redline | 1ee1e1838fddeb669812be73b8c1ebcaa272863ef6816c005ea8a48222f53c31

Resubmissions

06/07/2026, 22:26

260706-2ck84scx4110

06/07/2026, 22:22

260706-2ap5aacx2110

Analysis

user interaction
yes
max time kernel
1049s
max time network
1049s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
-WzUnlockTool.exe
Size 1.1MB
Sample260706-2ck84scx41
SHA256 1ee1e1838fddeb669812be73b8c1ebcaa272863ef6816c005ea8a48222f53c31
MD5 74be69e45119c12cf49276b25f57954e
SHA1 0e198373e3cb8c408ae5abd56ffb42b135236010
SHA512 3e42934bb89bbb9a7fd92e52bcc4b1f5990b412f2aa1805536e4542e7853630d343f6576df69faf001c79c18a6eeb28fb17d1ce6fac24fbcf31ccb6418c93d00
SSDEEP 24576:dn2w6BFObXB/TYHYkQhz1TmMxHdYtwbdgMX3:IwPbXBSO5gMX3
TLSH
T133454B39E74615F4DA235775858EEB7B9B147A248032AE3FFF8BDA08B4331123C85256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery redline infostealer persistence ransomware

Malware Config

Extracted

Family

redline

185.215.113.83:60722

Attributes

auth_value
1df585fad5dcd4ff87adc75b9c32927b

Signatures

Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/185624-22-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file 1 IoCs

flow	pid	Process
133	79460	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
110	discord.com
111	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 185624	1448	-WzUnlockTool.exe	100

