cf4b1f40d6d51aff94cdab689e598a3d419e4dc1cbf194d92a545ad20c4d1900

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/10/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusBuilder.exe
Size 522KB
Sample261002-ht9s9avbme
SHA256 cf4b1f40d6d51aff94cdab689e598a3d419e4dc1cbf194d92a545ad20c4d1900
MD5 52ae0560ee576e4e39848e003449de32
SHA1 a01860b863aea6711a6fc223c6a78380165c9ee7
SHA512 2c2fb3502701a2508c1e5db8cfe030db1b79acc4ad5f6c8c9de7d980b318574c6e92d4b519dddfe14cc767c4f39c22528ea21b8b8e6293ea364d5d9bb76a6922
SSDEEP 6144:kX3xbsFIJCnJQoJugnP6lDP/AWbQ7Voj3XiavoBrhxMBjKTxgU4VIN8J:kX6rnJQoJF6Fw7VE3ZABrwBjTUmI
TLSH
T144B4EFBAB0447AF5EAAE0FFB96473CBC5B7691730F47EAC9209455CB0C723629D12844
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4836	4732	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusBuilder.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2044	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4732	VirusBuilder.exe
4732	VirusBuilder.exe
4732	VirusBuilder.exe
4368	chrome.exe
4368	chrome.exe
5864	mspaint.exe
5864	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	VirusBuilder.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe
Token: SeShutdownPrivilege	4368	chrome.exe
Token: SeCreatePagefilePrivilege	4368	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe
4368	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5864	mspaint.exe
5864	mspaint.exe
5864	mspaint.exe
5864	mspaint.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2236	4368	chrome.exe	109
PID 4368 wrote to memory of 2044	4368	chrome.exe	110
PID 4368 wrote to memory of 4580	4368	chrome.exe	111
PID 4368 wrote to memory of 4580	4368	chrome.exe	111
PID 4368 wrote to memory of 4384	4368	chrome.exe	112
PID 4368 wrote to memory of 4384	4368	chrome.exe	112
PID 4368 wrote to memory of 1628	4368	chrome.exe	113
PID 4368 wrote to memory of 3396	4368	chrome.exe	114
PID 4368 wrote to memory of 1628	4368	chrome.exe	113
PID 4368 wrote to memory of 3396	4368	chrome.exe	114
PID 4368 wrote to memory of 4856	4368	chrome.exe	115
PID 4368 wrote to memory of 4856	4368	chrome.exe	115
PID 4368 wrote to memory of 1900	4368	chrome.exe	117
PID 4368 wrote to memory of 1900	4368	chrome.exe	117
PID 4368 wrote to memory of 5164	4368	chrome.exe	118
PID 4368 wrote to memory of 5512	4368	chrome.exe	121
PID 4368 wrote to memory of 5512	4368	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\VirusBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\VirusBuilder.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1064
  2⤵
  - Program crash
  PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4732 -ip 4732
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffdf047c728,0x7ffdf047c734,0x7ffdf047c740
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,14504679880150486558,11548488170494190162,524288 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,612739571377309379,16579330418228189015,262144 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,15610090691736656931,14262164835253128868,524288 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,12440054205591848746,13270766135897226702,2097152 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,4374266444964433716,1293357247505459619,2097152 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,9159765906173391518,5368887930682222747,2097152 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,15593193852929770710,14891570133460141885,2097152 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,16749593279452128082,10722282002919311387,524288 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,6762210169482498926,13877016242032079996,2097152 --field-trial-handle=2100,i,12650066526088273277,8073283078969116203,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5264

