6039166fbae6996de2ff586403e8fab7850b6e7d296c8179f47ba026ccb081e2

Analysis

user interaction
yes
max time kernel
122s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.py
Size 7KB
Sample260620-q153msgw7w
SHA256 6039166fbae6996de2ff586403e8fab7850b6e7d296c8179f47ba026ccb081e2
MD5 79523ce425ec80d81b87332cd1fe4fc2
SHA1 62ee1075db92a78f6bcdc7f58020779affe0be4c
SHA512 be359bf66b71b47c337fc658e0bb4c4a9691a209a71a8d24a70ce7974a620b926b3c2fe53e1b46ebb5b1fd3272740009a7c9a8579b5b0fab5990bf77cba5a458
SSDEEP 192:a+CMtxPtCJ82iw7siuM9yNmPVYfDF8vKyiJxCK:4zsixyUwquV
TLSH
T1B5F1A6B3A8C92401A2B7C16D58138B05F939E2178A5545153EBC73F50FFAD4488B37DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence pyinstaller ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
142	2464	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
118	raw.githubusercontent.com
142	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000a00000001c867-1277.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5256	chrome.exe
2464	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4092	taskkill.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264367422648722"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5228	chrome.exe
5228	chrome.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3692	chrome.exe
3692	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeDebugPrivilege	3708	taskmgr.exe
Token: SeSystemProfilePrivilege	3708	taskmgr.exe
Token: SeCreateGlobalPrivilege	3708	taskmgr.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: 33	3708	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3708	taskmgr.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe
Token: SeCreatePagefilePrivilege	5228	chrome.exe
Token: SeShutdownPrivilege	5228	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
5228	chrome.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3708	taskmgr.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
720	OpenWith.exe
3708	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 4572	5228	chrome.exe	92
PID 5228 wrote to memory of 4508	5228	chrome.exe	93
PID 5228 wrote to memory of 4508	5228	chrome.exe	93
PID 5228 wrote to memory of 5256	5228	chrome.exe	94
PID 5228 wrote to memory of 2896	5228	chrome.exe	96
PID 5228 wrote to memory of 2896	5228	chrome.exe	96
PID 5228 wrote to memory of 5956	5228	chrome.exe	97
PID 5228 wrote to memory of 940	5228	chrome.exe	98
PID 5228 wrote to memory of 5956	5228	chrome.exe	97
PID 5228 wrote to memory of 940	5228	chrome.exe	98
PID 5228 wrote to memory of 256	5228	chrome.exe	99
PID 5228 wrote to memory of 256	5228	chrome.exe	99
PID 5228 wrote to memory of 4316	5228	chrome.exe	100
PID 5228 wrote to memory of 4316	5228	chrome.exe	100
PID 5228 wrote to memory of 5152	5228	chrome.exe	101
PID 5228 wrote to memory of 5152	5228	chrome.exe	101
PID 5228 wrote to memory of 1508	5228	chrome.exe	102
PID 5228 wrote to memory of 1508	5228	chrome.exe	102
PID 5228 wrote to memory of 2940	5228	chrome.exe	103
PID 5228 wrote to memory of 3264	5228	chrome.exe	104
PID 5228 wrote to memory of 3264	5228	chrome.exe	104
PID 5228 wrote to memory of 2316	5228	chrome.exe	105
PID 5228 wrote to memory of 2316	5228	chrome.exe	105
PID 5228 wrote to memory of 4528	5228	chrome.exe	108
PID 5228 wrote to memory of 5712	5228	chrome.exe	109
PID 5228 wrote to memory of 4884	5228	chrome.exe	110
PID 5228 wrote to memory of 4528	5228	chrome.exe	108
PID 5228 wrote to memory of 5712	5228	chrome.exe	109
PID 5228 wrote to memory of 4884	5228	chrome.exe	110
PID 5228 wrote to memory of 1972	5228	chrome.exe	112
PID 5228 wrote to memory of 1424	5228	chrome.exe	111
PID 5228 wrote to memory of 1972	5228	chrome.exe	112
PID 5228 wrote to memory of 932	5228	chrome.exe	113
PID 5228 wrote to memory of 1424	5228	chrome.exe	111
PID 5228 wrote to memory of 932	5228	chrome.exe	113
PID 5228 wrote to memory of 3144	5228	chrome.exe	114
PID 5228 wrote to memory of 3144	5228	chrome.exe	114