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	-WzUnlockTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
79460	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
10056	chrome.exe
10056	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe
Token: SeShutdownPrivilege	76848	chrome.exe
Token: SeCreatePagefilePrivilege	76848	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe
76848	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 76848 wrote to memory of 77088	76848	chrome.exe	89
PID 76848 wrote to memory of 79416	76848	chrome.exe	90
PID 76848 wrote to memory of 79416	76848	chrome.exe	90
PID 76848 wrote to memory of 79460	76848	chrome.exe	91
PID 76848 wrote to memory of 79512	76848	chrome.exe	93
PID 76848 wrote to memory of 79512	76848	chrome.exe	93
PID 76848 wrote to memory of 79536	76848	chrome.exe	94
PID 76848 wrote to memory of 79536	76848	chrome.exe	94
PID 76848 wrote to memory of 79544	76848	chrome.exe	95
PID 76848 wrote to memory of 79544	76848	chrome.exe	95
PID 76848 wrote to memory of 80068	76848	chrome.exe	96
PID 76848 wrote to memory of 80068	76848	chrome.exe	96
PID 76848 wrote to memory of 80088	76848	chrome.exe	97
PID 76848 wrote to memory of 80088	76848	chrome.exe	97
PID 76848 wrote to memory of 80576	76848	chrome.exe	98
PID 76848 wrote to memory of 80576	76848	chrome.exe	98
PID 76848 wrote to memory of 81068	76848	chrome.exe	99
PID 76848 wrote to memory of 81068	76848	chrome.exe	99
PID 1448 wrote to memory of 185624	1448	-WzUnlockTool.exe	100
PID 1448 wrote to memory of 185624	1448	-WzUnlockTool.exe	100
PID 76848 wrote to memory of 185652	76848	chrome.exe	101
PID 76848 wrote to memory of 185652	76848	chrome.exe	101
PID 76848 wrote to memory of 186140	76848	chrome.exe	102
PID 76848 wrote to memory of 186248	76848	chrome.exe	103
PID 76848 wrote to memory of 186244	76848	chrome.exe	104
PID 76848 wrote to memory of 186248	76848	chrome.exe	103
PID 76848 wrote to memory of 186244	76848	chrome.exe	104
PID 76848 wrote to memory of 3292	76848	chrome.exe	106
PID 76848 wrote to memory of 3292	76848	chrome.exe	106
PID 76848 wrote to memory of 5260	76848	chrome.exe	109
PID 76848 wrote to memory of 5260	76848	chrome.exe	109
PID 76848 wrote to memory of 4816	76848	chrome.exe	110
PID 76848 wrote to memory of 4816	76848	chrome.exe	110
PID 76848 wrote to memory of 5024	76848	chrome.exe	112
PID 76848 wrote to memory of 5204	76848	chrome.exe	111
PID 76848 wrote to memory of 5024	76848	chrome.exe	112
PID 76848 wrote to memory of 5204	76848	chrome.exe	111
PID 76848 wrote to memory of 1908	76848	chrome.exe	113
PID 76848 wrote to memory of 1680	76848	chrome.exe	114
PID 76848 wrote to memory of 1908	76848	chrome.exe	113
PID 76848 wrote to memory of 3612	76848	chrome.exe	115
PID 76848 wrote to memory of 1680	76848	chrome.exe	114
PID 76848 wrote to memory of 3612	76848	chrome.exe	115
PID 76848 wrote to memory of 4568	76848	chrome.exe	116
PID 76848 wrote to memory of 4860	76848	chrome.exe	117
PID 76848 wrote to memory of 4568	76848	chrome.exe	116
PID 76848 wrote to memory of 4860	76848	chrome.exe	117
PID 76848 wrote to memory of 1572	76848	chrome.exe	118
PID 76848 wrote to memory of 5744	76848	chrome.exe	119
PID 76848 wrote to memory of 1572	76848	chrome.exe	118
PID 76848 wrote to memory of 5744	76848	chrome.exe	119
PID 76848 wrote to memory of 6148	76848	chrome.exe	120
PID 76848 wrote to memory of 6148	76848	chrome.exe	120
PID 76848 wrote to memory of 7232	76848	chrome.exe	121
PID 76848 wrote to memory of 7240	76848	chrome.exe	122
PID 76848 wrote to memory of 7248	76848	chrome.exe	123
PID 76848 wrote to memory of 7880	76848	chrome.exe	124
PID 76848 wrote to memory of 9376	76848	chrome.exe	129
PID 76848 wrote to memory of 9376	76848	chrome.exe	129
PID 76848 wrote to memory of 9412	76848	chrome.exe	130
PID 76848 wrote to memory of 9412	76848	chrome.exe	130
PID 76848 wrote to memory of 9420	76848	chrome.exe	131
PID 76848 wrote to memory of 9420	76848	chrome.exe	131
PID 76848 wrote to memory of 9500	76848	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\-WzUnlockTool.exe
"C:\Users\Admin\AppData\Local\Temp\-WzUnlockTool.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:185624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:76848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb5a97c728,0x7ffb5a97c734,0x7ffb5a97c740
  2⤵
  PID:77088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,10110495409598624741,11896351328417373635,262144 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:79416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,8261486776239963312,959481406754567270,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:79460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,2035777161365807608,1138731435443977002,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:79512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,18420186443450547110,6186662953592277916,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:79536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,16406887236556203584,17369895833665681375,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:79544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,14252021612996084143,9436581214588023941,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:80068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,2778843689012404238,17498780275978775676,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:80088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5016,i,14875202359732268186,7906078249608918938,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:80576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,2718281404464004722,15780915964468746378,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:81068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4408,i,10463581029714582121,3233763068422243809,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:185652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,17925777853453787318,1765167125514670932,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:186140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3908,i,12183966800285092148,16337415477140080318,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:186248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5036,i,3455975781867999996,13028555190531496924,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:186244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5844,i,7552183043399664252,15465640468506004636,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5996,i,14210576712409195449,16614851769601334309,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6008,i,1200759635687950316,2348409702319679270,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5092,i,4600106070720208503,3090326035806702907,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,12711255487645850034,6473364194465706239,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5972,i,11686422748784858082,16777068117932663092,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,10422951106727174798,7497801936727911909,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5228,i,12335733492769742283,15775326041875982181,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5052,i,8613373786941747498,3783825584857648315,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,13448617166552897334,6713805251306222505,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3388,i,7334105439901672142,9724647813295871483,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5920,i,1479436855652694732,3615164300067213922,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:9
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3668,i,4624864080660516328,5624878142696549746,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:1
  2⤵
  PID:6148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6620,i,16729977268017809522,10177568313656704450,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:7232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,2267830602586649221,6433228812456945860,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:7240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,2691193500617746665,13583878492458062478,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:7248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,17839045190065213644,15718359702443680640,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:7880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5268,i,4000056742423253283,17745566377381293850,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:9376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,16272048831248256578,2030261338195173783,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:9412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6176,i,1140455956093031515,14935146011048101671,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:9420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,16692628517217216177,13898691665251722253,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:9500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6996,i,5430629917612668507,204654419018034669,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:9620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5248,i,13453378437257755661,5664545510211208980,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:9904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7068,i,5807641995151149782,1070587654983868897,2097152 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:9988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3652,i,4375755659959404100,15550410146925735899,262144 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:10056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,13196001330823396180,7535602634815457071,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12
  2⤵
  PID:10668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,2109980322712543680,11072756224473025400,524288 --field-trial-handle=1836,i,4555834383446504377,6376835376301294430,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:14
  2⤵
  PID:11648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:79472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:12720

