redline | 1ee1e1838fddeb669812be73b8c1ebcaa272863ef6816c005ea8a48222f53c31

Resubmissions

06/07/2026, 22:26

260706-2ck84scx4110

06/07/2026, 22:22

260706-2ap5aacx2110

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
-WzUnlockTool.exe
Size 1.1MB
Sample260706-2ap5aacx21
SHA256 1ee1e1838fddeb669812be73b8c1ebcaa272863ef6816c005ea8a48222f53c31
MD5 74be69e45119c12cf49276b25f57954e
SHA1 0e198373e3cb8c408ae5abd56ffb42b135236010
SHA512 3e42934bb89bbb9a7fd92e52bcc4b1f5990b412f2aa1805536e4542e7853630d343f6576df69faf001c79c18a6eeb28fb17d1ce6fac24fbcf31ccb6418c93d00
SSDEEP 24576:dn2w6BFObXB/TYHYkQhz1TmMxHdYtwbdgMX3:IwPbXBSO5gMX3
TLSH
T133454B39E74615F4DA235775858EEB7B9B147A248032AE3FFF8BDA08B4331123C85256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery redline infostealer

Malware Config

Extracted

Family

redline

185.215.113.83:60722

Attributes

auth_value
1df585fad5dcd4ff87adc75b9c32927b

Signatures

Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/185048-2-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3400 set thread context of 185048	3400	-WzUnlockTool.exe	87

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	-WzUnlockTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1496	mspaint.exe
1496	mspaint.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1496	mspaint.exe
1496	mspaint.exe
1496	mspaint.exe
1496	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 185048	3400	-WzUnlockTool.exe	87
PID 3400 wrote to memory of 185048	3400	-WzUnlockTool.exe	87
PID 1436 wrote to memory of 472	1436	chrome.exe	97
PID 1436 wrote to memory of 2292	1436	chrome.exe	98
PID 1436 wrote to memory of 4884	1436	chrome.exe	99
PID 1436 wrote to memory of 2292	1436	chrome.exe	98
PID 1436 wrote to memory of 2868	1436	chrome.exe	101
PID 1436 wrote to memory of 2868	1436	chrome.exe	101
PID 1436 wrote to memory of 1100	1436	chrome.exe	102
PID 1436 wrote to memory of 1100	1436	chrome.exe	102
PID 1436 wrote to memory of 3896	1436	chrome.exe	103
PID 1436 wrote to memory of 3896	1436	chrome.exe	103
PID 1436 wrote to memory of 1524	1436	chrome.exe	104
PID 1436 wrote to memory of 1524	1436	chrome.exe	104
PID 1436 wrote to memory of 5952	1436	chrome.exe	105
PID 1436 wrote to memory of 5952	1436	chrome.exe	105
PID 1436 wrote to memory of 2696	1436	chrome.exe	106
PID 1436 wrote to memory of 2696	1436	chrome.exe	106
PID 1436 wrote to memory of 5304	1436	chrome.exe	107