PID 5228 wrote to memory of 3300	5228	chrome.exe	115
PID 5228 wrote to memory of 3300	5228	chrome.exe	115
PID 5228 wrote to memory of 2724	5228	chrome.exe	116
PID 5228 wrote to memory of 2724	5228	chrome.exe	116
PID 5228 wrote to memory of 5792	5228	chrome.exe	117
PID 5228 wrote to memory of 3296	5228	chrome.exe	118
PID 5228 wrote to memory of 524	5228	chrome.exe	119
PID 5228 wrote to memory of 5792	5228	chrome.exe	117
PID 5228 wrote to memory of 3296	5228	chrome.exe	118
PID 5228 wrote to memory of 524	5228	chrome.exe	119
PID 5228 wrote to memory of 3160	5228	chrome.exe	121
PID 5228 wrote to memory of 3160	5228	chrome.exe	121
PID 5228 wrote to memory of 4732	5228	chrome.exe	122
PID 5228 wrote to memory of 4732	5228	chrome.exe	122
PID 5228 wrote to memory of 1532	5228	chrome.exe	123
PID 5228 wrote to memory of 1532	5228	chrome.exe	123
PID 5228 wrote to memory of 6016	5228	chrome.exe	124
PID 5228 wrote to memory of 6016	5228	chrome.exe	124
PID 5228 wrote to memory of 5100	5228	chrome.exe	126
PID 5228 wrote to memory of 4108	5228	chrome.exe	127
PID 5228 wrote to memory of 2232	5228	chrome.exe	128
PID 3692 wrote to memory of 2908	3692	chrome.exe	131
PID 3692 wrote to memory of 2464	3692	chrome.exe	132
PID 3692 wrote to memory of 1384	3692	chrome.exe	133
PID 3692 wrote to memory of 1384	3692	chrome.exe	133
PID 3692 wrote to memory of 1188	3692	chrome.exe	135
PID 3692 wrote to memory of 1188	3692	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.py
1⤵
- Modifies registry class
PID:5940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff935d0c728,0x7ff935d0c734,0x7ff935d0c740
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,6633454312199102749,11946845819478632339,262144 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,17930632170569541840,1147066571596265082,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,7180530568426984629,9395861146735614660,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,6285005860873957536,3248206243081844931,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,2500144530266567558,11124243977821564409,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4744,i,13098621789979635865,38506751729784603,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,6516708455129461901,17941783135199540948,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,1199004089525917087,8174966488667157617,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,2605068154913720921,11878195378448819112,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,2621661480152285465,7741846375950300094,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,11498743432724165459,15390465696551613426,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5644,i,6846081019337843379,11350967672740460444,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,3619740821012047603,13798406643848549109,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4996,i,3958794430004330173,15933154770874204746,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5868,i,5261290420407644854,18107850312813655978,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6260,i,13913449374386429909,16485179219071143024,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,17089975815836139071,212128440433967259,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4904,i,3338254049130661571,6715380639247152515,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5772,i,17418157243648606698,6164757300658128187,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6228,i,4958745257648682787,3894035752101592352,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,8175340546625316115,16298085380641651966,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6500,i,2754323213214813394,7177865030437096125,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6516,i,6046538088291753130,3484842126905675231,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6524,i,6109880834334425162,9447123794398172795,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:9
