5399eb989774ea0c14eb453481f030838cdd0f56a888fd8cdbc2ca7f931677fd

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amatled.exe
Size 29.2MB
Sample261107-vba87aet7j
SHA256 5399eb989774ea0c14eb453481f030838cdd0f56a888fd8cdbc2ca7f931677fd
MD5 33742415146eef97f8b19e9ae5a039d2
SHA1 24c683100c9093550750b69619af4b47b0b43186
SHA512 65e69b710188796ab6cd924acba26feaa54b3e167a2d9c258653aaa769f419a3d9ad9f59542df2424eb9915d180542b5804b13b05cb1e88f44499d2dcc52c25d
SSDEEP 196608:i3V0GPRHSN7J3vkyMfHJRo8aDb0oKXUykA+wyrGpBPtTUVE:iF0GJH47JcjHJRy/0FZtT
TLSH
T174675C43E8A148EAC9A9CA34C5218523BF317C468F2017D73B68F6646F76BD06E7B750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
896	chrome.exe
5724	chrome.exe
5596	chrome.exe
6060	chrome.exe
4088	chrome.exe
5116	chrome.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	amatled.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	amatled.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2416	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5596	chrome.exe
5596	chrome.exe
3892	chrome.exe
3892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe
5596	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe
Token: SeShutdownPrivilege	5596	chrome.exe
Token: SeCreatePagefilePrivilege	5596	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5596	chrome.exe
5596	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 5596	4356	amatled.exe	90
PID 5596 wrote to memory of 2624	5596	chrome.exe	91
PID 5596 wrote to memory of 2416	5596	chrome.exe	92
PID 5596 wrote to memory of 8	5596	chrome.exe	93
PID 5596 wrote to memory of 8	5596	chrome.exe	93
PID 5596 wrote to memory of 2688	5596	chrome.exe	94
PID 5596 wrote to memory of 2688	5596	chrome.exe	94
PID 5596 wrote to memory of 6060	5596	chrome.exe	95
PID 5596 wrote to memory of 6060	5596	chrome.exe	95
PID 5596 wrote to memory of 5724	5596	chrome.exe	96
PID 5596 wrote to memory of 5724	5596	chrome.exe	96
PID 5596 wrote to memory of 896	5596	chrome.exe	97
PID 5596 wrote to memory of 5116	5596	chrome.exe	98
PID 5596 wrote to memory of 896	5596	chrome.exe	97
PID 5596 wrote to memory of 5116	5596	chrome.exe	98
PID 5596 wrote to memory of 4088	5596	chrome.exe	99
PID 5596 wrote to memory of 4088	5596	chrome.exe	99
PID 5596 wrote to memory of 2168	5596	chrome.exe	100
PID 5596 wrote to memory of 4444	5596	chrome.exe	105
PID 5596 wrote to memory of 1984	5596	chrome.exe	106
PID 5596 wrote to memory of 936	5596	chrome.exe	107
PID 5596 wrote to memory of 3892	5596	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\amatled.exe
"C:\Users\Admin\AppData\Local\Temp\amatled.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files/Google/Chrome/Application/chrome.exe" --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-infobars --disable-extensions --disable-features=site-per-process --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-sync --disable-translate --disable-windows10-custom-titlebar --metrics-recording-only --no-first-run --no-default-browser-check --safebrowsing-disable-auto-update --password-store=basic --use-mock-keychain --remote-allow-origins=* --class=amatled --name=amatled --app=http://127.0.0.1:49837 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lorca628546723 --window-size=1280,800 --remote-debugging-port=0
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lorca628546723 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lorca628546723\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\lorca628546723 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x108,0x13c,0x7ff8af23c728,0x7ff8af23c734,0x7ff8af23c740
    3⤵
    PID:2624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,7494313169471834114,16216510566795056878,524288 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,7923647510259074825,859860561237338686,262144 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:8
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,6254029338182543986,13096911495717338574,524288 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
    3⤵
    PID:2688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,7711529860846371136,9554718829693298354,2097152 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:6060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,5598792132216259872,3340738887028665376,2097152 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3976,i,5262963155141767592,2623556951895282680,2097152 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3996,i,15705514695854956776,14427202735655479765,2097152 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4804,i,653528905877226836,1219455328068573478,2097152 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,15719996455716034527,12961971941421722083,524288 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:2168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,9122240778590597472,17164622577609570031,524288 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,7024960178256476702,3500608603818825943,524288 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14
    3⤵
    PID:1984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,17318326436473415722,6443168700707358888,524288 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
    3⤵
    PID:936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca628546723" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5784,i,7856589426100235416,17076090116628921039,262144 --field-trial-handle=1920,i,13009002503288801316,8705913287819625841,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6c996426-128b-4bac-b7ef-6c06cf5cfafd.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\6c996426-128b-4bac-b7ef-6c06cf5cfafd.tmp
Size 3KB
SHA256 11b63915786eea6fa67faba2de316e4f293ac6744faaedb3d03ab00e2c9a3429
MD5 2f0d4def21b2e9ffbfc605639f984c68
SHA1 500e2c913951118e62b2913d706b4bdd548f245f
SHA512 473ef5bf457a82b5a0d474d246307630d8c4c845723fd62fdf363b9049a515fd929720652e6d4a15a5e84965c40071f411302ae52f10f50086fac4791f64b4af
TLSH
T1FF81E970A4ACBC3269FAD405F5022943CBB5653AD9263F94D5FC0E1C10EB6DC2747A27
MD5 SHA1 SHA512 TLSH

