stealc | hxxps://drive[.]usercontent[.]google[.]com/u/0/uc?id=1ZfsxDG_eEU3TT3O0UErfL_QcfBU9vzwn&github

Analysis

max time kernel
384s
max time network
388s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-11-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.usercontent.google.com/u/0/uc?id=1ZfsxDG_eEU3TT3O0UErfL_QcfBU9vzwn&github

Score

10^/10

stealc vidar 68fa61169d8a1f0521b8a06aa1f33efb credential_access defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

vidar

Version

11.8

Botnet

68fa61169d8a1f0521b8a06aa1f33efb

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 21 IoCs

stealer

resource	yara_rule
behavioral1/memory/3636-1635-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1637-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1639-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1775-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1776-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1784-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1785-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1832-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1833-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1835-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1836-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1838-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1839-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1844-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1848-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1849-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1851-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1852-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1853-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1928-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/3636-1935-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4188	chrome.exe
3616	chrome.exe
3448	msedge.exe
4652	msedge.exe
5064	msedge.exe
3548	msedge.exe
5004	chrome.exe
3468	chrome.exe
1436	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
4132	7z2408-x64.exe
4136	7zG.exe
876	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
3220	Unlock_Tool_v2.6.8.exe
3900	Unlock_Tool_v2.6.8.exe
5024	Unlock_Tool_v2.6.8.exe
2444	Unlock_Tool_v2.6.8.exe
3536	Unlock_Tool_v2.6.8.exe
3428	Unlock_Tool_v2.6.8.exe
984	Unlock_Tool_v2.6.8.exe
5056	Unlock_Tool_v2.6.8.exe
3080	Unlock_Tool_v2.6.8.exe
5032	Unlock_Tool_v2.6.8.exe
2392	Unlock_Tool_v2.6.8.exe

Loads dropped DLL 1 IoCs

pid	Process
4136	7zG.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 876 set thread context of 3636	876	Unlock_Tool_v2.6.8.exe	130
PID 3220 set thread context of 5032	3220	Unlock_Tool_v2.6.8.exe	186

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.6.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.6.8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_v2.6.8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_v2.6.8.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766187659551004"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\link (1).txt:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Unlock_Tool.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Unlock_Tool (1).zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\link.txt:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
2140	NOTEPAD.EXE
1312	NOTEPAD.EXE
4204	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1612	chrome.exe
1612	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
3636	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
4188	chrome.exe
4188	chrome.exe
3636	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
3636	Unlock_Tool_v2.6.8.exe
3704	msedge.exe
3704	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3444	osk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe
Token: SeShutdownPrivilege	1612	chrome.exe
Token: SeCreatePagefilePrivilege	1612	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3444	osk.exe
3444	osk.exe
3444	osk.exe
3444	osk.exe
3444	osk.exe
3444	osk.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
3444	osk.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
3444	osk.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
3444	osk.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3824	1612	chrome.exe	79
PID 1612 wrote to memory of 3824	1612	chrome.exe	79
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 984	1612	chrome.exe	80
PID 1612 wrote to memory of 4588	1612	chrome.exe	81
PID 1612 wrote to memory of 4588	1612	chrome.exe	81
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82
PID 1612 wrote to memory of 1332	1612	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.usercontent.google.com/u/0/uc?id=1ZfsxDG_eEU3TT3O0UErfL_QcfBU9vzwn&github
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc43cc40,0x7fffbc43cc4c,0x7fffbc43cc58
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4716,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - NTFS ADS
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4796,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\link.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4584,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5364,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5272,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5508,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5212,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3128,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3148,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5544,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5888,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5800,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5376,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3092,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5868,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5288,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6132,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5600,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5684,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6304,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6308,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6356,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6312,i,1972285907631918193,7336740980361352884,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:568
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4132

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Unlock_Tool\Password.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1312

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3444

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004C8
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3004

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- System Location Discovery: System Language Discovery
PID:1240

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\" -spe -an -ai#7zMap20810:122:7zEvent23755
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4136

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:876
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffbc43cc40,0x7fffbc43cc4c,0x7fffbc43cc58
      4⤵
      PID:3136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:2176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1812,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      PID:3392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1984,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2280 /prefetch:8
      4⤵
      PID:1036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
      4⤵
      PID:4588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,10258831290451441764,10828850014438663205,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:8
      4⤵
      PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffbc1f3cb8,0x7fffbc1f3cc8,0x7fffbc1f3cd8
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4788 /prefetch:2
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1900,365564958368975055,8333852344158289626,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5064

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3296

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4204

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3220
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  - Executes dropped EXE
  PID:5032

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
PID:3900
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:3352
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:2452

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
PID:5024
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:3820

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
PID:2444
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:244

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
PID:3536
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:2684
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:4752
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:4516

C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
"C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
1⤵
- Executes dropped EXE
PID:2392
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:4816
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:3120
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:3152
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:2232
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:4828
- C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe
  "C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe"
  2⤵
  PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Authentication Process

T1556

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
883205c8c72a59af010552ad311f62e7

SHA1
626dbb16469339df3aecc88ece281291d1c9462a

SHA256
56028dc10510be6f9b2bc236fe26c790d3f3a851aa8a4420cb3bb74499d84c3a

SHA512
604ae32d8e37304b0b9735c225c5d50451796eea2526cc6c44b1d36a2af841d1733606c4797fd56a01f22922ad0094bbd7616262abf109e50ce332d916c444ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
810c78bbe47cd30816648222898b8a77

