3323aa41aef866c71beffa8e10d59264e6388b811226cdd415d8c30b538f5612

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amatled.exe
Size 29.2MB
Sample261107-vbdz3set7l
SHA256 3323aa41aef866c71beffa8e10d59264e6388b811226cdd415d8c30b538f5612
MD5 fa065f0a631a408411caf541be14185f
SHA1 29752f8f7491afb87708ff76b4b2b402705be72d
SHA512 7a99eaac8029b07c747d7ce3d768553ca4a4a3fb0fb648d4e62232b7b0db56007ab40f6986ab99391685a71025ec5eb56200ee4ffe9f663baebad0cdd17d3169
SSDEEP 196608:7mia49tMR/+BeiyY3bDkX+GwXUykA+FyNU39Tv:7mT4bMRksY3bAXEnwTv
TLSH
T1E0676D43E8A144E5C9A9CA34C5228123BF717C468F2017CB7B68F6A46F7ABD05DBB750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3724	chrome.exe
2360	chrome.exe
1100	chrome.exe
5472	chrome.exe
5220	chrome.exe
3444	chrome.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	amatled.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	amatled.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1236	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1100	chrome.exe
1100	chrome.exe
3120	chrome.exe
3120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1100	chrome.exe
1100	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1100	4156	amatled.exe	92
PID 1100 wrote to memory of 2236	1100	chrome.exe	93
PID 1100 wrote to memory of 1236	1100	chrome.exe	94
PID 1100 wrote to memory of 916	1100	chrome.exe	95
PID 1100 wrote to memory of 916	1100	chrome.exe	95
PID 1100 wrote to memory of 4356	1100	chrome.exe	96
PID 1100 wrote to memory of 4356	1100	chrome.exe	96
PID 1100 wrote to memory of 2360	1100	chrome.exe	97
PID 1100 wrote to memory of 2360	1100	chrome.exe	97
PID 1100 wrote to memory of 5472	1100	chrome.exe	98
PID 1100 wrote to memory of 5472	1100	chrome.exe	98
PID 1100 wrote to memory of 3724	1100	chrome.exe	99
PID 1100 wrote to memory of 3444	1100	chrome.exe	100
PID 1100 wrote to memory of 3724	1100	chrome.exe	99
PID 1100 wrote to memory of 3444	1100	chrome.exe	100
PID 1100 wrote to memory of 5220	1100	chrome.exe	101
PID 1100 wrote to memory of 5220	1100	chrome.exe	101
PID 1100 wrote to memory of 3012	1100	chrome.exe	102
PID 1100 wrote to memory of 1872	1100	chrome.exe	106
PID 1100 wrote to memory of 4760	1100	chrome.exe	107
PID 1100 wrote to memory of 2120	1100	chrome.exe	108
PID 1100 wrote to memory of 3120	1100	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\amatled.exe
"C:\Users\Admin\AppData\Local\Temp\amatled.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files/Google/Chrome/Application/chrome.exe" --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-infobars --disable-extensions --disable-features=site-per-process --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-sync --disable-translate --disable-windows10-custom-titlebar --metrics-recording-only --no-first-run --no-default-browser-check --safebrowsing-disable-auto-update --password-store=basic --use-mock-keychain --remote-allow-origins=* --app=http://127.0.0.1:49791 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lorca2132909744 --window-size=1280,800 --remote-debugging-port=0
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lorca2132909744 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\lorca2132909744 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7fff3974c728,0x7fff3974c734,0x7fff3974c740
    3⤵
    PID:2236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,17894137236322923097,13636673892094033067,524288 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,10399124020892240743,7042432379886830122,262144 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=320 /prefetch:2
    3⤵
    PID:916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,8514396250527581710,11110510597745374185,524288 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11069674205831662758,10881584037139717418,2097152 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,17594014610984426258,525056821486559755,2097152 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3756,i,12119295278136944560,4815778835519917902,2097152 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3764,i,16793998768454273472,11176655944567607954,2097152 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3232,i,15474878486580222197,2623358450049495182,2097152 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,2198456294255722123,12771488033138481464,524288 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,14559941976477957470,16013756961453298394,524288 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,1673374828771904098,14378254370821225045,524288 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,8754747216579338842,7610552026643334431,524288 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
    3⤵
    PID:2120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca2132909744" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5752,i,8280330043085814554,1220332010816347643,262144 --field-trial-handle=1816,i,2331737768662737811,17001596339110438090,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2e41fc77-5802-4e76-ad02-26086b5d1e6a.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\2e41fc77-5802-4e76-ad02-26086b5d1e6a.tmp
Size 3KB
SHA256 f98ade4ad82c424022d50b6948cf5dbac7aabf71e08ce258f460d0e0a97de816
MD5 c9122ae67886f05e3c287a645740835a
SHA1 da8684d210845e05d9f16cd941141408a8269ead
SHA512 f5b4a2c0d57392327a29ea8dca6f43d3c7155e3ff1f05a27b387537287bdf3fc15e0f09950cf78f72159451d1ad83e865ee064b5aee8844918d86207ceb93488
TLSH
T11E71E8B0B0A46CB365F6D906B8473D03DAB8B266D1135F54C6EC0E2C15EB5DC23C6927
MD5 SHA1 SHA512 TLSH