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:14528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 130KB
SHA256 c9fe30093b42b1aa643616090105eba3ebe107f31c538e1fb726c60ec1178005
MD5 f20fe8a53eb08b7eb8ae6bbd51e2cc8f
SHA1 4928fc31bc020fed06fda53003e0d9030cfd3f11
SHA512 9d350a3a421f363212b4399775c2615373bccf3219d11dd854d575c2ae22ef5d1f136fc58d097a7ed0e4c003a2aa08005d13329a53cf3ce89683e77ed13cc8fd
SSDEEP 3072:Lp56HXMQUOaAPrL1dVvZ302iahLa4aIU/c3FZczwaym:3Te5dVJ02JhiIUjzwK
TLSH
T1E1D31206DC0E4C726593F74A456DBE418EC4FDA830154FC56F91C3ECAE2DC852E2696A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 61KB
SHA256 29007ba4dea7e4afa68d851ddb35b00798509b66bccec6f6e96912a7d975de9e
MD5 0b206e47f013eabed123b23da2cdcbc7
SHA1 850373a5808dd494b282dd226cbbc8d5b7296c7b
SHA512 48f847953f8d0061c135ffd3a69fbecd98277294ed523c65b553b0d7988bedf47da80b1fd1c96262fca1f6226fbced94191984a384af3f9c106f6eb06e9c0579
SSDEEP 1536:QuyNeeMhRpQhrWuKMRRGw5Zzf57PLhL7u0hUZmhF8Od+NmU:QtcNQVzRRGwV7PLhL7ukUZ5O88U
TLSH
T1D05312095E4B3D303437B390869C159A2E60BB9CF0C83B5DBBB3C591505FD18D991D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 69KB
SHA256 58bcc81c12c9165a05538d8cbea86e834f76cc32fc2b511e21a5b49b6decc8a6
MD5 2ada6ee72ccfbde6a94d3b25ce552ee4
SHA1 841eda344251f9cd7aa473af427338e7ebe893e3
SHA512 393825555454d67c8ce186627dd7b9f467f0dd355dacc77d0391ad3b521327ad855638409dbb6b2a93465f453749bbf0249d6abe66563a4048cc4cb0b440af37
SSDEEP 1536:+WCk3mFZoyoA8wtQFo8pzh/WfC1GFGTPOseTrX:3vUePLXFoC/WWGFGTPOseTrX
TLSH
T1B8631238B53D6FA77E8C902CD9B3A91C2190A752453E05E635C80B03E97ACD275BAF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 7de0d6432b7c857d76a75bc68c36e3b30764a5f69d0386896cfb34df6c49c12e
MD5 f592590d19b96fe8d9da97f16257956a
SHA1 497aa70d8d2afdef56bfe3addfbeb7f75cfe95e3
SHA512 c59e176c67c92cfd2ee3cf80c6fbc65b3945c05c0ce9e1cc540f9d1f92c77a226e69c07af634fe2f4bb68ab29ac4864619016ac2b8384d110ed971d87dfcbff7
SSDEEP 48:gH3bGcsQm85DmLdylThPXzO2tAjhZLO/fmqQoXiat3cWC/5DNkRdSCXn:ebXsgmZylThP3tAjfqRiat3cVDNoSqn
TLSH
T151A13ED5138E87E1CF54583D90D27A25B6F66A4F601FEF3A11BA98BC920E3688CF1D01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0ff30756b40227fab9ef801da5517457d2b7bca788408f629cf0011f0bb695dd
MD5 0e819e9d7160750b1fcf502eff9e9319
SHA1 3e00b6906dd659a26472ef9c80e0dfa994e85869
SHA512 2f2bdadec60902dba47afa2932aaae1d46610a0cbd1c9a422a21cdb357e1268c5d99a1c36d3abbe4cd0e9277438f8a1a5a8856865d6d9bfdfa3bb552751f0d13
SSDEEP 96:GQXsNLZylTgPStDjeqRijA3crDDNohkqn:G3NMB3peXAMXxUkqn
TLSH
T1FFA15DC4135E97E1CF54593D90D27625B6F62A4F601FEF3A12BA98BC960E3688CF1C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 432b35d9592aac1d9b02a6402eedf36748199033b022673c972d97df2d74bd5c
MD5 35173d207598087e59bff131c2b47019
SHA1 ef3128b070bed63483577fdc76f1dff920849329
SHA512 f38cc5e11d16ab01d6e1d0cb954c869221f353a8c284f5d050f1555a98439b09818c2006bf93737b1e38b876a6db8734bb8168d271a856210494cd0909544797
TLSH
T10B7171C0435E97E1CF64593C60D27629B8F96A5F511FDF3A027198BC560E3648EF4D02