SHA1
b8b72fbae83a75def34d239b9f74969c796ec6f3

SHA256
79b3bc6b6637e621c5023089e5f702a55960bb8c9a8873cc34edc6fd397d13f8

SHA512
944925f9d3e88465a5717bfec614019c02fd1e9a6d17866625b89ad35c1eec2462d85199a049be3e52db72b4c1cfe3c0f84d18c99c0d30cc829a79804d9c9b7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
5e5b08d0a93943172d4bd910317aa74f

SHA1
64976fa96d7b4a239caec9080df1e86fa6408bd6

SHA256
e8c69b07293f49277851e9415965d2e7c2de1972af8bf6f806a5d29a889cd271

SHA512
a20424efc889f52588af7feee7fa95f0289b9e32de346ed0d22b5821b29fc7be7483649b5fb1130e615d90652c6a1f30c22bdec21e77b40abc2e83594c17a88c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
f690bd49911433a4c20f928ca3ffdb39

SHA1
244d81b754a35dd3dee4c043bde66d796aa12668

SHA256
e50e55158483ff238ca78e3f869d2cd3da385d6654190fa9757f6294255df2c4

SHA512
d3ba97fcefac75d3ae2d9f6f3f7e282136c8ee3edff447ec43e32e5e781244c15f2c9e62a4c47d887e6f4289c01f1245185c6df17a67477850dd11016c75684e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
e653b8cf04e681f2912294a3e519ff46

SHA1
2acd54a9dcdc310e29394fc996e86dddd2ae5b00

SHA256
628e17f1de81ebf24e884e4655083f1f3712bef5e80597a88b362bc49e3b2ab9

SHA512
22efd38824901c47a415788c16c6639e2724c1a83d3e837a055c337d53b554d898325f3f4f2510abbb919a94a954219028ebda9e294b7cc6357c4e2a6e788f7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
c76940e3ead4e8e31a576d4bfeb0ed5a

SHA1
7d4d91ec39e48f1b55fe05ec46277d0eed35d332

SHA256
5422d45fcd2b2912c1f343c4965d976c8231e773bc4b10ca66b150a56a6d3088

SHA512
43521b66deb7323e243c2cef2684dd9b0a04e81c399221b5a638dfb87719beb73294d47f947eb6c0dac8b7491b08b59bbb7a820fda8014b48a4ea4590120243c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
42KB

MD5
97cff9b8afd67eb0c10fca8dfe0ce6cc

SHA1
9d18b1b641a7e5a25a2058e5742a06044ed83076

SHA256
ea2dc8b5eb28ce0639bd76f9a8d046a5beadaa9c019683750aee69cde744059f

SHA512
eb979c3b5ffb2fda4aa7094a4b3ffc4f86cead0004ea92ca9ac47c001a21b4220620ec9f95e04079a63060ba2e18217c4dfa8ccd857cdd455741e5ee0a5f3227

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
27KB

MD5
0d79a13e342ae1668e3f3b5671c8e52a

SHA1
2f94799e01e47424e4ef4eeedbfeb663933bf871

SHA256
eb8fd45363f6d159a6e4d9c5cc5048fd52082402a223a6898c0eb09842c7f1d3

SHA512
fcb7b24c0cbe2026ad75161810ceb83c13ac4b9c128ed40fd3f5af9183bf5e7a129fb885b2dc1fad588a889bcdaf885c8a1d4bb8025bf78bc2c8ad913f4f2677

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2299b5f5b587bac5_0

Filesize
375KB

MD5
a4f9c8a39f151e23c85a10d56543e6d4

SHA1
c3acf7842f372c69f52b78138c04ba108e27a030

SHA256
7b0ec281427883ec67c90dd0021324183145092a03b1fd296e5e1888da6965d0

SHA512
5d5fbfe1a88a57b7bb4ea147857870216ffb1dceeade56b45913e663f40ac8c53bdcab3d8e9d09b801101519e7e6cbbd6e081652bf3df166209226f51dd74bfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4b4bfcdbca80cfd9_0

Filesize
289B

MD5
510a222b509fcaab349f2741b3ef3a74

SHA1
92b46fdcf9aec5042f21860b777e314f084d4784

SHA256
2c8f9d1561db8ddac7132128d1b128100f446bbdfe7dc3ca465686782280f83d

SHA512
bdf6fd79af9e3f41ed73ea4c7688d985f03259c624fc456200a27067702b3500eb29bf806ca647082323f20439771504338a93e617adaf7b2349b3e9c09cf9e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8240f5fdda8959de_0

Filesize
19KB

MD5
45c5c9aa59852ced3dee663f375221d6

SHA1
ea851a73affba7065e3e82e116259fde4dfa0d4d

SHA256
3d172af26c3e139422d8363ea7af5c850d224e5838678ad90a3af17f8d5e7184

SHA512
c6db42cd746a4d7788eaa7c767f033bf5e388b419ed0c03d469cd29ae2f080a4f0d6d5a3f0fe44b47d475861a9329644946680f31592be77bd7749a581c4eb7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\eef153ee5b884e2e_0

Filesize
280B

MD5
8b3d542da97d0048a016afd82f052b58

SHA1
67058ed0313748107dd313528997316de2ec3b96

SHA256
6cb7cb8cbc89a11fe26b7c71915fecdd011fdffbe514890697e1c7e55284b38a

SHA512
1fec6cbca903775112d0fbce74f0f7dc90b44ed746d4d80d814fca6d2fc9f175fcd4873b0261e6c7f5a510ea62f5b9f00a5e6588e8a472674b516188c4e28951