  2⤵
  PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4832,i,17642899098364651310,17930381578778208525,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3348,i,13673044160246978393,16618340902225241025,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3344,i,17016254374666327290,14447361479038210509,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3684,i,7076857947100741403,2052346995519987416,2097152 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,14382348484614233887,13168956389747525769,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,16370890231429946550,2401338625808395635,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,17590058229189882862,5251273258534792795,524288 --field-trial-handle=1928,i,17953225223524896253,7558241173370448445,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:2232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff935d0c728,0x7ff935d0c734,0x7ff935d0c740
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1828,i,9847081487796153674,4465083304649588103,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,1983307053321641058,5764559007769284432,262144 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,1489995009146131142,11899737643234462891,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,11318623994736790279,16377793180650652023,2097152 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,5846259394824752714,7683248963767442528,2097152 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4548,i,2982371640131045910,17998328150927838124,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,4366071500605300477,10691335158296232482,2097152 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,2688821427661104455,4584925053917946744,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,16628679511078561246,4843491033711651853,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5708,i,14715919868280422240,5886276849794033020,2097152 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5828,i,14458331926438088779,3610912965123935144,2097152 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,14721417056628226951,1771471705073815416,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3680,i,14676544904550868092,8019870758323010083,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,5986246556470681175,18421713881314041279,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=3924 /prefetch:14
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,9646102925884288370,15298430428571233183,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=3548 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,13984907648032049134,12342147670743162572,524288 --field-trial-handle=1924,i,1393430927050442056,3808856617757616297,262144 --variations-seed-version=20260620-030036.173000-production --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4896
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  PID:3384
- - C:\Users\Admin\Downloads\SteamSetup.exe
    "C:\Users\Admin\Downloads\SteamSetup.exe"
    3⤵
    PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
      4⤵
      PID:5240
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        Kills process with taskkill
        
        PID:4092
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:2852
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:3292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8f934d48-e82d-4927-8cb9-d743049d6fd2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8f934d48-e82d-4927-8cb9-d743049d6fd2.tmp
Size 124KB
SHA256 a7cf3364675b0c4af70f62030fe83fa0e3ee54c38ecf0d909665589a0ba52c9f
MD5 c2ce0247187e4bdc523a9381f0d8b115
SHA1 bf31db059d0959bf2cf489841572616cb1d7a526
SHA512 e709093ba970f25cd65dd0699c3c6ef7b6a4d60d1d0d1bdcde7820a0a61af95b41035f491ea869627f559b7f74225288df5c02e76762f14a44c722a6efbcff70