Submit Download

1e45780f-5b68-49c9-b0d8-14698c498845.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\1e45780f-5b68-49c9-b0d8-14698c498845.tmp
Size 6KB
SHA256 9b609c714887fc3821100bd1878a956fdfc9b7f885d2544e611a5c885d4ea47b
MD5 9e1daa215d2e8335d0ab4e622850e99e
SHA1 db1f3e2c3596bb2675dc68712bdf6c5e96d2c1de
SHA512 d399ab76bb8b21b3d4002151d1ca8af6def2a189c942b7a26e5439ccd529cd8af449f2c440b2491a446a94125971c9e784e21b091a0bb578f43c411cf9b6d7e2
SSDEEP 96:zR6hHE1FqSAYDHv7C8bWhE0Ri02tWA1juX792b+WVoMkm+TeEbD1AOj4d86IJ:zRKk1jv7C8APRp2nSXsb+WNabD2FdkJ
TLSH
T18DE1A626AD24B9379CC7C21DBA75BF52E5F6603025DA0D045BFC893C04EA6CD324B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

500bce92-610c-4588-bab8-e7c5effd182c.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\500bce92-610c-4588-bab8-e7c5effd182c.tmp
Size 7KB
SHA256 2befa564d496722c52f733eb820a2e33a6af340b929ac574e5964ae2b5ba23e9
MD5 445fa73148f00b64ae8727154b039841
SHA1 1136eb467e6dc09d5812a5d518fb916b387e3a93
SHA512 e7c0f42e8eca639e5ed487f2c32e99cb83495ab03aa673b95d0dc0e31fbce2ff0f5e83e33e68eaf805dd02a66014ed65bd4342e4916489f76567ad1520ab2110
SSDEEP 96:zR6hHE1FqSAYDHv7C8bWdE0Ri0ytWA1juX792b+WVoMkm+TeEbD1AOj4T86TK+7:zRKk1jv7C84PRpynSXsb+WNabD2FT37
TLSH
T19DF1B626A824B937ACC7D20DBA75BF52E1F5A43025D90E086BFCC93C05EA6CD324B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 f8e641c37ba1d602caa5b219b799d69c2e58dca26d519c7a9d7a3ec6b2c5fdb8
MD5 f32fe0d0984d8779c3054e1972a4c184
SHA1 8aac50935421b8fe82a394581392b7cc1ba65901
SHA512 88542715bfa4bcd42123c6f611244fd9c2492b0fb27afee029444bd0aab0355f222ca5ac3383f7dc5767616b6b64826fb5e2ff08d0ccdb6bb126b6e256c516e4
TLSH
T163B0220022A8803BC3F003323082000033B3EE20C3AA23A383EEA0B88C003F8C308000
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 36f0114b77505c3223c678b0ad0d1423a30fca319dc0562cea258070624f336a
MD5 8fb904966a08fe199e5ac3e678062b5c
SHA1 29524fcbbb032e94c55c6e5943a30b75438caafb
SHA512 55a0abc90d374d4a6692d92f3bcd0869ac6e4d28275f2c77c8189ebe08fb1ae8c2c178a6fbb9a90b80ec6420ecc54786f2851b7f1f72411aa6b741d8bafdaf2e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