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
33c291154c93fc2036f1315bf4346fb4

SHA1
60c23fef5c50136599bb9d33092328eb4860676c

SHA256
95959d783ba2b3d40b8a44529cc6fa4bbd01f7d245ca5d3089316afec21628b5

SHA512
8ff3f25a82757b9663b76b0914eec67684dda4b84d0f0b377951c802eb5394a8af5bf430cd544b4099cd880f75d15260a09da27b69aa22ade98675ff5dc40790

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e61f93c6aa154f8bfb68df7ef72186fc

SHA1
14bbb70ed3f17c9e82772a5fe5a81156731e2470

SHA256
62d6aeac71c0ff8ca83285af470bb822190461ee79c1d41a1cd9166073ef448b

SHA512
ef8de831d8e6d2807b7428c3962c4f5faf6a19df7386bfb9410d5faf8a2fa44e47c81eae82ee7d13d82fa655060e7f7dd6e6287d76d2e546e1a11e120fb03fb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
54fb23fcd86b43742e2d2ab8b8d26bfe

SHA1
0b0d744bb521ac5029324b4f1f3eae8b3cf727b5

SHA256
402d6caafcd6cc866705e6a92c71b08fc3dd029a36c42864e5affb924eaa7de0

SHA512
01f5dfd8922043d1c82206ec1fd2266c32a961ed566dcafd1e631edf6bf4fe8fa274143a2ce9a7bd22cee7efea0218de062a0ebcef1d58ccd31aeecafe87398f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
293ef652b34a6020ee8d928f678dc6b3

SHA1
6657e84757447975764324b1ca754b5491c78606

SHA256
9ca3e38fcb47369df2e437ae33923240b3bdb4849cc092c5770a5f3d2308e385

SHA512
e53b22b84a5d3376c81fc6b865df06035503a2b7e5509c54aac3d1ff31c01f29d689cc6b0bbaf42be6d5843ceda19a56f7964a773cd6d0e19d45dd557fd00476

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
915838f345a5f51336ab11ad9edcf3b0

SHA1
e604c845bf0392156299c5b03fb055b5a7660937

SHA256
4ac31fcf930deca8f19e035fa96643079e10e1c6d6438bfe114973c3a10ec486

SHA512
a01992b564371718ee7adfa9f41033395ef7816955022093801763e3916551bc0d752b4233a0be1aa666df1558b814d5b59f12426f78adca74701822ad8c67b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
72bb68d84c3a48bf75fc1726fba2b80d

SHA1
9d84b66f07a4708abc180ead3c73370a168a4f31

SHA256
eb60d0ddaae170517b1df255255a62b6117193d975fc13d40007917d939ed6fd

SHA512
57dd108934c5da857f178a597af24b02c0ecc15f412c1b22a6ecddfc24140001bf6b0930f21061910e22f9476e7bc65c65b2aa73b5585632a87cc8e84ccbbda7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
5ef0d8f2e07290c1f6f0a0ff5e0fb6f7

SHA1
4b558ff57162edeac939ee48adf8d6e9e378023d

SHA256
db8752f24899f0e1a6e3cf3a60148b3b087e6848911928f8bdb77da53ad40617

SHA512
fd20570ef96b354264de88abe08cc22537c4aedbce57279d4cd01374bd08d85ada1a0fadc69c99206675ece8e4e860370dd573677deb77e4a6330fbf81d433be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
28KB

MD5
ea4b475fbcd3f17947c0142c5edc8777

SHA1
0b17c5e0437903d59363e5bb4fd9091d58df30fd

SHA256
a1e81c0dd705c8676d283a1f621ecb3ee5c2f0b760d30b80ad5ff79117e5f7fa

SHA512
119b607630e7f4823eaff939ffad74aab26658f57bf0149133a45c4286ccef0064c3bcd9fc163dba2900687cb78068b39ec62d55f9df5fd80059becbcc4e7af2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
160KB

MD5
87b8cae81210dcbc42136a6781d258bb

SHA1
d1c954c6001cbd29a25c3885734cce2b7bfa34b6

SHA256
b4cabc27c99212c7f7ebc25e79c480e0fb999d02eba360bd32bcc27e4b15f6fd

SHA512
13c710831d754547d867f7d56810419d77a9cfb62768e1f906a326009f75f42303821270a283b35d1fea001b1eaee0d2a23fafaa6f6510e3bbee5d5a83e63414

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3cd2b2f6f6bfc7f86a50528fa864c5ea

SHA1
231e73371f2060eeb903b69c8d601405543d4bc7

SHA256
584b06da9de154698af81c3413b8fe4e95663d3ce5a587127293b3a9cd10af60

SHA512
2f662553772acf7600d5605162c05cb3c43e5de96f6bd3eb2d6be25dd362e07ba7841c79044a86e50cd1d1cd8b113fbfde081b26768fc7afd3badf924b234553

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
2684ecc0e2951062b7139d32d7878540

SHA1
eda75368c385e577d97235ba4726ef04e6d1a832

SHA256
5393d2fe2803c1b28fdadd94c9403f6b1e59a1d67ac14f1641912e8b9f66b161

SHA512
6c6eaa35660e10b4641c1a2b94d91ee0298843762baa919e7380e89504c7df47a8ee32ef8fa83f5ca18d9bb4b561284bf9e7c82ae07c06492475427743c3427f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7e6b9c85281d9891e1ff14e4e75845c1