PID 1436 wrote to memory of 5304	1436	chrome.exe	107
PID 1436 wrote to memory of 5356	1436	chrome.exe	108
PID 1436 wrote to memory of 1936	1436	chrome.exe	110
PID 1436 wrote to memory of 3480	1436	chrome.exe	109
PID 1436 wrote to memory of 3480	1436	chrome.exe	109
PID 1436 wrote to memory of 1936	1436	chrome.exe	110
PID 1436 wrote to memory of 6656	1436	chrome.exe	115
PID 1436 wrote to memory of 6660	1436	chrome.exe	114
PID 1436 wrote to memory of 6656	1436	chrome.exe	115
PID 1436 wrote to memory of 6660	1436	chrome.exe	114
PID 1436 wrote to memory of 6860	1436	chrome.exe	116
PID 1436 wrote to memory of 6860	1436	chrome.exe	116
PID 1436 wrote to memory of 6868	1436	chrome.exe	117
PID 1436 wrote to memory of 6868	1436	chrome.exe	117
PID 1436 wrote to memory of 7004	1436	chrome.exe	118
PID 1436 wrote to memory of 7004	1436	chrome.exe	118
PID 1436 wrote to memory of 7320	1436	chrome.exe	119
PID 1436 wrote to memory of 7320	1436	chrome.exe	119
PID 1436 wrote to memory of 7704	1436	chrome.exe	120
PID 1436 wrote to memory of 7704	1436	chrome.exe	120
PID 1436 wrote to memory of 8200	1436	chrome.exe	121
PID 1436 wrote to memory of 8200	1436	chrome.exe	121
PID 1436 wrote to memory of 8556	1436	chrome.exe	122
PID 1436 wrote to memory of 8556	1436	chrome.exe	122
PID 1436 wrote to memory of 8624	1436	chrome.exe	123
PID 1436 wrote to memory of 8624	1436	chrome.exe	123
PID 1436 wrote to memory of 8672	1436	chrome.exe	124
PID 1436 wrote to memory of 8672	1436	chrome.exe	124
PID 1436 wrote to memory of 8964	1436	chrome.exe	125
PID 1436 wrote to memory of 8964	1436	chrome.exe	125
PID 1436 wrote to memory of 9352	1436	chrome.exe	126
PID 1436 wrote to memory of 9352	1436	chrome.exe	126
PID 1436 wrote to memory of 9368	1436	chrome.exe	127
PID 1436 wrote to memory of 9368	1436	chrome.exe	127
PID 1436 wrote to memory of 9940	1436	chrome.exe	128
PID 1436 wrote to memory of 9948	1436	chrome.exe	129
PID 1436 wrote to memory of 9956	1436	chrome.exe	130
PID 1436 wrote to memory of 10192	1436	chrome.exe	131
PID 1436 wrote to memory of 10192	1436	chrome.exe	131
PID 1436 wrote to memory of 10224	1436	chrome.exe	132
PID 1436 wrote to memory of 10224	1436	chrome.exe	132
PID 1436 wrote to memory of 10320	1436	chrome.exe	133
PID 1436 wrote to memory of 10320	1436	chrome.exe	133
PID 1436 wrote to memory of 10364	1436	chrome.exe	134
PID 1436 wrote to memory of 10364	1436	chrome.exe	134