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SplitStop.jpe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8676e703-f8f3-4f00-86e4-b671d94cc5b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8676e703-f8f3-4f00-86e4-b671d94cc5b8.tmp
Size 131KB
SHA256 f4aea7e61a4b076a3c4f32ef1f9d42523f6139069d241c88d425c73b5bc54e1b
MD5 d1e9cc47656925d03e2007517b44e276
SHA1 4977f56280a25a78cc7390aae55315a7aa75747c
SHA512 b53a0141d39afa641c1a675dcd73b10bba58fe71975652f8e939ee34ce2708e50a0bb4c473f780677685975fce69db983a0f7ba610765ca0a8dc9d9e48e79503
SSDEEP 3072:7qIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:7KPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T11CD312217D01BCB4A9AEDB21B1902A15EAF8DD4B95397FE61CDE3F4805A36D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 fd740c5526bb01f7594bb065be4727deaf7cb7d75f1b26cadffeaf9336d66869
MD5 c988fb05a2323c80ae25c977c64c1ffc
SHA1 2b26fc30a5b318ac59c8e4395c2f6dabef3e41e5
SHA512 91e89987693c888d11632f220eb67e654caf4f13399a9a022ca581c87aa1105079212482c9d7ace56060f791cc31fc0774b3bba4fb79af27a3a4311296afe507
MD5 SHA1 SHA512

Submit Download

6f3cde60-6f37-476c-9f2e-a6b24828a249.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6f3cde60-6f37-476c-9f2e-a6b24828a249.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7df01fcc-0801-4a52-8fac-b0f6d00f1b8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7df01fcc-0801-4a52-8fac-b0f6d00f1b8e.tmp
Size 17KB
SHA256 32e6c0a3f05682d1e24f62135a16a559239bad390f6d29f2c3f6be9606c5db00
MD5 dd640a034f45376f3fcaa0a994fd4c07
SHA1 84453886df3f8873a24f080834e8931fb45a049c
SHA512 f4914452222e94317f3fd39a2a4bf91384dae0f2bcb11a077cd1c0143c27df3b5988a42d81e29fc71842f0242fa488537d4bbb16e9e30f0e2c39407ce6dc1661
SSDEEP 384:nVjD27KxkXqKf/pUZNCgVLH2HfgslDZ7pLuLceSx8XODDS+ErU3s7HG+I4QEry:nFD27KxkXqKf/pUZNCgVLH2HfgsFZ7p5
TLSH
T1D772E8677C4899370F94CAC8D8267F4FACB9025B65ED886553FA582503D4BCF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9abafbc0-5f8f-496c-95bf-70c2de3f29a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9abafbc0-5f8f-496c-95bf-70c2de3f29a2.tmp
Size 649B
SHA256 0c2b823f7ab362231b7e8d2e383bdefc6ac5e6b5fefe301da29242fce6900c9d
MD5 63d16d4b2c371f7f1344b8d37f6e14e7
SHA1 880689fa4bd6076e125ab2683f4624885244a820
SHA512 ec1ffa207a692f1974e29842a53f5ce5bffaa30f6812bf2c226c85a9d36944be3dd5e975cf2b8ce9fdffe1e74d72380b7ac46041e99a96a7360571c873c79719
TLSH
T126F044B5C921AC2718FC1B2D60A40B4AE755232B2A90984B3A3C410C8FB063B459691C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 168B
SHA256 bdd014b3e47c04e3e7bb063acc54e2b0091f81cf056a5ec8056051c036b97c01
MD5 52a37c2c19f68a95bfc56a42ba1c5010
SHA1 59caf3db33da96bfc17ff54dff3749bf8cb9f815
SHA512 860ea83f79c7e00ef77981b171a571943bf5868486b15f89b11291ccbe323069a0baf57f90c4510d58e737311658de3e60c0626c043d6db905fff78226a9e209
TLSH
T135C02B0E85305301EF3404F47BDC048023E4041400047143C1D2C05C7C331D15D01D18
MD5 SHA1 SHA512 TLSH

Submit Download

14d87df5-2e0f-41a4-a3e6-73c4d64dec6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\14d87df5-2e0f-41a4-a3e6-73c4d64dec6e.tmp
Size 5KB
SHA256 3c8dadb01b1f78bb18d680d235aa407a9a0abd06171291096a48948f9bb59d92
MD5 9afe71d4a1e42a9e14fe70290117ad7b
SHA1 7ee95850ec3846450fa28a2f54096d7e5c912cde
SHA512 b124a587b50f0da02ad01c86fef7ed5697b80850ac1a4214effc7e83db29bda8d53e01a978a95f07a5150d78c6f064eb156a22bba9b0faefff0d51f137a23b19
SSDEEP 48:YALlhHqTqqq/hSVh4hXhChKsbRsyXLscfoKslgmzsgLfsg2VosoKsy+spRqzs8CB:D9y9KEiV0r1peHaYwpcCqoBkHLbWR
TLSH
T1C8C170F7C3D8C62DC81196F897166F1ECE2D4A28422C3C67C8D9AE5B97E2871D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47e33dd4-b68e-44d2-a7b7-560adf8b24c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\47e33dd4-b68e-44d2-a7b7-560adf8b24c8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