SHA1
3b5a39a802cd0d24cc0bd04ba87f75093f46fddb

SHA256
2ac28a5c21293bfc40bd7d05783f37509bd6fa30b3ae32c7b64cd92d66b91700

SHA512
9c8374f4abf2b48c6aa4d91a51ca995ca1b93e5299bc7bc7dd901a2959a634f2fb696537cbb05365a07013a58040c15f0f152d15f6dd1ebc2690f479a11a856c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
46a49c1da1ce1111967b63708762b759

SHA1
588aa8d6c639bb4dbf761b1738d588ac14ccdeea

SHA256
67c100b3e49ad245d62cb7e128198cb020b12f9382c74f2cbbef44c571310bf3

SHA512
e7a4f4daaf8da0f37002c1889bd04de76caf44e51387be69a2d4b40704870e0c9c46d49f3493f8e3cd4a6b6a45d7e70f1a43951abc61020a0fe14eca9dccf4f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
472ba1788623b28d8262753e887c7dea

SHA1
b5ab914dc9213f6518e2a307c5fb629a7522ef52

SHA256
fb667afc7937f818a99884d11d145090c2aac2b68cec26d74ec5c49914154013

SHA512
00af1cd357ce90440b5402333db982450d529146e8066bd9510d14e2cf74fa5064a6fc9f31a0c83895935a8cac19788236537fff57d8afb07950e8208ae4b512

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
688B

MD5
cd18395bae328987795d4daf77707069

SHA1
dad251ba516d79fce8434719ceea0a42b606f81a

SHA256
aa589bd81c19494f849109d9f3a505e60c9d239d22932c11bc0946d321acef66

SHA512
44865801a17a65b1cde3315ce6d51207638f6beaadcacfcf45df55dc758ab65eb312fc15a21564657ca813a8d68dba05f5b2500e664e7d554dc8a311eb0b264f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
f74247d1a244d85b7fa10bf60c5f2c1f

SHA1
1caf203c9a9dbee5a505214a7d3d736a2dd5a19e

SHA256
c3bf8eb9dbf7d202a47d502ed95baec2a68de2eb4bd42c1049b579bc2c5d0d5c

SHA512
88e181832c48c7e2c9a98ce1bfa11ba93edb180ee9f2041159c72175e92b7d9f4fa93bc2901bd585a1e29e91928091fc8e20687572f9cd3488253b8998f6efd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
edf26e2bc393493fb2ee36368299ed7e

SHA1
f7ebe47cca5ab1ebfb4b0a1db2c683cc41e3be0d

SHA256
76c97a5272b51e0a8439cbebc4dc4f13b0f7a649d6ce51e543d26a68533e65cf

SHA512
3b2c5cde664a3b46fa6d58f36ea9468c63dd3ec0bb44385b7235c210d01ff1e805ffd914d0c762cd4f01f1630279b2e3d26abde6c722144abd5d31ae04f3d611

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
6fe0fea874903b3b8f0baa646af25662

SHA1
a41d49e82f61af30184a1d8e82d0069769aa3b46

SHA256
91551b0e852b1111e9705ec89365432a42cb4f5308dd1ca18d17f066b1258c94

SHA512
e7b28dc3cb769b22d0e1629216c80302d2cf5addbc2d050fdcfc229e93c3b42c1595a5e9d801340022935c1ea8cafa0fecdf63360ea093aedfce86ee9c50d3fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
9a017fce03115ef7631c954e68f3625f

SHA1
63f1424f1690894fad27ef95a8165540feecff81

SHA256
df172b737eb8bf183218999edc4fa170aeb9ff449f2b33e225c93e839b6e6d50

SHA512
e7fff981fe16b98cec3398bf111f31818f3656255753c84d40a7d36e027b19f53a045e5c494575f3f1d4a0f36a1f701d493d9489ef7c2551d6286775ea0b06bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
857B

MD5
6d40ceeca81b8806bcbd614e1c5af230

SHA1
fb9331e2eb6c0cc09ab0670de30fbd12d14ba2dc

SHA256
7ae50b952e66f485bdd32c686715312f9fc353957f2c7e2d8f725efb5f5cd435

SHA512
37253325f2ab0fc4075a9978b74c944199e9042aed8d32828f124db2bd8f12d76c2f2023ff0b037146ba28e3a967ec5e287437c75b9e6350e5b8aac5809382a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
18f826e56de0faf0e878fff89936641b

SHA1
447c62cace8fcd91687b56cc6bd98f3fb561bce1

SHA256
467791bd83fa6c649eb8ebe4535d6f24ef372c4c4d6bc1b30c673fc64231d4a7

SHA512
eca70e6fd3d83357b6411e7cd18cbb3b258f52da285ec8a1ca878bdc5277e806929527a6de6b99e5b8413ad7d0f34edffd31287d5899aad152339b10b5c4c75a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b729f59b4db6ec429b88fd803556390d

SHA1
cd80d5a9e0b98f6683ac83f3d0ef1d57f6568fa0

SHA256
57714ce1dd5461153aa97efcaeb14e610f60fbe1de7dd39ddbd709721c2f0d76

SHA512
0273dfb0c012d4da082c6519fcf2604247564671c12768c9457850a5a85e462108b6195e881757fdfa39290a713559b6e0b56e89d6d9e935baf4593947c3b483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b612373b6d779e6f75ea87dc3ef42190

