2339a92651d7a791dec9cfc030aa01627273fec8b49b95977997a2f06271f471

Analysis

max time kernel
151s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amatled.exe
Size 29.2MB
Sample261107-vbftnsy14j
SHA256 2339a92651d7a791dec9cfc030aa01627273fec8b49b95977997a2f06271f471
MD5 85dd196fda8f1b4ab367b9a4b3b185de
SHA1 cd53343ff1a3960e3d1e825c84bc53e17cee356e
SHA512 a144a39d0dc3514a59758f4e29c20e7b7b5f2bd2802f202a0c12ea2dff50d0670ffda6fb91e7dff465664fda0038a1c8d3199440e38c94c9a7ac6d5e9b50471e
SSDEEP 196608:bKV9iAvEQRW6N7RrIrrEg73pzXUykAhFytUMZTa:bO0AMQRVZIrr77VWLTa
TLSH
T133675C43E8A148E5C5A9CA34C5218523BF317C468F201BDB7B68F6A46F76BC05DBB790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
6000	chrome.exe
1584	chrome.exe
5732	chrome.exe
4848	chrome.exe
3372	chrome.exe
1060	chrome.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	amatled.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	amatled.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1352	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6000	chrome.exe
6000	chrome.exe
3816	chrome.exe
3816	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6000	chrome.exe
6000	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 6000	3168	amatled.exe	89
PID 6000 wrote to memory of 4280	6000	chrome.exe	90
PID 6000 wrote to memory of 4900	6000	chrome.exe	91
PID 6000 wrote to memory of 1352	6000	chrome.exe	92
PID 6000 wrote to memory of 4900	6000	chrome.exe	91
PID 6000 wrote to memory of 4776	6000	chrome.exe	93
PID 6000 wrote to memory of 4776	6000	chrome.exe	93
PID 6000 wrote to memory of 1584	6000	chrome.exe	94
PID 6000 wrote to memory of 1584	6000	chrome.exe	94
PID 6000 wrote to memory of 1060	6000	chrome.exe	95
PID 6000 wrote to memory of 1060	6000	chrome.exe	95
PID 6000 wrote to memory of 3372	6000	chrome.exe	96
PID 6000 wrote to memory of 3372	6000	chrome.exe	96
PID 6000 wrote to memory of 4848	6000	chrome.exe	97
PID 6000 wrote to memory of 4848	6000	chrome.exe	97
PID 6000 wrote to memory of 5732	6000	chrome.exe	98
PID 6000 wrote to memory of 5732	6000	chrome.exe	98
PID 6000 wrote to memory of 4104	6000	chrome.exe	99
PID 6000 wrote to memory of 5828	6000	chrome.exe	105
PID 6000 wrote to memory of 5736	6000	chrome.exe	106
PID 6000 wrote to memory of 5092	6000	chrome.exe	107
PID 6000 wrote to memory of 3816	6000	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\amatled.exe
"C:\Users\Admin\AppData\Local\Temp\amatled.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files/Google/Chrome/Application/chrome.exe" --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-infobars --disable-extensions --disable-features=site-per-process --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-sync --disable-translate --disable-windows10-custom-titlebar --metrics-recording-only --no-first-run --no-default-browser-check --safebrowsing-disable-auto-update --password-store=basic --use-mock-keychain --remote-allow-origins=* --app=http://127.0.0.1:49768 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lorca3293213820 --window-size=1280,800 --remote-debugging-port=0
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lorca3293213820 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\lorca3293213820 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x108,0x13c,0x7ffa6410c728,0x7ffa6410c734,0x7ffa6410c740
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,10611638305844555971,9838164398582626429,262144 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:4900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,2261868363896476138,239103580112552018,524288 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,6585523187235031899,9467472017626285807,524288 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
    3⤵
    PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,3318714826804558658,8380223912053015048,2097152 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,8420740159239190609,6814129276105545641,2097152 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3800,i,5008128746888918398,10570943374057609511,2097152 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3748,i,10890273982967779492,12573794163863057373,2097152 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --disable-breakpad --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4612,i,8845140905453199350,15580118093686318514,2097152 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,16279841283225981671,9363259943703759551,524288 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --force-high-res-timeticks=disabled --metrics-shmem-handle=260,i,4194303637939655442,8583201993709372718,524288 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,9091895416656336711,3207234296441767736,524288 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
    3⤵
    PID:5736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,7531151730056722254,4247942662152562344,524288 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lorca3293213820" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5756,i,6149017739939167167,426516594298879586,262144 --field-trial-handle=2028,i,731197232829447034,17929914357349378909,262144 --disable-features=site-per-process --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