59ba6303-bbdc-4897-8e6c-d152fc9b4715.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Network\59ba6303-bbdc-4897-8e6c-d152fc9b4715.tmp
Size 1KB
SHA256 efa5723a563f1a3404c3415323dd32024786b9348480b0c7c55044eaef35d539
MD5 056adbfb54fffb74f0d4026e69c8b5b0
SHA1 33005284f1f0c7c795831a27cd394e14d4c5b7a8
SHA512 f0c05d07b939b1bbc48105b3e0e1a26596980342b403f6a19cc39068fb849192ff45bb79cdcfad82b52dffd8485df7891e9bb0fb8872315ef9790c4b9d1cbb6a
TLSH
T1CB118CF3C3D8857D895102F4A7156E2BCE2E0508432C3C66C8E8BF5F97E2870D21498E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Preferences
Size 6KB
SHA256 f99bc45d00b9a4ee6f13706b67327e6e78ab0f57f103e7190be698b1d9f1dc32
MD5 f6e72461fb418565d5328c1106e0c582
SHA1 9f86b84b01e0a044da332e78e3d68abd6bc30de1
SHA512 5c15776d5b918f32dc36e75c64e9014dba2878deaad8a741b74952bd40423da37c517231a72089e40a87907e32a8550f138924bd937b72cfcc1844700130a14a
SSDEEP 96:zR6hHE1FqSAYDHv7CFbWhE0Ri02tWA1juX792b+WVoMkm+TeEbD1AOj4d86IJ:zRKk1jv7CFAPRp2nSXsb+WNabD2FdkJ
TLSH
T18DE1A626AD64B9379CC7C21EBA75BF52E5F6603025DA0D045BFC893C04EA6CD324B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 a2bab2727d98d0d99e8a62d7994949092eed3fc3c93064399f61d17c6fe5cd61
MD5 11d6ed6714d0d24e8d730ac79c4465b0
SHA1 780e811e0c867289f55fb42b0a6f1a3674451b9d
SHA512 3e3696c0b171f3b8d8f30fccf20da7aa8e0fdb5f8dc201a39adbb4d172ef1cf3867952082a42734c3fb247ef95859b7a28c8270abf895ec34fbd8d678a92411c
TLSH
T12FB02202C80202A3C0A2C3B0208022C83032EF30CA32A302C3E00EC3CC223F08338B20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c748723360d90ca866c388a0d6807755eab7053944ccf258541064f47d314c96
MD5 156eda0845bf55b448b8618e3cb2d937
SHA1 cc33de91207021abe2ebd0f69239a377d95def36
SHA512 14d9688a9477797ba467c9bef8c159c30cdecb4d76e673ebb11b539f90ffc075447f5f14cc605850655d7637befdfc066789648b00dedbb8f6b619233d0ae8e5
TLSH
T1B1A0026703468630C50106B03C1987C85200FA65A100072776F1035BCD600548F1214D
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\Local State
Size 1KB
SHA256 1cb0c69b874fe527f33190d816f7bd9c213f9f5bbff11338793ad291d13734a7
MD5 1e2d4b4eead703aec466bfeb12de1545
SHA1 95566e41b79d4f3b31688b7461c801d96612b2ef
SHA512 ed50d0f5eab5ffbeb5df2d4a23b8f4ca31044d0f716dcffc9120a1fd2ad96b156326edf8cf527b9c94a10094d3739a13f68fa56bdd3d537355e61bcb139c8777
TLSH
T12911A870B0B436E1E586884A5486AEAB5D38A333C1638D48A7CC5D145DFF25CB517C35
MD5 SHA1 SHA512 TLSH

Submit Download

e5a44fbc-f992-4e03-bfb4-6e929f10e59f.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\e5a44fbc-f992-4e03-bfb4-6e929f10e59f.tmp
Size 3KB
SHA256 f17c98db87d940d143d08efb621a6990710963d23923508f16201498c67849bc
MD5 e63d344391aa6242ed36f818d1a47d84
SHA1 86282302872791ba8d339d03a8e2db76a314a7c0
SHA512 ee29caf87f8c39f46cc798d88a616c4129d299ed81307c4145be1b3b94948f70797874e726f04bb8a4d4bc1fae03a1790f7175ffc4362ebb50fb9fa29c6114f6
TLSH
T18471D7B0A0A46CB365F6D906B8473D03DAB8B266E1136F54C6DC0D2C55EB5EC23C6927
MD5 SHA1 SHA512 TLSH

Submit Download

250a1afd-156d-4143-9987-4da3b1b55960.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\extensions_crx_cache\250a1afd-156d-4143-9987-4da3b1b55960.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fd912410-77d4-40e5-a95a-167ba683c709.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca2132909744\fd912410-77d4-40e5-a95a-167ba683c709.tmp
Size 3KB
SHA256 fbd60a0070a684bf396ad3e30b4a7dd4962fee09e137ce2cb3300b1ba31db46c
MD5 e398c637f2c80f7ef1ebc56a954120d0
SHA1 b7ff4275b5ce10b59c5b559d39c75a379753e28e
SHA512 fb060720cf845c53459a84621c2abee1b7bb68a288c4ee0e06299abec1bab4f34f28e6f9347e9bc52b8bb08103dcfe74690ec8f827517ded221dd42dbfed8c59
TLSH
T10281D8B0B0A4A8B365B6D906B8433903DA74B266D1136E54CAEC0E2C15EF5DC238B927
MD5 SHA1 SHA512 TLSH

Submit Download