SSDEEP 1536:gyxImysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0B:rHtoSKa6qMwgCh3hodf8U8+RhpN+
TLSH
T15BC3123C2C869C6F4DF2E140704BFBE6CE1DC8A2E04E956441BE6E5F6091CD59293E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 715178ea159b0d26f2f75485d38ccfa3d98a1e27b6ccba24e56d4800f753b8a9
MD5 fb19e509dc029ddfeafdd915ccc76976
SHA1 3c59a5e4a78fbb2d9e2569a4c61a2be4ef6c640d
SHA512 d348207beae17cf8cefd8021bc29a8967b132387a75263c5aee861ff9eb94276d32114e29dbbd96666f2d12e740dfeac040ebeb2960894993bdc5774da8901ab
MD5 SHA1 SHA512

Submit Download

2cd5304a-b7a6-4f46-b1cd-28ad17668507.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2cd5304a-b7a6-4f46-b1cd-28ad17668507.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

70269926-3486-42fc-9520-295a015e7bd1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\70269926-3486-42fc-9520-295a015e7bd1.tmp
Size 414B
SHA256 6615dbc081f4fa34fcb0d92e3943c5d405fe1c117be7b6c77d0efa25defc190f
MD5 7390f4aabd8a38703f6ae62cf11d59d8
SHA1 25350a621b66c7062e9dd6a9760016a54b37c689
SHA512 6bae821b568cc675bb0d9960cd4f6fc5369ad80af7b89e3d69d41f3676d5fab7e6a309f13c175dfb1dd2695812e53398587bf53024f858e9193f4982a1f1a58d
TLSH
T1E3E02BA6CC20EC270CFD171D6454574AEF4003172B414A5F373D920C8FB266E46A2C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6129ea0856addcdf7923aaaeca122377420e67a75b075232030c7100e3519cd1
MD5 ced7dcbefec3ab609022f5d5f984c92b
SHA1 515bd872776f0f3deb7624759132ce62a573159a
SHA512 f7fd23d0f9a7e3fbe2ebee4b62200e8e90776b2cf8dd669d62fad49e43385b2d3395f97f5a1d2e97af49da686638bd5daa6ec6dcaf93ae2b47df1df6bd62a3b9
SSDEEP 96:1V2N+dVWWBkvT9SM1wcEWeA+TZS2SoVM0iuhqn0nm5NK/UxzKfN3cdWBXxgvLMJh:1V2N+dVWWBkvT9SM1wcEWtQZS2bxthqE
TLSH
T127A16255865EF281DB713BB076C55E42773842CAF11F0F31386B62B19F4638452B2DE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 2df0495975d2a7b87d37b8719421216347c862a9ade1490aa33c2b2a814d6a63
MD5 6118f9e196c9ccc6fc0fd7f9dffba9cc
SHA1 ec7888f206a52397980208995dcb2cdaab3b83b5
SHA512 ec3f50b91b336fd9ae7e0d2f48e860cd0fa93367aaccd875b934fe03f98057161d95725d1e9f3d8d614373e4dda0ef468509b990ce033416785925fbe33f6bca
TLSH
T1A3F0A7359CBDA191CF156FF04A951D642B3E518BCA93078749B397E2944B3F15322075
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 208360cc68f7ea25af4e113f4c0035d4d9134faf1601b91ee485d7a16369feb3
MD5 7aab3a7256cdbda82d92c3acd6f350b1
SHA1 51834bcce0e0bd870d7cd9d4d87e53a46c20fc9c
SHA512 696605af159113031a6cdf89f313bde8eeac1c077122d6e32eca83d097eae4e2c6bc71adc75c1c2af71fbfec2b589cb5d67f89f8e48166225bdc70372e2ba60c
SSDEEP 3:MsEllllkEthXllkl2zEklYTKX:/M/xT02znjX
TLSH
T11A4404047FC5040DD50010F04051C3501370D5500515574734D155335CC5D400C40110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 d8d3ad408cead3c2dcfed507e7f9f4c4fec8675decdbe957990f7323b378324e
MD5 38fd6e88394b354eff7a9dc596e7e82b
SHA1 98a57925cc781078ae6de5983e331d0306a3f5e3
SHA512 afda4698612b05c1f7108ef0c6286976021a5118aadf4f25554a0c0afc4a13f45a3e5cffcb973baf49bcafc0aa69ba607425454049a1d5382bd6e5dd06ef3c91
TLSH
T190E02644258BC36E94A49423866CF34CDAD0340AB7CA39062799C8442182E046180284
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 28KB
SHA256 4bb53538c72d0c85023f7eb73a08b3131c47230fc95216a97d693264e8dfa5de
MD5 1e3ed9ef6123b9fd600403b5920423e9
SHA1 8ab56a79f2f66f0441fb5c3822f423643a682391
SHA512 69e2e240f46066387fdbb298ba3b29132f51a74b3f84148714b419f280b47e6e6a34507b59ce9c508d5b2b896c8a030a237de43eddf901e042f99fe4c39d5d23
SSDEEP 192:EcJyyquePY1ty5oPI1x51mrWV04NmO5+6291XJSQ:/muhn6mrCVBE1JS
TLSH
T152D24BAF1A347402DF815E3A109E6AB6C937A04C9FD2CEE4309DA412097670BF1250ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 cdf09a31708a4131660cc868f0f0497c640ba2e1e031723f3d8ac40a6fdb8cb5
MD5 659fa48090a62fc5141664d6aab09d74
SHA1 7d9866f5b7b5f34308d3bd238a3cd5f198793ebd
SHA512 3e05038188b15d15f11c3351ed62b82a7f55091d679fe77f2c5036604c7feb8a022d5a4f8e98e04047d9d4f6c6a0f530ed7e1e5560e7847cc972390d1a3adbfb
SSDEEP 192:ZUysyUqxZ0NhS6T2E/tH+bF+UI3iWGVWWNkqp33FD2Y:c/tIkUI3ijVWWNkqp9