C:\Users\Admin\AppData\Local\Temp\-WzUnlockTool.exe
"C:\Users\Admin\AppData\Local\Temp\-WzUnlockTool.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:185048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2864

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\WriteRequest.gif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf710c728,0x7ffcf710c734,0x7ffcf710c740
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,5863292372994269626,7810662446555648331,262144 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1916,i,187214052436374653,2399481601421439822,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,8635202656285562927,9098247749294259143,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,1190303046129539318,11432570613825148378,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,10586182775954250732,10829416150640111322,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4400,i,9555536005894583327,670030164385983206,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4804,i,1365032280573947331,16811208558513343958,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,17049019872115054735,2814446221891516977,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4632,i,7698656538212785925,14054431678173600489,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,3968202590993862775,3684976481382733297,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4824,i,967989730349477687,14662067565612568186,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3628,i,5339963915134024576,14636295783414325358,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5784,i,6032990547253639164,9650400450042850723,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:6660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5816,i,6114946951960854168,7785109391062079666,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:6656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3656,i,15920179841063557155,2265898645573028352,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5780,i,1511640708461076725,2385641659685599909,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3560,i,12751438302396133204,2406150030502432542,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6140,i,8418711567146543133,14750831228438547509,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:7320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3560,i,8752815088627933890,14473962594348164501,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:7704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6116,i,11086617388001991641,13701804720914728049,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:8200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,17201622327168839384,11408002928790565072,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:8556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,10926468752175737234,6578858075128732137,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:8624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,15111752511263895841,818794452034743648,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:8672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,17074509545296154833,9106372438451693060,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:14
  2⤵
  PID:8964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3576,i,6334051893989626406,4489703035037501636,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:9
  2⤵
  PID:9352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5804,i,174191634074044961,11134670468737266700,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:9368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5176,i,10366029326089907290,3162279055426951727,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:9940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,1891719973232283505,10564450342607179756,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:9948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,14550380347254349015,6577624264661201716,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:9956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3276,i,4385453479710358623,1149719168643620680,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:10192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5228,i,9514076456447855045,16136017646783280615,2097152 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:10224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,9246293141615939086,14649740653450748136,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:10320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,368014701477483489,13692137830277150266,524288 --field-trial-handle=1800,i,13315597852022199771,2337305031728482102,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:10364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2a28d13062ee2ce8d191f38f3684c23e1908332b4fabf968250118689f23405b