987c7a5a-7ba4-4c3a-957c-6de178b747e1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\987c7a5a-7ba4-4c3a-957c-6de178b747e1.tmp
Size 858B
SHA256 6324096fd030f0186a29cd7fa5f9839b8a7b345b5e19dd4395490052183a5c1d
MD5 e54b002a80877cb6882bffafc2dcdd47
SHA1 d5b0fc3101772632f67ecb1f567ba09781e0da18
SHA512 f732897749bf5600c034cca6f517338e632a31b02241d1c0452d0494983e0429c84211d8d54a0fbd4c8f7daded584ee4c1e02100ea66e1fb228a8afb06c4b956
TLSH
T16D114C57E3BE7437107948BA5E48F80956B5AC395251B5F4CE7F82ACB0854F30F52027
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 83086d17bbc775a2d5e0228e68b61e1c549aad7125b435c6adc2b7470577438e
MD5 cb4628177c221cbb7e52625cd24034d7
SHA1 ab7fa9bc5134a9e162a252d8f4c68e35a84e0da4
SHA512 ec646bf053bb97c449a147474118506e80c0f14888d394e0f11133563cede63edb8561790e384cae40941e3d39c55e0d21b951b3566622eac11fbd9cbb2b19f0
TLSH
T1CFB0124980415301C04302B0116054887599DF11A6051302C1F42F01D83A562802F298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 11354f0ff17ae87d989aee1424b29ac031069d0d9d6ffd8065b633e188cfdd04
MD5 f85c65fd7ec44c027c88f0c4e81ff489
SHA1 bb027cabcbe3a9d9217a7a8eb71f6e6d95bd0b4b
SHA512 e2fe38bbbb8a29ea6f699f79292f8b1fe3acd32237d597dcd316d1ab3a11e098cba39e28eca610d45570102d83d56aa13aa850099f0c011fbf6300a337720d65
TLSH
T15EB02202C0032202C00203B030C082E830A0CF3AEA033A02A3E00B32FC22B320222C20
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 6d69b60ef3463270baaf9101472ba84520d2e0891cc9cbee63d6ff690a6d58b5
MD5 1278c42a3fa447a399a63c478312be62
SHA1 3b92926618ea27831062cb86521cffa69b2c7c54
SHA512 b0c50ea5f76a78e46158c7036fe8514691b64542d42cd6c81d56fc00be918fb0d4dc7038349a167d2ac4ce755b9807a1ff7d3ae08c687a7a1225ba5dcfaf8468
TLSH
T160B02280B082AE03FA0003F030E38CF233202E3B03CB3A0322E800E8F8300B002C3200
MD5 SHA1 SHA512 TLSH