Submit Download

778387f1-359a-41f0-a474-657a67e0e58d.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\778387f1-359a-41f0-a474-657a67e0e58d.tmp
Size 3KB
SHA256 a70cca434c8eaef3b44d9b859b19dbaa4b5ec9b1cdf25d445f159517696d1d7f
MD5 ff0d13a19fa712d33e5e39088119073b
SHA1 8821d26ae7ad9e124175b1d0493535567e1c97ae
SHA512 82bab6dacea354146be14f1bd8f184f0bf452f9fa2accc25e612acda7af4196c2f5b4ffb59d57c631f5d1cf19997471d41b41e58aec12ed2793ccfc679307323
TLSH
T14571EA71A4ACBC3269FAC805F5021A43CBB5663BE9222F94D5ED091C11EB6DC3342A27
MD5 SHA1 SHA512 TLSH

Submit Download

8a2d2746-d176-4f8a-9fb6-e99ffbbf97db.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\8a2d2746-d176-4f8a-9fb6-e99ffbbf97db.tmp
Size 3KB
SHA256 01197c0ae04141661ca431d9a778563eab618518a64d811093f5f8bad0a01701
MD5 fcb6d3306570516abed2b7c393366382
SHA1 956f2f38a7682830af12e0f9dca65fdc5b444f08
SHA512 f00a2884bffdeb167db55f5f99e167b9c05cb565377aa686c797d3b59a8aa96e7ba32b884439acc33d473b6708be59f987b94b709dc2224e598f68984abc1c36
TLSH
T14D71EB71A4ACBC3269FBD845F5022A43CBB5663BD9222F94D5ED091C11FB6DC3342A27
MD5 SHA1 SHA512 TLSH

Submit Download

7b13da85-a740-4140-a216-148431c0392c.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\7b13da85-a740-4140-a216-148431c0392c.tmp
Size 6KB
SHA256 39ec4b0711707c9d48210811440a41650d6e011f464f7ea40a00be459759a1a8
MD5 622624e37609ae250e13f07ccb15419e
SHA1 34e906346790e000f7fe3ef0c904c311ab19aff5
SHA512 88a601bc9f6f628788b9fade4b136626b884cccaadc1048449bd54eb0d62528901bb84ef251ea2cc58209301126bc0c30c2e44c36627f8c9e0059ea76f7aef18
SSDEEP 96:zRE954GI+Ss4LHv7KKobWhE0Ri02wWA1auX792b+WVoMkm+TeFaA1AOjPO86Rt/J:zR8Dcv7KAPRp2UVXsb+WNHaA2zj/J
TLSH
T167E1B815AD58B5379CDBC20EB935BF92E5F5503016EA0D046BFC893C05AA7CD324790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 ca18db5a8eb1e67c0073749d09d47efaf2f107cdb83c424d4c361ae534579709
MD5 1eaf664b8cf4a1811ea35ebd29444636
SHA1 1ea2e389e98d21e4612ca1916b9f210ab238a5b9
SHA512 f292e890712b98c38c403d6562f1896b13dde1a37e835166083f131019fd1eb228a73f80dcb3199d65877464e6b1f265483d067faa5d89f34713e5aec4e3f512
TLSH
T19BB0110820A80022E380833A38C20000AB23AE38020223AAA2E8A0AA8C002A22B80802
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fa2d5520b5b719a757c6d457eab37a334efa0152873b0dcd9c7702a5af8100a2
MD5 cda74a0a40c68a01920891588f0ff3c8
SHA1 731ae80f366f1ce83c57976da9477da9d50a6036
SHA512 8eb96e9bbc4b310d2eb3d6418435c719922dcf7128399fe24a09f1a4052f6f28be4d028d207a644caa9b6eebbe43cd7648c7540bdf514204476b643fcc694a27
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