MD5 30d4cbb3c5e3caabc50f5579256086cb
SHA1 a0d2dee1ff8d154fcd0bd2b00a86c4c115de8cf3
SHA512 fd8bfc54937e6de6b58e975010cda41f24b08aab38e53e2bde9e2a2f821e2711466000605513159e5ea794ae7cefef196c245c913b0ab3acbe14acfcdda1a2a7
TLSH
T19631002BE052C883CB4274F1A29E3691B4D64B0DCB0C36AE483095B36107F976AD72A7
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 5a34cbac1d3dd84ed70c9ba5b71e8e64492b954e189e52be0f7160b2e23fe2a4
MD5 98d5380824201fd3880064b1fe917e42
SHA1 99ce862d98a6b9805458bb7c223a0a2abc52d36e
SHA512 98884aff1bb201ef5eb8325b7e5e0a4b7677949566837cb3cfed20d181770d9881603d12a641cb747e62e1579c6a13dcd7d460bd8fcde8302ffe492da2cf5aeb
SSDEEP 192:DSm9CcL+JSr3JhkrkdkXkTkFvwtOaP7v9BQtfP9ZNPnIuTkDXkDlkRkDGkQkrk5c:DSm9CcL+JSr3JhkWSi0vwtOaDFBQtflV
TLSH
T18532AFF3C3D8862DD81156F8A7257E1ECD2E1A24432C3C26D8D5BF5B93E2872E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8c3fc2848dde2dfeadf23c09f84832872b08be4ce6e34b4827756b8effb989f7
MD5 dcb6dd0fcc08bc508c1085ebf860fe33
SHA1 bf6dae0bf266b4461a71edc813d475c6946a95a9
SHA512 53421b84c8227683ccbfc80a3a1a0b0409ebb62b83fe939510c4271b986d5c1f98c703d0af04e73c4e60ff8715ba84ea7a4d47c2fa73061ab8c3bfad65bafff0
SSDEEP 192:PRmccBhdn8yv71APRp2Mmplu9vHsb+WNPULlKmUbe/2QRVyIsnAUgE:PRXmhd8eEXT5wt9e13E
TLSH
T1FA42972FAD24657B5CD7D22AF9217757D7F6102162D42E84E6FCCA2C12EBACC2213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4c82aec94cdd72cbca8b7875bf354a4294a7ab2227c174250d4232aa1432cc76
MD5 4a349d064641754c940704d27da15033
SHA1 d10ac2c1fab958e4a84f89f7bc0f1a128f710e8a
SHA512 2d871c09c04879a8b12585e9e757fad574895f60e54ace8d1461b16a033653bb33b80e0ff58e70c1cbc2a816b63ba402b081bcb62f3cc51dd77c21f97070f3d1
SSDEEP 192:TRmzcBhdn8yv71APRp2Mu/9vHsb+WNnETbro2QcQRVyIsnAUge:TRemhd8eEXC5w8o2g3e
TLSH
T16632961FAD14A53B5CDBD22AFD257753D7F6102162A42E84E6FCCA2C01EBACC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5a9fc3a4fed4fbdf962df3750e487b0a92c36ecd8c61189a340066462bed12e3
MD5 06022fad2f8e9e59d78c796a9005c02f
SHA1 5972acbeabd6c03bb2dc55f3a1bc9172e6c56a54
SHA512 c6bc2a4a415706219ef03c9b69869576c9640fd76416d7ffa35f339a767e4a7fe414d2e39c31d9c36ac8349a373def71eba3accbd928c61011f3a1f47bbfe300
SSDEEP 192:PRmzcBhdn8xv7xePRpMMmplu9vHsb+WNPULlKmUbe2UQRVyIsnAUgE:PRemhd8h+Xx5wt9eA3E
TLSH
T1C742A65FA924657B5CD7D32AF921B757D7F5102162E42E84EAFCCA2C02EBACC2213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 f3f057451794cad9bd36a00756f62f91fc6d5f8b6b65d92c9db8e3bb2d677555
MD5 dec14a0f749522dd88ce697e20a62336
SHA1 8647c3ad700a388da4696c1a414a76653626af3d
SHA512 df729673b51f630edaad86626f11c0c8121cafea3e779f64de8b0e80beac0cee427ea1f0dc64f5f04ef50b0daa7d864fa31537b2732e07fd347fec6310517e0d
SSDEEP 192:eNq4K6Hv7KxkXqK4I40pUZNCgVLHrKHfFKslEf17XzKD/cz+ErUkKN9qV2DcUSrE:IqjUv7KxkXqKf/pUZNCgVLH2Hfgslg7S
TLSH
T12632E827A48DAA7F4FDCD509CC536F4F6CB5029762780D2456FBAD0803A978A114B2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 264B
SHA256 64cbf44fcf70d3540b5e732fef3043c2f247be0572f127634292af345d2037b2
MD5 5eaa6066d6e8263c51423f35aa089334
SHA1 453a43b0050809162ef10ea15447dc52b0313dce
SHA512 27bd1ee51309a0e3da5524340e329977d03690e30de4ba086fc4695555db6cbfc668dc9d80d41bc57a77dfefb5c946295a0466e1a6eb55d2f7bd8c95871a8b67
TLSH
T174D08001C04D61D0C03CC771575660C81775AD65CE5C37996778744FBCF6571206B71A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7a922be692efd7b47dcf845802f517b06c926908c8420951a38315f31e926f9a
MD5 692bf5ddedcaeff5fba185ec0eb8f1be
SHA1 057e83d9fd08327dab57cc4b43a5484eddf9ac17
SHA512 057768fbe291d762c92675906b2f5443cdd51b813db24d978cfc8615bda6f04a3f1430ac080b104eb18380cfc31cfd1f414948c5b65519777055c5d4fe20f8f6
TLSH
T131A0021942E00C31D80193B216A502D623629824031282135494808989977835102242