SHA1
fbea7ea419e7df3364c75f5cf92eb35969668980

SHA256
b36bb715ea80e841704dbfae439bcab8b7a46ad676aecdf1863c563d15c6ed9a

SHA512
21aef16c7ed7ff436d41a590da1caf842c108b859104e07918cd889960d83df9611923c7328e12c7876812c0f0e3ead4a52b607cd0d4a75bbb43a1649bf65d9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
de14d01b2ddd5ad9d2f2198edbd394e5

SHA1
d654d3bd326c6c975ef9bede0e77ec976d44c61f

SHA256
a48050523f19320e576f101db44aab8949de254a062c379760f4bcf7a515b8b6

SHA512
8db56b06c8797a2c4c1bf3b218e0254b632dfda719312462f9b42456df2109feebd88324dd2463a3bae70d2dd1aee6fb438134ee1c5557c57a770a56ba74d0d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0d3f3e65625af5f19954f670b7d63919

SHA1
c0af1fef362ebd633afcbc1fc4c2e68a0eda1181

SHA256
28ee31d02277ca84cee835cbc94a32856149471d92a8ea3d0d3ded007bad7aaf

SHA512
429d992493a0276d58c670d2014968c66cf02dbbfd6c555af665b60404ab4cc611920a4797c64597466728bf84f87b6e148a249b404862c6d4f99f1550d5321c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a30b6ecde71b72fe0e9cd0f32c328482

SHA1
17ae47bffeccbf2badb71fe5d44219322f155bc6

SHA256
56c8d9cd67de6b1e252091b9ff8d5b21cc725d22af3fa000638ff30ca1857556

SHA512
c3f7b40f03dde28bcf7022752a4be5c2aea31c1f589de639073a96aca18580c619a9c862b67a41e5d21a6fdd6d9881ffaa3de0e1cf82ff375d39ac7574faf688

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ea516639bab4eac9d47fbfb8ce391647

SHA1
0eadaf490d5d0d0ef8c8cd8686d0d58442484a58

SHA256
cffd3de1f435cf93f291277fb96316c925d051d880c72a8c2f569533a8b6601a

SHA512
2cacd189107ab803d0638ef0233b5a2e01f308d527d4313a3f4ee308b4e490f62fff4cb82eda9ff50bba3cdd3ecb0d20b96b52bd4644938185293e98c8c447db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d3a2e46a62cb8b1d520fdbacb68febdd

SHA1
89d52d19fa04cc4113ce2a1abeb0488d62364783

SHA256
c6a4cb72cb60314dcb212e20d3d74e24002fed451ec8b4b9e01d64a4a6adb780

SHA512
d65d88b0f114517249d85d5a01ee53a93e321093265eef50cddefce797a4d8c74c880958a5fd88247b0bf01c92509f2a31ea9d806dc8284d229e68e0fcb69415

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d37b022926f107ab40348a2a3be2bdab

SHA1
7d988dae32d9620b004741b2aa00cd240bff2b66

SHA256
606b8120bd7f0f8e0e0218863fca5754da9551eb5648ebdb5ca13dd8079302ce

SHA512
528de693cd52c8202b1cc30a76e044c477113427da134f536d049fbce236e201470c0054fc145b9caf2b072649ff8520765bc41d15570cb0651e3f53b10480b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ff4a0486e4702dbf8218d3feba0f269f

SHA1
3f06ab53d9a5861508a29c9741e3aea251bfc7d6

SHA256
122ef4d277e565d4848e34cab3ccdfd165cbf15301f0e1bbd9c7d20985c79cb6

SHA512
3d1c02fb219acc9a7eee138e11ed1e54915479e0d1f99536e2b5955d015c030c1e50f2eb76c1db07187579163514a6b219202c9ca8d4e5e304fd0bee55230b27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
94fbd1cb704741227d877308ac4ebbd9

SHA1
af9532a935b77ec86978777c7bd460ba59ae94ac

SHA256
1500c6f8e3483f06e23212785efbe375216637b0f57de59e713ab0d315b45790

SHA512
24aa698bb216dbd5ed80361e4265027288cfe299388f30b6d51f1bf1b616e36a684734120036a11762bc8dadd21ee269b6beacd670de1f362709d0e06ca15786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
61ffc0995dc60259a48e45323064c378

SHA1
34e46aeb2e01600e835d1a55e14a7c4db8ea07ac

SHA256
b6254b0d5a9aed006afa00e59a1b3f48789f13d93ee14a5ea15b996e24cc0ace

SHA512
13fa0b09eac456d538fb78a6b2db05428715fcc54ad875a038b5d860c42bcdf91a9c5c27f1d60c8b6b20bb6319ce682bb5985a3716fa898165584e4f14447aa5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9fb14a721b29c38005b0861d3b637173

SHA1
f70cc367129701ff66f56ac789e047a387e42fc6

SHA256
79d3c21bbfe189e5609fa5fe85d33adff21b76a87ca892322e0cbaa81aa37ffe

SHA512
2ec82c44f1d8609287e267896d8ae68c1141ca0d458a61e5d7082e9b03bf8ce114b5e2c1b8b77f57828ed03bc097fe6fe5472cc4a26b7ca156cf4d6a8e3d4562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9a8b1aff3f72de5396d715aebe9eb6a9