TLSH
T1FBF35E5E2F243212CDBD923A68E604F7497CF03F87A366C55C6544B9CEE2756B01C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 50c8b75b059a87e8fcdf54b938f6ef81f2a1563ad6ca66fa7e433247cd5481c1
MD5 460e4f317d658ef702094b0474182835
SHA1 50f003d1828ce563dc58d75be8e70448d540acd1
SHA512 031f69013b0cfa0cc6d3634f0745f67bffc16d5a9590079b54fe73e1592d1f33969702c131602387a6435f667d321d2779110d4be3d27d7b2d2e0ecc2d695f09
SSDEEP 192:D0DKRKWT1pdqRBR4eQ9QWSRDSAGJMd0tRWK:D0DKRKWT1pdqRBR4eQ9QWSRDSAGJMd0V
TLSH
T1BEE15DF7C3D4CA2DC85152F4A7252F1BCE2A092893287D5B89D4EF4F93E2472D24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ee1c53d14e52d2823ed48cc1e8fc7a380d0a5d9d777c67df68f95f66adc58f6d
MD5 db9818d5dcd9525c1de48fe1a85050b9
SHA1 3d14e5168594c8b8c8fa97828c0623976c64641e
SHA512 e6bb8d44233c174014be34c13e3c47ce700fddde7b8642cc00edbc2913f0529c203127a8972f1a1b04ffce22063ef00b43b73ec075eb57f0f3a3f0c6aeae4f5e
SSDEEP 192:D0DKRKWTtmxmApdNeQ9QWSRDSAGJMd0tR+RGELHmzmDmemmmtmDmH:D0DKRKWTtmxmApdNeQ9QWSRDSAGJMd0Z
TLSH
T1EF026FF7C3D4CA2DC91156F0AB256F1BCE2A0924932C7D6AC9D4EE4BD3E2472D24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9c9311e3c312a02fdaf435723daae9035697ec9d50b427ab9ffc99615c4f1c2f
MD5 59b34234d76eed2e5a9bc46702617e75
SHA1 564d939cd3b0642877649e49bf101d22e243bc3a
SHA512 23b3d987770c7eb3ac5ac9a791ee7a16caca8f26b127634d2ca579fc569144923eba6dd7bc7ee5411e9c32d6aa0a90fe5841d4620de8a8479001dec83265b967
TLSH
T188317DDF967EB45F20BE046B0D54B80539BBA83112A178F4DBA6C3ACF0818F35A16067
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 52904c90b4d50480e9816aed19aad619166ff577b2da99d49a7e12c8164b5301
MD5 145e58b56985517ddb4d9c554a2b2116
SHA1 c9b2e003aaa1e866752d8a2773f345cc2e9708ed
SHA512 728c095643fd00dfd8ee2241a865791f181af620f415e92ea32b95ee0d0a1d8b43dc60042413a44542bc58fb224819980405e5ca48e32dc4e2887703d18a0ef7
TLSH
T14F118C9FD67DF46B30B9456B0D05B809A97B68311B9178F4CE6AC32CE0818F31F01012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f2febda2bf0ffce2d749000f97132514cccebe86a7bc246ce521492d68bb293b
MD5 4449e12c59caf2712c1a834cb91e6263
SHA1 11f4fa16d6e0c35126ed09aed60468e0a286a14f
SHA512 db3ac6b9aa4141c27454340e710063d0218822adebfe37659ce8bb67b432cac85a636548753839545f4911362227d922b13f3df455fabacf1e20c74a59002ad8
SSDEEP 192:dRbJ6qTv7jIkAPRp2oz9PHsb+WNnJG1PE235ex6VyIsnAUge:dRbJdrg1X7Bw0i2e6e
TLSH
T10732C72FAA10667B9CCBD21EFD657797E6F5102271D62E80E6FC892C10D7ACD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 62a046de939966797f17191672a134ee1c6d5f2244933935275f5dead99df354
MD5 12318f73be985f998c461012f6c86b30
SHA1 4ea62bcd144fbf656f99776537951aa0b4875ec4
SHA512 a0957e9610a169b8a6e0ce57e213ca5c43e63f9ff8ab8f0c9a75eabce8f4eeb1aef1ac1e46212e613977395cf2112da3126f016cb37687d9cc09d6571fb1404a
SSDEEP 192:fRbT6JJv7jIWAPRp2QhzIBC559PHsb+WN72Z0xXNyddTAkPE2a5euAoVyIsnAUge:fRbTKJgXXVzI2Bwrw/A/2aAMe
TLSH
T1A452D76BA920567B9DCBD12EF921775BE7F5202271D62E80EAFCCA1C11D7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6298b1f62bc8e637734a5f65775d10525593dd642a9ba5745aaccb82901511b8
MD5 2d364aa65664f9bd5c4e27e95de814a7
SHA1 b32fe09812cafdaaab630091a9920d9b8725f3a9
SHA512 ac683b53ecccaa7b4ec03e8e16af6cca233c9980b04e449a843cebb22f66c9db278817db7f0de57447fd0cbed6aa68c393eeffe340401984ce4b4444afadec7e
SSDEEP 192:dRbJ6qTv7jIkAPRp2oC59PHsb+WN72ZJGaNyXPE235euArPyIsnAUgE:dRbJdrg1XWBwVpM2lAfE
TLSH
T16242B76FA960567B9CCBD22EF925775BE2F5102271D62E80E6FCCA2C11D7ACD2213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7a8f4760b0ed93cc8076ae3bdd0046222f41714fb720f1d8467c1e3974790a1f
MD5 f788578e2a86561d365cbabf825a004b
SHA1 ae89469c6054594045ab0bb0970c52b3a8396fe4
SHA512 6a89852bfee32b6c961ab00490276cbe29dc12aa156aa6259461ce6799f4fc70f7ed6dbab4d2c533bab9fe2dc9f0fba9bceea06d57877c718467941044bf1f15
SSDEEP 192:fRbJ6JJv7jIWAPRp2QhzIBC5/9PHsb+WN72Z0xXNydpnXPE265euAoVyIsnAUgrK:fRbJKJgXXVzIkBwrw7M26AMe
TLSH