093a4d6c-7210-4a10-b0e8-a672a86451d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\093a4d6c-7210-4a10-b0e8-a672a86451d7.tmp
Size 3KB
SHA256 a36f0869fe7478a1bb70545838cd629cd9318a2dd41b29e88f2cbb34a7cc5864
MD5 58f2886bdadcd4731232f643540afb01
SHA1 5eeb891f0afbfd13ab84e4844069f07df0d2a685
SHA512 c873bf1f069d833771b66cb41000f7fddcb0a013abc517e0d7b706e90f7e702b418ce79f7ef33993675e5b040e3e7a501b891f9a85dbdfbb035f0c1de7020582
TLSH
T11E71EA71A4A8FC7769B6960679022E07CAB4335AD5526F40D5DD0E3C10EB5DD2387523
MD5 SHA1 SHA512 TLSH

Submit Download

2e891ecc-a5f5-49d1-b571-78ac22c3858f.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\2e891ecc-a5f5-49d1-b571-78ac22c3858f.tmp
Size 3KB
SHA256 1387e2c235c89c58079741b866209bbe2d5cd3cec8c7cd92c5eef7013ffcc3ae
MD5 da2f323fcbd2a6a4a9789fe24ab355f1
SHA1 9b89b37b41a75fda8e86acabb570282cd8b5cb71
SHA512 3fbc659a99e4a2bc202be8ce820230f4e0e82a3c49ae7f73b29ca6cff8ec4403ed2b8b6e9c6dbd2633a7b49cdabc57fc13a9cb4fdfec3f8c8f086497f12c0e19
TLSH
T1E2711C71A4A8FC776DF6860679021E07CAB4336AE5526F80D5DD0E3C10EB5EC2387523
MD5 SHA1 SHA512 TLSH

Submit Download

3fe3e340-3dc1-4057-b838-32970e38a7b9.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\3fe3e340-3dc1-4057-b838-32970e38a7b9.tmp
Size 3KB
SHA256 aeac21ed48e0c40679f2c8af5884f84c6a336f8742de126544c6aa62c0e4e08d
MD5 52b848c39a1cb84bc8103f7e841b3b57
SHA1 df2597e31169a0b70589237a53e4b7c0d02a1e37
SHA512 320a556d0e1e230d523eaffbf9dea6e6172b99d3dd8980cbd4499bff14db77f2878c6d5428d85e2250e84869051f8c0bf38f45732e8a7877f32b2549909538db
TLSH
T14B811B71A0B8FC7769B69606B9022E03CAB4326AD1136F40D5DC1F3C20EB5DC234B527
MD5 SHA1 SHA512 TLSH

