e9b238c4234a7f3be4e7f1843ab0ce474729c20a425232d27177111cf42ef9b57dc1b2c2b3d0f9361e89
TLSH
T16CB0244711D13C03D53013F001D3414433117F30774FF44700D00040D4113501107101
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 2ce2ae314e30e4537e02298216fa038079193d2c5fec79ecdbeb9a8a6f1add01
MD5 6afc041291928d8f471a309e1d361f60
SHA1 277404b985aea66bb8e686b88d86b5d07a3f10ec
SHA512 d25e8423fb8c29e07dc8752ac5ad896facad3af2e9d39534e73bbbc97b2dea4526f0d61c01708c42eca8163b5e94ec129e23a5256fc70e48f507da1f76408de1
SSDEEP 6144:7RE+Dvz0p3IGzzZDTJThDxWhaj5mjie/JYFob2:dE+fM4GRPZh/NmT/JYOK
TLSH
T1214423272CEE09B710ACC124907FB92496BCC66F8384EF4798D57A4FD2D7D86534B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 267KB
SHA256 18fa9eba998047e994f21946aa517a22782a579a269151623dd0fec751ed82fc
MD5 43d85ed78654844bdacf00f7aa8ef7d6
SHA1 f55ae89252436a9501faa90da865b4c987142e7b
SHA512 d98b22ed1521284be21b9d18ae055279bb0a171f2bad5592d87c63f869c76a05549f8290ad85ff80fd2682602dc930ddeab0a6fd28a0526a54b5a6301d99df17
SSDEEP 6144:sr+Dvz0p3IGzzZDTJThDxWhaj5mjie/JYFob2:m+fM4GRPZh/NmT/JYOK
TLSH
T1B04422362CEE09B710ADC114907F79248DBCC26B9684EF4B98987E4FD2D6D89534B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 a0f0d620361015d9af927de183bdecee439d5e1353d73b0ddc13dd09c595b6f2
MD5 cf6e931f4ecda048de05b115a0165da1
SHA1 1506f2c33af88a0a506e41ffe45b74492758ef2c
SHA512 7f1bc43f5666b02b818411c9c88e5e0c099f42ad3544ae7794fbdab902e90f69ec099776a18754dc2840491a3dd1ca1a39c2b9d1a0cb52cf0765c3219b2e3fcd
SSDEEP 3072:JmT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JtThDxWhaj5mjie/JYFobx
TLSH
T16AD312239CEE01FB14BCC508507D3F0096F985B39640FFA39ADC6A4F61D7EA4A366155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 267KB
SHA256 48bcdb70f31b9caeb8f911488f6a0f57b3ec88e4b3174a24a66858e30d6dc196
MD5 24ba320ee774dd5475894f528b499166
SHA1 587a12365a2e8c47325b3a11e634c506ff90d633
SHA512 f02a472140ac97e327c139fc185fad756baaff3f4dc1fb8cfc7d826d745d112f9a4149c633a540aa8c280292ee3a3d2f672095e2b4ed63c7663ffc083f1141db
SSDEEP 6144:gr+Dvz0p3IGzzZDTJThDxWhaj5mjie/JYFob2:i+fM4GRPZh/NmT/JYOK
TLSH
T1D84422362CEE09F710ADC114907F79248DBCC26B9684FF4B98947E4FD2DAD89534B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 3a60645ed1b6c352944f75a7b9be70d4422ffddf1db05931944a5151c4e33260
MD5 6f078f9527d90c2cd99b856e48586a4e
SHA1 8406bc1e9a598a0137640b68e33e0f4d10d320d2
SHA512 44372214d8a13f7ac0598321f072bfc24ecd39995670795ff46b1238a256b606323ffd520ca9342b8eda874b1f64b760572b42b7e9b06861afde7461c48e4a95
SSDEEP 6144:gRE+Dvz0p3IGzzZDTJThDxWhaj5mjie/JYFob2:sE+fM4GRPZh/NmT/JYOK
TLSH
T1B94422262CEE09B710ACC124907FB92496BCC66F8384EF4798D57A4FD2D7D86534B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fresh Vocal Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NCRHRRAWJ0.tmp\Fresh Vocal Setup.tmp
Size 4.2MB
SHA256 ed5f2c0d9857bbe5f0aeea9da8e1227336a006ae2c8e21247d1fae1921f910f5
MD5 71b5773936c1ef0f7bce35ae28452e94
SHA1 ae1cfb6bb078914eca78c5b9faacac48e42d976b
SHA512 e88739d3d6452cddfbecb8bf3816c6b51807b1053fa8e76048abb3081f459eb5b22f5e927aa2c2ed067f9076fd73dc07216a343d8a22cbba03a46c301bc0c2f8
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333PY:7xuHjWfZIzeY
TLSH
T1E1268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5064-0-0x0000000000780000-0x0000000000869000-memory.dmp

Download

memory/5064-16-0x0000000000780000-0x0000000000869000-memory.dmp

Download

memory/5840-15-0x0000000000F20000-0x000000000136B000-memory.dmp

Download

memory/5840-5-0x0000000003720000-0x0000000003721000-memory.dmp

Download