35696fe9-8081-45b3-864f-e745995a2134.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Network\35696fe9-8081-45b3-864f-e745995a2134.tmp
Size 1KB
SHA256 2246b3dd7ec1a999af46ff995ab0b721dfca61ee3b70e328ab12b8098abd6f76
MD5 aacbd7b4b6dbf8d5d1c225f5fcbc003d
SHA1 aa16148fca22998f7018e7d8a77810f798c4705a
SHA512 715aef16c4c7ce9e32b9c63c6c4edf591f77f194663654271d13c36158a77af102bc936a4592c3fac080c9ffc0d468c750fc65dcf7ab1805632a8891980d5607
TLSH
T1881180F7C7D8857D895102F4A7156A1BCE6E0518832C3D66C8D4BF5B97E2970D11058F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Preferences
Size 6KB
SHA256 9b213b525c35c4bf8c28b44f8aafe6ea00cee3512b62296af7ef5509d09052f3
MD5 01902584d0d7832b7ee155f57b8831ac
SHA1 574a37a607bd76903c70b300c469e72d2c3db8a4
SHA512 ffe0820d2065faa54f26a73d74d8f0bcbced52d4a132115d3bc83caebe81b922d2f0f7e3d24353c12a1ae3d65592bee4c6d1015a23d062428b16f825dbd6dd80
SSDEEP 96:zRE954GI+Ss4LHv7KKBbWhE0Ri02wWA1auX792b+WVoMkm+TeFaA1AOjPO86Rt/J:zR8Dcv73APRp2UVXsb+WNHaA2zj/J
TLSH
T18DE1B815AD58B5379CDBC21EB935BF92E5F5503016EA0D046BFC893C05AA7CD324790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 fdfb19b56fca7b080aafc92ac5c275abd7e3c9e200b78743cd6f9abd0ae2190c
MD5 3cdfa95bf7cdea0ef15da299f0c4489a
SHA1 1f4887b188854bc010639e774842d7a533d5a14f
SHA512 3c25fa617f9f7cb7004a917cd7927f405d73e171b9bf7aa25303df339c1d7180e06c4e2f3c57e0f7e5826ecc3d4fceb6ffa214f947efb716e9f0df7ca6ef2351
TLSH
T17DB02202C00200AAC002C3F0228E00883023EF30C202030EC3E02A82C8823E0333FC00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ce5c5fb34887dc17147d948901bc4260707afc5ef4e6cdc2011361b77540f743
MD5 db4e6443ac319e5d1b470a5aa6208653
SHA1 57ba8949aa2b1198aa6d15e82c4f2c2200bd15bc
SHA512 e694e08a7c516ebfc32456d0df15a58010c51310349b48485b0a0b1eee89d218d97040bc7e2c2388e2145278dbf5653d23b3d9d2648672843b7ccfcfbd89aacb
TLSH
T145A0022512418572C15083B469C183893660B96583070313B6D00776DC602508E16354
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a1624a5c-2093-478e-8d0d-8fe653f56337.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Default\a1624a5c-2093-478e-8d0d-8fe653f56337.tmp
Size 7KB
SHA256 836e43f07ee851bc6aee2bc11d2a347fe8a30e38459ed05421dd2c796e27faa2
MD5 98dcf88829ba0c64a3ac04d636e86e0f
SHA1 06fdfa68bc5823cd29eb4d56f15bb8b31df7a7ff
SHA512 280fa2ffd36fb2629405e2b5bf4854683eae49a6a229ced53e11797b0caea90a03f0eb5d079d15d599b6828ce52f269def47b760c87e20a2569c4dfc9d52deda
SSDEEP 96:zRE954GI+Ss4LHv7KKobWNE0Ri0DwWA1auX792b+WVoMkm+TeFaA1AOjE86RlKBj:zR8Dcv7KMPRpDUVXsb+WNHaA2ju/7
TLSH
T1EAF1C826BC54BA379CDAD20DB935BF92E1F550311AEA0D0867FC893C056ABCD324751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\Local State
Size 1KB
SHA256 d7d1ef8564e0948e53caa18b1aa09bf3fabcc89f7905fce52b0b1ec761806e4d
MD5 4fdce30f340ee51692701c1697e16bf5
SHA1 f52e80ca3c4a00be5a67b4911a6e5d0ffc629d8a
SHA512 6c660e64acba3eaf93651e5b7f5a2a7bc2ad42bb96a63162455adab2f853221a53dacf922cb4d4ca6bb92809f68a5ac03346711fd5c7e6c4b170a4bc138a548e
TLSH
T1F911A57194AC3F24B9C68A48D600C7D30F3A563BD4771ED876DD0041017669C3B06E38
MD5 SHA1 SHA512 TLSH

Submit Download

c65f516e-b48b-47ea-a57d-b118a14f2c39.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca628546723\extensions_crx_cache\c65f516e-b48b-47ea-a57d-b118a14f2c39.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download