SHA1
6e199ffc4fc2d0f544c99799cb3b70b22d74ea52

SHA256
ac2fb9f522a59b51ebcd06c10f2d6fda74c42e8d19cbc85ed286866808c62edb

SHA512
fdb561063782619bfe6d1a308efdf0e95c745d405839441e05f1d614fa5a639dd77b318e84f15c1fe7b395c879e6fccbb7038b1f9a720fbc06e85dc741d6adfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
55c6d6c4fd0a0e885fadccfc0badb0f6

SHA1
bd5c327549261d63f9194ee31e32988a81907ba1

SHA256
9636f8d85515e77a3712429ca6ba31c205d31f723b4bd15906e3e99fa468e8a6

SHA512
df96f6e750875382f28e7b6e3d22ceea16e9242eae234ba72ec6abc92e832825bc80046eebc5c0ddc08ebbdbc2083e7caaeacaae63574e4cf346784f2a100dde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
80b8d5a427c004c91f559da0c05a5945

SHA1
e34a8bfffe8e49817c198fd1788c42806ca33fee

SHA256
fda7ce89c643c07b69968447cf509d5468094d34e7889744e79f15fc039b5f88

SHA512
ddfc0ee59c1a4da42efccb2c8830edb4f1b6e1bf101f39dd7b439efb8fe7d4808ceb7ed847b7f607e15df4c4610c5a877e481ddd82d7bb446771c1fb79181108

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1b07ed4d80464daa6430e1e40b8f6c11

SHA1
b8a0bdc62c982e2c7122a39efc8961e4287b35c4

SHA256
7b18272421d9e97fe6de3410d1c2f3b0da51ff63ccb6956df0e79a4790b80548

SHA512
a8f377a8a9bb6f05e6e63153d41576fe424a7b0ed90315d604787608e0b238088027a48675c5c1f8bef44427fbc2a41c7b2c67f21cf56f80e7ea0d7ed050eb75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
80d433783c05b23b95389e6fb5b1ca1e

SHA1
1a0e2e870c6b5f1f70ef3d92993a60f8f4e79dbd

SHA256
d24237fba6ec4cd1e6490dd14cc10f9160eda36f1131791e0dcb7536ab2c092c

SHA512
c735bc0a08ec58a039058dda447e8995f2580ec04d7353044d5f5401e019570fb45f70606160a7e49c3b69b36ff7409f26fcc3021309cf236ff391e5fafacb9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7fd8c737ca345d7ebf6f1e4a0f9313ad

SHA1
654c5eb9461d9b29c2e84f09195205ca5e8bc757

SHA256
da85dd013ef41efde839f339089d7614e2d3df5747ef8ce5d8595dac59267c86

SHA512
b6f650b6a4f7660be6111730aabdddc74acb04923e4820f7319a11d257dbfea4313ee5e0359fc7252fd3a9e803d00e5c40d830b6d822c7584422db1765dd45ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9f4ecf9fdb4eaa4e021cf7336090c010

SHA1
f14540c52b597804a7092f997f5ac74bea37e20c

SHA256
2f71958afd51326f1a952a154b842b870d04a1287d0758fa5bbc3e4d7b752ad8

SHA512
2becbd21908c7a8a38638819a0bc14d8bafb66bfa26b0d1dd36fbdff02afac4dd56f3c12cfe5d3912430e2186ef6851da59f9cbf1cd5e440eb96df3fede7c5c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f20dce4e4f7e08a51822a09814028fa8

SHA1
06d3268a97362f5d66a7a16e22d8362d73e478fe

SHA256
b35f791e495d0158890cdbf39fc101d2ae2f1c79fe71f4ca9acbceb003dd170b

SHA512
07d39785a908fc0187681c60a9f39a9f6a3505dd3d7e6447092c6058c9bfb439dd389ab1643780da8b2545219b7686b56df4ff831983a89f21be3394dd7c3f26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
29fb05d2bb203ab47e1aec94d503763b

SHA1
0aaf982140bd628378128270095902020e80ce2b

SHA256
51ef1a380a99c86aba6c8e9586174e59a8f491e1b5fef468aa98de4e7d5fcc53

SHA512
448bcb8db83aa29390f54119ea76fe1470da149e5537482be0894ba74501f8d4dff5b63a8a806916358ad0764e6b70db0073c34c0263214375f882c0321b7043

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d0b2615239049fde07cc13ee4106a3b7

SHA1
d3ea02b94bebba1b82eb4d77c75c5fabefe5f472

SHA256
7d90dd6f709777fa660a26034c0aa476a6774971a98d22604a35360d5c71dcd2

SHA512
5ff9c7b762934bb7445ff238532d8a533c7364edd847180146c25d3019e551b375ee41b6790f3d9d216105a704998ee7d101213bf5378f4d966d7a2d83f267f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6aecc31a301c363b5391a5bfb71c4cdc

SHA1
5a4e80fdeba3382a0fa933a060df6eebce0e53db

SHA256
04506d9e821ea657dba8b06149d30abb173d0cfefc76f1e5089dc10cc6e6c10f

SHA512
4e045fe0f08d160c7e77cd76f39c8859850eea718c4a16fa03fb0d182b4ced9701d5a592f8483b4e17319048a28f6abc3ad6c5aa4e7ac017786d25a76e5a27dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
27f6544a656f931b78066b2c2acd784c

SHA1
4467068d92906e22db1ba37dad642b9626082522

SHA256
835690dbf26c6e5e653a4a85b8bc29483c32f7f67e228bc9ddc034cb2e1f76ed

SHA512
041129ea1a20a46306c5fd17b431878e77623946b94eca97ace6dcce7a535fcb58b77e1a1797e33b407d852bac29dd1628389cca8063b3ea61ace6c8b0c58371