T1BC52E86BA920567B9DDBD22EF911775BE7F5102271D62E80E6FCCA1C11D7ACC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 b300bfb3924559e0040b3a07ef31d9eb5642e770f649b41ad0017a30b6ea529d
MD5 006202e2dc625b1c503a2b4af9b01004
SHA1 dacdcc898b47fc4a89a84ba7f7790e893e8e1038
SHA512 f8dd59d77ce1795cf341477ce594f42dffde776e9c5bf28f2db39f658062a4232cdf00b0abcb8451610e3c7c76dee8709277e854a08b9aba1e8146092547bf38
SSDEEP 384:xzjj+7KxkXqKf/pUZNCgVLH2HfgsluUXODj6+ErU3ZIHGgV1KfkOJRzbCC:x/j+7KxkXqKf/pUZNCgVLH2HfgsoGOXN
TLSH
T12252D867684C9A7B0FD8D68DDC167F4FACB5015766A4082452FB9C0803A9BCB124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c672930a0c6b5ee79bb3ea5985876d1aec3f4433baf83c8fb3cb6ec623d6cfcf
MD5 eb0f2c1367c40d0dd0f0360ad6098d98
SHA1 573a44e988be728d8afa3c50536680bdecebb1a8
SHA512 172b3ade4600b7ef47e322de9611e7d1857c1f254205bc238d6435f86771cbd36c8c714e6366049e8b2c2f9f35ae3b08973a4c3d3920ca308e9a3dfdd6708705
SSDEEP 384:xzjj+7KxkXqKf/pUZNCgVLH2HfgsluUXODj6+ErU3ZIHGfV1KfkOJATzbC8:x/j+7KxkXqKf/pUZNCgVLH2HfgsoGOXf
TLSH
T18852E967684C9A7B0FD8D68DDC167F4FACB50157A6A80C2852FB9C0803A5BCF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 8d995a359fa3d2f0c7f9a01b273895af49c126b613233ef028e7ec27c7429f1f
MD5 5f4769c9e007350222d4db2c59ef4192
SHA1 bdd4c03c5249a4cda21acf394ddcf32f4fec673f
SHA512 b4e80ca868bc5efe78e583dab9dfb52900eeaa21de2cbfbbdf8ee1a6d3734a64d216a8505ed7fdc16f1ccef1a22c10ad17ba43f0daa5be216c221efdc9a7c18f
TLSH
T1F2E02C8026CBE2BEA06980030A78B30C96F4B81EE3CE3E06AF00C84811C6A0878A1360
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13426436779010794

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13426436779010794
Size 6KB
SHA256 8bf32fa6ac992f260691afce51aa7c4fe8308be553f12891e9154af99b3d7e82
MD5 96d59ae091cac15f9f7ddbfd505114bd
SHA1 0019cd99c32063260dc9ebb1a5683d946e185248
SHA512 7925e7846e5e73b239c8f3e3a8164b8bdc6bb6db547c721a728bc085210f9c24e88d5e86765b58dd90bd99dc4e3749665f0b76d65484324cdee39204ae5b0ff7
SSDEEP 48:3zr09oWi+ioHdjA0u2iUgSL5/pDDCZMUA6lySk56KMNfrGu1dwQDd/tt/aO9JR:389jARVSL5/pDDCZHk56K2zGu1uM99JR
TLSH
T1ABD19C529EE4053ED27F853854FA21F1BB35B90039E6CE0F4191922908A3794AF78FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2e8186af02d5ad30d50fe72d59a3dfe9fe423f70815639989526d69dcf71795f
MD5 4359985ef93db05f8e67e1f56c3cece5
SHA1 6bc7567e736b1e1829200186ccaae3ee5b542f96
SHA512 eb8a5bd273f65f63f0a8b7668110158273affd268c720b783691da9379263ad713b54b899b3f780a9421b446cded363f8d73f5a536badca4800b2a71851c1225
TLSH
T1B3B0928C2B91811AD8C9073146488B82A204A46220402A528805DB224C19694BA11884
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 caf4329338cbd4835e1ac968a4bc29eb4261feff30703eeb58169254ef5bcc8b
MD5 87f66434553b9ec561872530dce578a4
SHA1 8d111d8237c3130ff3e9c8e09619d4522bc7231e
SHA512 0041bdc4e21491dee09801d1a5dde830dae2b4b460ba1926951e5facc54e3358a0c72c5ec4c586238f8cadd114ffd276257689ff265b5f6734c41ad0ff2ecb92
TLSH
T19DE026E06ACBC76F5089801B5224F30CC6F17409FBDFA6167F08E9CA638B6447182640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c8c1f9d80247445e7df12f76ea159403ddec72f1b986a53b9fc29b67f8c833ec
MD5 7657cd7952569825498223ab8c1b7a03
SHA1 d4b15c70d485a845dadcb596d36daeab6935357b
SHA512 b012e1d497ccdb0fde10a31c9fa04eb6f4c949ce2e0282f68ee7206887db93155c43fce2c1148960a4425886f3f0d7880e0ba41674613238d5a58220a0c55432
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 43e2a7704eca432105fa503e18d6698200f432e453044567072f44649a48f96c
MD5 665f9985f5467150a5bbad78001a20dc
SHA1 d3cef5de41e43ca5a6407b2a361ee9b6fc9d3b6a
SHA512 b74e5949f9998025174d008a15c6e6c59ad72e1a6418f996f88f942f9cdcd73ba3d997387b06f22acab58a545f47e84ce58ec4ba348e25deb5084047fa87c915
TLSH
T134A0023041FC5462CD0087B060620D9333624854A5B55B2354B244C48A5B5C54291344
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a0159.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a0159.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 a00f2f92149005caa021e2e3a10a4b21f18033b8a32050d6c9b4e0269e0b0c1e
MD5 e6ff08e9444f61c4decfa67b43c49d3d