Submit Download

32972303-c6e3-4f55-b8c3-b850403e0d83.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\32972303-c6e3-4f55-b8c3-b850403e0d83.tmp
Size 6KB
SHA256 187915457914e89f9e88d48e01ffafd489692299de9a54b076f69436a9a6b176
MD5 e3b5033c3aa40b0ef90a73d2044bc4ae
SHA1 6262d9f6c639c0c26765144c5352a3f9c71197f5
SHA512 7e1234716eade869915290f2d72b658d98264bd91afe08f3256c89cbf6dc4951370d2785b2bf6199fa7342218fe4ff7cce887fbec134a576b644fa8ba328424f
SSDEEP 96:zRnsX+3gQS393Hv7obWhE0Ri02SWA14uX792b+WVoMkm+Tew7sS1AOjv86uS+J:zRsOwjv7oAPRp2C/Xsb+WNK7T2yH+J
TLSH
T1BFE1B616AD64BA335CC7D21EBA35BF52E5F5653069CA0D046BFC893C04AA6CE324750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 7266bcfc216d0ebdf28d754fc0b56e84d6d62cd53e42104c17ab490e577f2ba1
MD5 fffbc9d842377b912ee6e7308e60989b
SHA1 55f9706fcff40a80bb2d3782abd357130c31918b
SHA512 87a2e3048e6b6c8eaaeccf1ff86146a7f8bcb9549cf0f6a80e7f72580f2a2985e294006f3654ef0f4e93482b9dfc9f75ae2d34cf74ca620b2c9a057331dfce1d
TLSH
T1A8B0112CA0888002C3E00BB303EA0000B232EAAA02232B328AA080A8CC82BA02302200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9f28a3d30cf44bd0cdc549e07be6dcb2fbbd4008783e12db51a9673711a7ee0a
MD5 f6f9c1b55b2a7cb1a65296b4a60b486b
SHA1 24085a8067674faecd5848b0a025617a1dbef622
SHA512 d00886f74a9471273e922fe7d0c8674f8e83d27f900ca800e7d3d60cfa787a9f53d0586c42ee2cd1cfc134d3dd6aabaabbe5b99bf2e8685c65d063c2c6f2868f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a8b4a461-6a3e-4508-b4e7-029a60625d80.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Network\a8b4a461-6a3e-4508-b4e7-029a60625d80.tmp
Size 1KB
SHA256 a1f5e9fe1a424348bc413abf805f5677f06be977dd70dac54cf47f5c83800741
MD5 6b948851fdda4c3c6f911ffc772efaac
SHA1 ddab325ac7b24b5eb8e533356b6e2ae60cec0f3d
SHA512 dfcfd917e1e0ce66ed3746287267c31fbad7e76f856543ba0b415fe7b313df25c49f47a371950579fc1109983a277b4708501f71745bcb371371d058d7c53cb8
TLSH
T110116AF7D3D8897D895102E4AB156A1BCE2E0508432D3C66C8E8AF5B97F2874D21498E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Preferences
Size 6KB
SHA256 ef7117a615b83c5a904d570bbf5f94131085227ccb48ff8670094c80f412cf22
MD5 d95dc8417d726eb3dbe0dcb2f9426dc0
SHA1 4eb4651cc3c9c6c32e185e27cbc052e7832cfeba
SHA512 c24295bff52f4daddee70156ddc80b38b46265a843885639f052b35a3367e7f18292276e71478f8e25865ff7085d06c1ac2ea34a3a56e7b9d439764912df9520
SSDEEP 96:zRnsX+3gQS393Hv7BbWhE0Ri02SWA14uX792b+WVoMkm+Tew7sS1AOjv86uS+J:zRsOwjv7BAPRp2C/Xsb+WNK7T2yH+J
TLSH
T13EE1B616AD64BA339CC7D21EBA35BF52E5F5653059CA0D046BFC893C04AA6CE324740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 c5875f9915ea283c92c769dafe6b52c7fa84a55758622514bb811b5bdafdfca2
MD5 d633ad34267fb3679391d74c3e43fabd
SHA1 4f498234d2b0466d534176e6d851b83ee70fde64
SHA512 ececc56eafd035fd479b0104082b8a41a86aeef9be5a139a716bc9d71ea1ae5450a6779cbe611392b1c00760e0ee8c1e3f825e04391c078b5a78b40ad63766a7
TLSH
T199B00293C082595BC8D2C3F03B8554D93162EF35DB675F46D7E01AABDC5A2E08735990
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a69e8a4b5bac2a2e7d6800e55f83624ffa4aae92030bfdd6ec7cee66d15aa583
MD5 4d45809e1b42260dd0e4d9199b21c1f0
SHA1 a49f7e6aba80c24b20b1cf4f2dc020b13b5ab6af
SHA512 73b50dca501d3ff6d944135a1451580de707dff67f6f3ded747a901657f7e998d1e22b5ea3cb229773ac1a5d080eb1d5b7a68ead28fb4fde9fc35ebc9b4c2482
TLSH
T1C9A0025113858210C18006F0290983891610F9268100432776E02B569C700658A1515B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c44f508d-6666-4b00-8f77-f1b814bfad02.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Default\c44f508d-6666-4b00-8f77-f1b814bfad02.tmp
Size 7KB
SHA256 3ed61ce0e08901006fa130e1176878f17268ad8455adedea1642d267892ffe24
MD5 97a2f92f12564927f87be34ec7c5b507
SHA1 64d6de2ae5235f8470fa6f630fa33bac2feb6c73
SHA512 5fe987006e1134ed5034be6f168310596b1a7d90fca88a3538680df2c411580c2b5590c3e13331e8f40019763893cbe030498db18bfa2d30208b589fa100c1fa
SSDEEP 96:zRnsX+3gQS393Hv7obWJE0Ri0uSWA14uX792b+WVoMkm+Tew7sS1AOjdn86ulKO+:zRsOwjv7ogPRpuC/Xsb+WNK7T2Om+7
TLSH
T1D2F1D726AC54BA339CC7D20DB925BF52E1F5653059D60E086BFCCA3C05AA7CE324751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\Local State
Size 1KB
SHA256 1b1f4e638cb76adbbf2ec15b645424e8dec57b9c5fcc5be7becc4f04d87d4557
MD5 599c31a6d060447501426701518b1078
SHA1 e56a16e923d0e673e0a99c12e3f8f0c2a500d666
SHA512 2ec9c75c071b0432879fb4c2c0e8fb2ad6230c0572294030116d9a7d63e885fabf413b7af14b1d2d2eaccb6060caecfeac19ffeecfc7883af476170b7f03fb8d
TLSH
T1E61172B095F8FB69DE824A095A40CB6F0E79236BC1E6CE043BCD2924157A2A93617C35
MD5 SHA1 SHA512 TLSH

Submit Download

efca24f1-2749-47a9-b1cb-dfabe7c7bb8d.tmp

Path C:\Users\Admin\AppData\Local\Temp\lorca3293213820\extensions_crx_cache\efca24f1-2749-47a9-b1cb-dfabe7c7bb8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download