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
abe5fa51b1c91c59edf8404672c6b001

SHA1
640f5823b66e5848906b386ee88a6eccb15cea7c

SHA256
4ffb57172247a2452612d7de31c1872c2cc7c23ec3e1ff7a1e98e1f59946e0f1

SHA512
ba00c4809f722d1664d7f83f8981f3d6824f9dc44f70f47c976cb0ffc133537b4e71339d12c834d3a908bdd2a5783c9ac0ed0fe545744f01d992248440ade168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1cbe38eca1e94ddb299b736878f65b07

SHA1
585eb247b182883abd0dda7fb816ae55c8bf0760

SHA256
2b8d0e3b10bd1b76ce8ffe51c8ce36e5188c8b4f16c40cf7aeee33c40a592491

SHA512
c1a6c3b107680f5b03a08f7fac8f980cbf310894c7257757981079e85de447a01a7df5f5f6e75cbf09bce91f1406c62546bf96d52faa7f790261a7c195ba95e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
11ff392c6530241c84ea75a0a4499a03

SHA1
6574ae44afae81c06e5e1fd46071395bfebc7ba1

SHA256
0b26cc90009ba558b26026c7cc1ff7e9959219b843e7a607651fa9c332d388b4

SHA512
a96f6bf6d2760ec9c74fee79941400e3840dab15b84ecdc62831680efecdffb88d63f0f7718b5b2b84d95e8912a684d93ed605dc54bccc437698165ce83c7105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
bd1ad4ba7bb17a42f9163ac81bdcacf4

SHA1
a2857ecaad3d1ba6035f3e04a6c974b2862af743

SHA256
90df4ef62a029841b09706df52469cb9847969456a153309840f4c0db4b5e3c7

SHA512
40de53a240a02f24a6ddee8f48740da9a4dbda4b4e8a8ad696c1bbe27800e74d505846c54ea0dfd0a3e2c4efee32cbb7e1cb9a07807952a48f72e93ee77db4e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
ea982ca498b267fe628252779dd6beb3

SHA1
b80c83a79505427e6ecd89ebb60103941c06a552

SHA256
18184058c55dd9bbe2a04c83bdab965a30f91d5d450ab83f65b458cc557e5f4b

SHA512
711398f7eba69883211e89d9cdc4718b576d662ffe0a46f967cb4c407e0909e32ba6ae2ea56814a69de47ebb7f569b1ff37781065f6417c2b0308e1816a30786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eaf2f100-3bee-4cba-a016-ef74345a4f93.tmp

Filesize
9KB

MD5
b203031d4e5a3ef47852e4f008d1a1d6

SHA1
36861fa6b5a093ddb4977f425fbfc3300b3832bb

SHA256
d085ee456335952d7348ba4ebc3eb8c5b90d16157a4a5fed8f99f1d6e3c6f373

SHA512
84f5cdf70b4bf3ba7da805f6a0a7d75de32ab8c110b117003186ff358ac13c0478d9bbc21080667cdb7120e5a95c775acc2d754b11b95cf495661f303260c8f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
86083d66edb91e6ade35ea73d96a901b

SHA1
2c75211131f744074717061d40bd8ab9457905b0

SHA256
907127a90039a6206f237b6ca2387e1c12e66d8990ed0a72425d7a208cbb6842

SHA512
3c003fa6da93dacf8207ced384b920f9fd523899b79938267d0bef2f5c88102402c704f525929ec624f5b53de19a2a966bc5e8d56854ba91b248419786950ed5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
e596f0702b088404b855fe6344546de3

SHA1
176cb9f3a5de6763979485c15ee8399c7b8d03dd

SHA256
cf455b4df88c2899b17b387cfada42145ae40925b02a4ba0e414e0c83a0bbb1b

SHA512
c622fbe72f825760732ac1bdac5166d4499d3f8609b7ee1e3b094f351eef5db685f1779bab168792a994a95f838fc21dd4df50e7d62c78e30ee300bff33494fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
88bcc2ca3b784ba9f06cbf6a441036b6

SHA1
8e0e4865dffd9c98cb2da8f6534aef127ffd3a78

SHA256
80ec80c11ad39b4b3198442f69f3b1597e987cc0c5eefabfbd5873aa26a4c433

SHA512
0d8427ecf031abd7a9a7f735cdd37c61b1d80e6422e18c066ef410fefa37f9522e8159f41d860b7cd5c44f36e09f3b56f9319381eda003bff77d3e9b626b6e35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
4fe375985ce7908d559c295a3fd1c64b

SHA1
b90fffd27dfaa0ac8c7f2098fe686a3640dc86dd

SHA256
b7f71310ad77d4e771130a8e837d7ce111e713c8a8bcc2c945d4a330fb17d153

SHA512
b29d66e304815df770787c2c43622bd75ee07450d386eae2bb8422ae9723c6bba83eb9de250d5a3146da9334dbba8f0f9732c19c7c1e9aaf3a47157b1e6d1d33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
7138db3baf4a270bd8dfc316d1037d3e

SHA1
276159efd49759266540c4729e7c25e79d5d6d0a

SHA256
ffb708533b7d96debaee0cf4c7dea241cc28a2319ef47ca2ec326f89d74223b5

SHA512
29bfed0ccd1362b094ff98241c55e4d5c610120f6447ab41b7af0e6628a8750a2cdb1ce9006d22602c778e7911acbf28cfeaa4c58a36440480cf146708ecf665