SHA1 9362e0b294292ec75c117af0c3dbf8a371482ed9
SHA512 e494f5db01be5e0e290746a7df1b02dc8af51d2ff0f5476962c0c5cc1e3c3aa4f0cb5bf29e54330895631b9860e2107c962e73a457695259d58bccc506a587bb
TLSH
T1B3E0CDF065DBD7BF5046E0E34674B31D86F0BC0AE7CE764AA706D864658260473E06A9
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 e54fdd0dd93f59ae6a0b6d0373b7af339f28f5a82066d4e755860f0e3093daa8
MD5 fcd69ec2c3e6980ae8ab323b255703b9
SHA1 54f5434261b8aa7e8a5341f4ff1711719b3dac4b
SHA512 bc0cedbb3908cd42e26635f70bee20901db96dc8c39f9be1ad00300fe0e46118a2d42bcbfda5b0af789b1d59dc3d59fcf850371fb6fccefe56104f803f88863c
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBulLUL4VL1Lw:f7doKsKuKZKlZNmu46yjUuW
TLSH
T1E203208E977881F3C0B2C13EEEC246E5FC7C260CC7262DD111F903795D8C036516466A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 790316508c28b834d609d4d00cb8f3e4cc25cd5f286ae8c72c350c2fbb83791e
MD5 4a738c1b4310fb1285a6f154047172b6
SHA1 ff16a87f73abfe4b2d6819233cdcb0d79929c226
SHA512 5b73b92a7bae1ff20974c5baf0c4d1710c9759c86f71d7e4dd03aa91c3da8a02321619c7d907ce4f1ebccc5dacdd3ba6b5e756d89de9b77e44570051927d1e48
SSDEEP 3:ClvlHNllv/etXlIWho/+qg/G9TjffaXM/RuWGJpDEJ7KgJpDEJ7HBQn+l15zSF:C1MlImoGSCc/mLEJOgLEJLftzSF
TLSH
T11202228BA9448120D838003CC7CFA4A53A2E2D483FEB220120E0006CBC9E00288647C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\22b6a6d6-2548-4da7-bab0-b63a39bdfe70\4
Size 12.3MB
SHA256 b678de4066a223d0255ee71e0940d42c4b79b2bd9a116f78b0e36ddb97bf988b
MD5 28e673b4bca99901c13261ee05934a87
SHA1 adf4278f6213adcdda9056d22a782812e93dc609
SHA512 69d5f245784f320388f6b3052e1d19793c57c20a62f08e611cdefad29c56ea8620f63b30b230cb77a6d99bf4a86efb131e8c074dfbd81d9fac74cc8d8d8b0380
SSDEEP 393216:k5VNjE33XzBPUWVPXrgwf3oLf8pZrkg48MriRu28:k9sjlXPXrF3oL4ZuVku28
TLSH
T18AD63388F32763E1A610E7828DE7AA59CF79D1DDEC11ED3E1330171AA2243D716417BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 e292a0942035e3174d1fdf454a4218609c1a215711c25fee6b828985acf94695
MD5 0c2a1afb62021913827c483fdd38ccce
SHA1 0ef658dcf502c6f93e267d299c5cf78f44b16573
SHA512 5e20488b23328acf265e29986bb8248704c49a416f376f92ff8a5af6b43fbb2ef8ade697e0655ba239938f42998bdef3613399d956f90e1a4e8077db0895b1c0
TLSH
T145E02600BFCBC2EFE01690470135B30CD6C0380BEBD9150A2F00C88A5083A0469A0668
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ee593f45a80fa1ca8adfa043f39e395b42e267780c72343e0796e8331168a3af
MD5 47a0f005a0bc7b7775cb43899c26eb0b
SHA1 f8b9318dd61930a5f469cea9d1da7a117e7fa02a
SHA512 4ae0a69c0d9e59f6255d6ca17f120aa99c5f1b07dfda61589538a996efce91cb932edd9daf2c9369b4b17ed97ff21568154732e592b73a6f22ad88f3924c43d6
TLSH
T10F21F196F330C109C189867A647EAB280334D8129FB8EC0F05BA20792EB6B141E4B2D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 c2e436d0e13cd371fa0a72895a122f5b630fac833bbf26368ec52b16d8588e07
MD5 aef589fe1d4ab2bb7e767f3fa20aa19b
SHA1 dfa1d2339a86ecba97085482f83fa05221540e89
SHA512 4879f7901d275aafb524e14d787cff6bdb25da87510ffda994dcb4b52c1aa740e793ebce8ff8081707b5ac320734174a569986969eaf00188033e6967b41b47e
TLSH
T161E08650BB9BD2EF90A590530575F35DA7E0380BEBD96F0E2F05CCC951C6A4475A1368
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 422b7f7c0ae320f5868d1e1a1f6dbc3b5cdbc6ac0c6de4759ef65bbf8552d89e
MD5 9236041fab26d65ebede5dc8cd498433
SHA1 8e4f4d02aedd3bb0b3ef1d1b1e0eaad237a848de
SHA512 0b00b95010cda757fcd6926cfb8a7f4145f2f11c2d3e9e532de14655034c8b6d5b055cd54b00c5ed3d74b98a85ac44e0e78ed480412f233cdfc5f1fa5d4ac359
SSDEEP 1536:TyxImysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0B:gHtoSKa6qMwgCh3hodf8U8+RhpN+
TLSH
T131C3123C2C869C6F4DF2E140704BFBE6CE1DC8A2E04E956401BE6E5F6091CD59293E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 26b161eb91b0b260c42435536852d11f044fbac67a33c13d184de0cfd74dff3b
MD5 0771aa4aefd0f156327c6d8fe17a3bdd
SHA1 bbe1cb327b18654238e2ab885da73f4f9128ca4c
SHA512 81e3fdc53a4e11fff2f8f9b8d94dfca917b4a0e2bcee4adca1edba31f12c1f00882024394f15ea56767c3b08bbe7d2d47675b5d71cb34b02358f202988e7af5e