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bf43e06f4ccfadb6eaef20a83e6bf7bf4cde86211e0de6ee08c0cd714d6b89c3
MD5 f472864c1a86d2121e4cd06bb925f1cb
SHA1 6bcd6bc7e0157401e80017ff688851a4e2a31196
SHA512 21a47e9bb69f4e3ad12101e609ba751964d7bc48ab6ac50d3b3bb3c8eb62d4f8cb05293bc797300beaa70b0ce612fb9087efa018e9466ba114521b2499886240
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 25c67727127048976b5a9af183af03b98ef04d1d21511e13e7f2d4a2d128c5c8
MD5 b98d974f6cf6bcc857017010a0fa06c9
SHA1 200772eb733b92ed6a1f2c57157c4fa5725375cf
SHA512 4ae591113cb81d4e7a0b89b4eee7f8469b14849cd0a87f49f42e193d599b66b320dde60c3ff1ba25b55882daa7a1ab3fcd62ed1b81588610ddfb07e1c28ccc58
TLSH
T1BFA0027097C80512DD014274E4A31F53B2EE581C6955C7035496848BAD9B3C84743650
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 a568298b6d9ff67000d4a5b0f2fe00b133e84fe2ed9524d4f3dcd5303b7d8703
MD5 645434e925c0a39c6a6c9853e4bff122
SHA1 48b8134d7cbcce6a8237c7e2c39b0eeb85263065
SHA512 2cec2d3f987e392c7956172a357155356b525522daf72d2eef1abfd968300f46214db5a2609a8c36b770e4d1689d3e9c2b8af7b5364ed4ced9d952e0374c44df
SSDEEP 3072:94vncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdfn:9ocBaj2tiHpCbVDpaJ/v8ww
TLSH
T1AEC302B3BC1DB869583D9082B04606CF5F906FD386747DFEAEEB6B8902060DE5711939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 d4f0acee1199eb9b8a910d2719969392caf35e8725c9bc5f732fa1c38b8c4335
MD5 7c90819d4fe950f8d1d5334e7c16f259
SHA1 c42f06cce12167dff3949a341b99e4a501724d68
SHA512 803a1484156ce18ef2c77b451997c70b1cbe94a49f85b8bc555bd538058e5f445c593247e0bbff45a95121fe74ac2029d9118b8c18cde6fe71c61946bf6c0e89
SSDEEP 3072:e45Fncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdfn:eGdcBaj2tiHpCbVDpaJ/v8ww
TLSH
T12AC302B3BC1DB928983D9182F05646CF67906FD241B57DFFAEEF9B8902460DA5310938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9a84bedb586414e113b9cde27e8fbf223f404ac8e88a6b2ff2ed03e2e668ea7d
MD5 99026c08d3046fd636f6b7649a626ea5
SHA1 151c25fdc08ed266b4580f1ab96a30d36283ec0c
SHA512 466452b6b9dba1886c06f30f56fdf4f562a61791c48edc910a50073629a7937f5c05f6cc153f60e1f7dfcc648ab7c232a467c6296a17f91d14a6658b6b362c05
SSDEEP 96:cMC6dd+BXK7CXon4efaRN6GRDotok5fHD5B6AdGyvLtWy2O7TFn5v4a:JCubWXon4XRBDUD7f7wz1O7TFn1
TLSH
T165A1F832A4399D7398B6D585B9527713DFB46167AA509FC8A9EC0F0C01FB49C1742713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 b1e5f093969bd6932be70fc69d539ae82c9ca7ab53f16fce73b3c79083ee1893
MD5 d50dee54a963121e087251fe1a5257ea
SHA1 f80f9dd26488eea6b43a39aa2b2f8c452e26e7c1
SHA512 157f47d5906ceaf62f155db4aada42b900568ba459493ddf7eab9f8e0df6d9264bd7b458f9b2e74e3fde71d4073f84d4c14cdf8703da8152c6baf1c16c0e2634
SSDEEP 3072:e4gFncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdfn:ezdcBaj2tiHpCbVDpaJ/v8ww
TLSH
T145C302B3BC1DB928983D9182F05646CF67906FD241B57DFFAEEF9B8902460DA5310938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 42c52e279b4a3f0ed53b367b3c4a084020411a45a6db22e781916cc025bbba5e
MD5 6a44169aa2a4d4e6c4a616f8f6d012bd
SHA1 6f8a87bf1ce717a70f16263e041cf5bb42963df3
SHA512 b1e2b21effb0449255d2c531126bf5e79a9b3f0459bff60939da2f48e0210671cabcc551e7222e5e0f6abefcfa25255c2db5a0ec66934b713500667337452924
SSDEEP 3072:941Fncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdfn:9edcBaj2tiHpCbVDpaJ/v8ww
TLSH
T1B2C302B3BC1DB928983D9182F05646CF67906FD241B57DFFAEEF9B8902460CA5310938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1436_1609604015\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3400-7-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/3400-1-0x00000000004B7000-0x00000000004B8000-memory.dmp

Download

memory/3400-0-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/185048-14-0x00000000057D0000-0x000000000581C000-memory.dmp

Download

memory/185048-12-0x0000000005790000-0x00000000057CC000-memory.dmp

Download

memory/185048-11-0x0000000005860000-0x000000000596A000-memory.dmp

Download

memory/185048-10-0x0000000005730000-0x0000000005742000-memory.dmp

Download

memory/185048-9-0x0000000005C90000-0x00000000062A8000-memory.dmp

Download

memory/185048-8-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/185048-13-0x0000000074970000-0x000000007512C000-memory.dmp

Download

memory/185048-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/185048-15-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/185048-16-0x0000000074970000-0x000000007512C000-memory.dmp

Download