Submit Download

ad1a89a5-6538-42ec-9ea2-09b21d86eac5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ad1a89a5-6538-42ec-9ea2-09b21d86eac5.tmp
Size 13KB
SHA256 6ebff7884421a41261b1d222afc11317a9186ed0f4cca5f59a8b8639098c929a
MD5 94990b1132d3950f952ebb4bf292db60
SHA1 61df966ec4dd658881a01c414f18d3a2170cd679
SHA512 463311b8d664c83f5d61245de5b61cd9070b0fd6fbe4d263dbe8cd7ab8715ffabb88ab1de729bd2a7084ce0c14b11a83e58c20e6ed85aaedb9ea7a08836b868d
SSDEEP 192:NRkcBzToVJ6jbv7AWpAPRp2g7f9+Hsb+WNIt7Yr9626+2eIkwGz4PyIsnAUgtaJ:NRkmzTdjzUXVgwzA2d2nmW8
TLSH
T1A352D76EAD24357B9CDAD62AF9117B5BD7FD202234A41D84EBFC892C24D79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcede17f-bae8-4b89-b604-bda983dc3ae5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bcede17f-bae8-4b89-b604-bda983dc3ae5.tmp
Size 12KB
SHA256 248b6cbaa8e47f4caa4a4467a0e53781149c8af32d07234387c896813ccf645f
MD5 2dbbc2deb5256f979149fedc0005b143
SHA1 528dcfea644653172281b6d866f9cfff875b62f6
SHA512 44ee7a0b8b4abc5b92f00b07b7fe0be2013a14937be137dc02be7fd9b175f757885fce8f9a1547e97e137afa9978e7f9618021812d2faf526a311080370041df
SSDEEP 192:NREOToVJ6jbv7AWpAPRp2D9+Hsb+WNnFi0V+2eIkwGz6VyIsnAUgtaJ:NRjTdjzUXogwY0s2nmG8
TLSH
T1BC42D76DAD24753BACCAD62AF9117B57D7FD202234A41D84EBFC892C24D79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be4b10b2-73db-4625-a7c8-1c79add33d64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\be4b10b2-73db-4625-a7c8-1c79add33d64.tmp
Size 12KB
SHA256 72e2399c341ea89fffdebd588bb38d5ce1cdf471ea265da25d285a423f9b2d0e
MD5 f220ab33d677bfac8690a76c504a887e
SHA1 a0cbd9969087f25a12991b4894a3799886632060
SHA512 d72fd9551fb4c01f08ede1f23013ef3049ac6040b177e2568bde9384b9c2564453ad3533df2c4779dee879465a341ff60183201709f95049da06e3b339570689
SSDEEP 192:NRE2cBzToVJ6jbv7AWpAPRp2g7f9+Hsb+WNn7Yr962p+2eIkwGz6VyIsnAUgtaJ:NRfmzTdjzUXVgwMA2Q2nmG8
TLSH
T12C42D66EAD24757B6CCAD22AF9117B5BD7FD202234A41D84EBFC892C24D79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

acad4f14-9847-49e2-bcaa-8bbf01c92ca6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\acad4f14-9847-49e2-bcaa-8bbf01c92ca6.tmp
Size 264KB
SHA256 8240606c1b400ff6aee67f5c1d9c2f9d41c35adba259d1f0483b13f215309e9e
MD5 1f866a4250d7ef330850f8e1b16590c1
SHA1 bb42eb58fbb03b5c6e8ddd1ceb0f3a4b6149e239
SHA512 eeed9571a4b3801fda71c985a44d01603970586626c627e75280664517cff7da10513f8c2188fd9681e87a1f59fd2558c1ad9051d91f2c1232bcbe5af5cc39d3
SSDEEP 6144:SyPoH/qdKfVUl98g3iPLbPtbmf1K49XLWbEPi4NTKlLzr:DoHydo+98guL7ofM49s4NTK9H
TLSH
T1F04412223D09ED70FDFDEA32B2111A0967B4C90D85BA7FB74ADE5F8C09926D44608C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb98b453-42ce-4a9f-8070-9eaf4b4c5fba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb98b453-42ce-4a9f-8070-9eaf4b4c5fba.tmp
Size 264KB
SHA256 3f1e0d5304debffd10cc621cdd56d808f13c8137868bfde3087e374397e05faf
MD5 21a50fdc0e33a1c4a2f76d53e74abec0
SHA1 2fba9fcd54b3d2be9d089df7638ca1b84ff74795
SHA512 5759169728b6130208046546105d08720e508357a63624560ba0e4dbe9e09eeac365fe3231ee8972b4bdd41d9bff0f36f932e04d8bc8b572735882b6bb6b3771
SSDEEP 6144:SjPoH/qdKfVUl98g3iPLbPtbmf1K49XLWbEPi4NTKlLzr:koHydo+98guL7ofM49s4NTK9H
TLSH
T1B44422223D09ED70FDFDEA32B2111A1967B4C90D85BA7FB74ADE5F8C09926D44608C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4732-0-0x0000000000F70000-0x0000000001000000-memory.dmp

Download

memory/4732-4-0x0000000005EB0000-0x0000000005F42000-memory.dmp

Download

memory/4732-3-0x0000000006220000-0x00000000067C6000-memory.dmp

Download

memory/4732-2-0x00000000034A0000-0x00000000034B8000-memory.dmp

Download

memory/4732-1-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Download