SSDEEP 1536:z8xtmysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0L:q0toSKa6qMwgCh3hodf8U8+RhpN2
TLSH
T14CC3123C2C869C6F5DF3E140B04BFAE68E1DC8A2E04E956041AE7F5F6051CD59293E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 60e057c62f7e442be81ce56e48909f463503d49abf8ebb6b0031aeba7f175e96
MD5 01d9c22be7b50fc28a4cf49e2135fc35
SHA1 fa549f9cd30efacc017079314a006e80f55a0d77
SHA512 3952efae4484547a6d288dd520a5d11062e4d91859e10c72076ed9ebeb91067768d0d7e78d0fc77abfbc261ee6c1210d6a3888d211f60671f76332367d994700
SSDEEP 1536:zgxKmysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0L:OJtoSKa6qMwgCh3hodf8U8+RhpN2
TLSH
T157C3123C2C869C6F5EF3E140B04BFAE68E1DC8A2E04E956051AE7F4F6051CD58293E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 47b40669d021e2c06e19d3ed389a2d15f79a8e175a3bfac7b9c00a829565cf1f
MD5 9a0c91e7b46b24fe7c23451fb1d78a3d
SHA1 3149ca1e7c04f220aa3db227429f63079e0a68f1
SHA512 e63e070183973fbc888fdcd8fe97240341f22c0c7ee6140f58b9fbca2c591a5322378a7fff53d1efe62616b2a3910c74b3b283cfb02b26e4c6c1ff3c3e68836a
SSDEEP 96:zC6kd+q/o6Oe4rRfPd6NdjRDotok5BpwD6B6EGyvsaKicTh0b7v4a:zC7x/oj1QJDUD7GqoycTh0bf
TLSH
T16EA11A3360684C7789B6D98975473F43CEB861ABE553AF50E8DD9E0C50B78E81302A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 e79cdcb996480b6334be535eeb9a336cbb3f802ddad1b30826173ce1f187cd74
MD5 b8a7172b73d14877bf4eeea5ed0c9d37
SHA1 8304302bfd34c79289bcd7dfa15e710be061f794
SHA512 c912c09a370993b769a3e0d1b7b436fe589a6e192bf8ed6121889f23631382a86d18e0afb7fe8691104b88c2dc53d62812c3d62b96518405efcccec844651dc4
SSDEEP 1536:T/xtmysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0B:F0toSKa6qMwgCh3hodf8U8+RhpN+
TLSH
T1D2C3123C2C869C6F4DF2E540704BFBE6CE1DC8A2E04E956401BE6E5FA091CD59293E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 69147be5b7da4171f6b8e389f740e032e7379220fd49ba2345b4f6b0e28da729
MD5 acbd2a2c450a677bf9f95b77952b8c8b
SHA1 e211971f0ad91520de33e00f9553bd5882355543
SHA512 2fe83c605485dd8029aa808b61c2a423b41e9b2fd64c9e297ca7f4adf05da47ec309ca14e927850e97fbfbe89634dfccd85fe6fc5a84ccc5fa0d2a3c0bf2d5d2
SSDEEP 3:MsEllllkEthXllkl2zEklyNll/:/M/xT02znwll/
TLSH
T164440405FFD40405CD0010317015C3500371D5110517D747355104135FCD5C00C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 eade3164e41ab8173fa48023d81aaf9ea9321cc4c6c3347f061c644574baaaca
MD5 488e0e4c0412bdcd0c17f891cad3db66
SHA1 86e9fdc70ca3102b679878579c437ad004563c48
SHA512 83c4440e831af59dd2b42fdef0293accba92a1f14c698e90e027a2a1df27ab516e5b10d14dfa9cd819143e418403da584ad24aca9a96f4755cdcc86a81cf4ba4
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0J0:TkkhCU2QB2zbBxxLj+Zy1kD5EcEy
TLSH
T1CD23D14E165861D9E1E5183EFEE24CB17CBD4F19CB2B69D205D00C7A4CE14AEA02F1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5228_1003787963\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 944834.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 944834.crdownload
Size 9.8MB
SHA256 1dffeb95662d0684e9f54339c335a89bcccac6abf625baf479ed7e36b995b08f
MD5 51e463e22f9a685b700cc086b4e85a85
SHA1 9bb50f4f68439907072a36e264741533cbe5b647
SHA512 c27c1b60d673031555ea12c14eb2d23e5975d4f772021ddbeaf8c3d0d648ce4347f2f80289760299e8c3d364987b5ae8f4c7fb617b91eebcbc9885c94dd21070
SSDEEP 196608:H6uoY0W8UA5gurHRP/XRLO/uAqMVVb582KKmZ:H6uEW8ZguJXsWAq4t5S
TLSH
T1D9A633A8779804E9FCAAE33DA9D094A3C2D5B56607A5C29387F04EA10D635D4FF32713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-573-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-575-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-574-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-572-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-571-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-570-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-564-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/3708-566-0x000001FFB9850000-0x000001FFB9851000-memory.dmp

Download

memory/5312-2343-0x00007FF92BF60000-0x00007FF92BF89000-memory.dmp

Download