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db

Filesize
28KB

MD5
5a825eab1c74c4d95de2dcfaf5ae774e

SHA1
9c2f6893488532d023957975820aa8b5b1d873c4

SHA256
44d23ba67b8bc97531f9d9372733887e4ea8a8ec41955980d687b3733a0c12f9

SHA512
276ff1217e297f7ec2dcc60d8154afa8eaf7f395d99beed2d87108486a76d61425857e86bec6fc7dac52374166b41da8ca87e34444d94bed2d5ce2b3de1a815c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db-journal

Filesize
20KB

MD5
ef00d5a5886a3c2cda6ed56ec97bc16e

SHA1
e897588d7989470439770e68261f5fe54e39b727

SHA256
fe612800668ab8e2bd46e7757ee4834d0cba8561c17813c025d5858e363d3c7e

SHA512
008194dae85e2b51eb9461c0719fef029693b83d43d4fce2647b2935739f50bbf652c10f630e66cb9bb14a9834b80223f34f0fa2ff4c8644a0cab101763e63f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8405a793-e614-4c38-8a92-088361b9a600.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0a89dd64f150efff5c73c4459c3eb963

SHA1
da8de3a4f0999cc62a388372a162e58ccc703b1b

SHA256
519ba2552efddb9d0ce164db9e739c6d2aa4034d227ffec4232f932b6f0166c6

SHA512
6b2e6403f906ad3c734f1ef3d0ca958d07a318066e8706c929a9b909d3f55b8fe593f9bf30a122bf12af54a685209720460dd0c0d4d1ea9ec9e4ca507e0ee05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\delays.tmp

Filesize
1023KB

MD5
2a1bcabc99c0f624a69bbd9fc6d1339d

SHA1
244a48b2e11689809ceaf09579a6dc91303def59

SHA256
1f1e543b6f92b83810908ffa3f77d4958d53a2e95856892e202525376f5f9677

SHA512
17245105c90ebded2789719172400db70fb61e06b13624cb0fce1831ee462a543782b0048628f750578ddd172bc096e3a563cbbe8217de6534cdca656f8b951f

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool.zip

Filesize
49.4MB

MD5
7c46512dc0658a341e9fa8562222a318

SHA1
dc10863cf1bbccf98e3d14e0a74f0ada61b592e0

SHA256
9860dde912b9abe49fce9330207051fe4ee31ac5b0b8457474a049c65ccf662d

SHA512
ba687667e1b2e32c09dd5433276e572a7d84d8f40f46bbafd85713b7fc626b9741ce9102f8e9477a25aae83f0351f648e49fc8061dbdb0d81a540a05216c7c23

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\Unlock_Tool_v2.6.8.exe

Filesize
540KB

MD5
bac65e87e77915deacf4d92f55c32683

SHA1
3c494ff16016b09f0cb3584075102bc3f6305f10

SHA256
8b1102426427c5122ded22b5158e744f508ec3b15f6f16d4300601f05a2278d0

SHA512
bdd9eb580d93b97582aa25df86ba98b1a11bffe78927c3324e478fc3320506534dd33913b98f72dcd002a9cfb7746ce2483fd4a2fd9c1335cf97fb035acd2574

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool\Unlock_Tool_v2.6.8\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
C:\Users\Admin\Downloads\b2e1dfb0-e3ef-4aac-b922-6a759f70217e.tmp

Filesize
15KB

MD5
0072973c1809477fa1a36f41f5c9d41c

SHA1
1f647cf27ff928e8e653512feb67affd2bf577f4

SHA256
c794e350bf5fd9c6b52cbced19a1406df0d3949664acecce43270f553757c9c9

SHA512
9d73dcc24cf86a7ecf02347d8dc1698f03f60615d638f36a37c133ba3d57acca8747b6e5a78b35ccc2291730b6bf52eac3b8b47b3fb990b33c2034d2ef1cd418

Download Submit
C:\Users\Admin\Downloads\link (1).txt.crdownload

Filesize
139B

MD5
d6e6a65a26ffa30048b01dbc65767fde

SHA1
90ea65e235341d104a3c80804f53504ed2662289

SHA256
efa02dc9dc2f627c69fe9a653c20df5193a7ada36740b5e592eca26efeac300e

SHA512
b902f287b386f5dbf8b71e4263579c2785f1eaadb542dd9d910de11da27f0f5f13dc71b91a02e7dd01752937147b717ad8f19c1c5c06801dff157372a67db19d

Download Submit
C:\Users\Admin\Downloads\link.txt:Zone.Identifier

Filesize
118B

MD5
b0ad832ecbe58ce2f351ba280d76f915

SHA1
557c61b1af60d17935016dcc343a3e63ea1d35f0

SHA256
b1ae85e5685885da31add780ba100a627f2ae644237aa3647d380420a9b46c09

SHA512
a22a3f438c70860df6d9c2ffa65487bf9482f5b4f6582cd538d371dc406c9957def6daf7486f555b7d11386b09d2dde14f74fa4cb30f3539d0a97803f981cc99

Download Submit
memory/3636-1635-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1848-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1637-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1639-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1832-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1833-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1835-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1836-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1838-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1839-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1844-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1775-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1849-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1851-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1852-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1853-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1785-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1784-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1777-0x0000000019BF0000-0x0000000019E4F000-memory.dmp

Filesize
2.4MB

Download
memory/3636-1776-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1928-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3636-1935-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download