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 af4221fa3e9d3c40661b2541891ffedde2aab4619549a0f898d0fb0df63ed954
MD5 1a1f9808b30463628a8088adfb845924
SHA1 751c5e38f3660c63af743943c8e4fc801a912acb
SHA512 367ef36714d4038a316ff2a1d469abbfe5d1b63bd1a6268ba7ccf59f11acbe2599fe191d25e9a61a5d3eac905b547f5954110916fe4a7535a4c925e338c2a85e
SSDEEP 192:DmMwHKFUykJvJmgmt5pBmgAwyIAIoI6raPjv029R9IKfP0NPwNmJmTRmDmtmVfH/:DmMwHKFUykJvJmgmt5pBmgAwyIAIoI6B
TLSH
T15A129CF7C3E9C52C891156F4AB15AF1ECE1D0A28431D3C26C8E8BE5BD3E2871E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 9bed66fe43aff26b110079dad4aee9c4df1baf423fc9811445e203614b80e163
MD5 eed4e8bd3610c788bcb4a4d4762c3f7f
SHA1 5473092674815fabbc83568dc27bf524c6a8c8cd
SHA512 cb606742e30562d7c8985f146f0ed490abec4bc9b392b7e3b5673c5fb058714cfdc620d0fa2de8aa9f2e232d949c64c28570421222d1319cba32cfbe86196d22
SSDEEP 192:DTtrHIAJJyJmjmChusOKEyt5pMPIJI61HI0mrmmmDmtmemXjhnm7EdluZSqNP0aF:DTtrHIAJJyJmjmChusOKEyt5pMPIJI6M
TLSH
T139328CF783E5C62DCA0156F4AB15AF1ECE290A24431C3C7AC8D4AE1BD3E2572E15175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 502c1b114d590adf8186a029c63082b11cca5e202e48f5770b1c003628e91d50
MD5 9be8a82fc56f99748bc26e2324a4cabc
SHA1 41d23cd7389fc824ee1e64345fb7bf8cf2d84fbe
SHA512 73b8215487af965723c426906f166b84f7bfbc3809afac839f148a4efbf03d747f5a41c43101b31536d2bed6bd71eac8927de7506a75e84097b0f4f3d996190d
SSDEEP 384:DmMwHKFUykJvJmgmpeI6tx5pMPIAIoI61HI0mJmTRmDmtmemXAZHm7XdlG2gaNsz:mBYJADb1tYEi8PftzgKlufb
TLSH
T118429DF7C3E9C62DCA1156F4AB156F1ECE2D0A24431C3D3AC8D4AE5B93E2871E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 b1cdbc59efdc81e0ed435a722de0c4577f3c117e3cb2e6d6d94111f13326845d
MD5 2465b1b094b04cd3e39da9fae7ee7e52
SHA1 f959eda0f2d0fd98dd0fa11209fb4fa7ffca6019
SHA512 d307c3f2ac0ec7e7c8e5be01bcb25b91c68ddc3252a12524f69a96019a479fb5ee3ed2e77a4a4bd78e6ce1f9750dbb289dfd8f760ace39ee9f0ebdfbad26e204
SSDEEP 384:DmMwHKFUykJvJmgmpeI6tlnz5pMPIAIoI61HI0mJmTRmDmtmemX5m7XdlG2gaNsi:mBYJQDb1tYEi8P4tzgKlqfc
TLSH
T13652ADF7C3E9C62DC91156F4AB156F1ECE2D0A24432C3C3AC8D5AE5B93E2871E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 ada87b3133395342c9dc91b316270ba69a4e0fafd964ae86e5dba2d8056bb306
MD5 ef8625189021eb5334c6fbbc883cb90a
SHA1 700636f3616726ae96d2798074b48691c5111fd5
SHA512 6129a79baa3f1008ab34a9dc0f4cb98c74d9d625f219e23a317b4852ee0ee21aaf40c6404d7b31879a5c8bfa1f781340260d80aebc1e7679797f3826d57d28f1
SSDEEP 192:DTtrHImAJJyJmjmChusOKnz5pMPIJI61HI0mrmmmDmtmemXjhnm7EdluZSqNP0ao:DTtrHImAJJyJmjmChusOKnz5pMPIJI6d
TLSH
T1EB328CF783E9C62DCA0156F4AB15AF1ECE290A24431C3C7AC8D4AE1BD3E2571E15175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 afd196dd31927a49c693b499fbbdac45fcf5062b7f2a0445606385cca526205d
MD5 7327868e3f82a306ad410047a3171146
SHA1 e85f28ebdf24be705c4717aca565577d4421bcc4
SHA512 e377577bd8cac09781373d7ea7e33fa2cf46402f4e030696724b88ad5919dc449e504fe87018f76bc29310e72250760530a1047e1ed08045ff0c0ae6f20e0a1e
TLSH
T189519DA3C57FB45B502C5E7F1E15B8092DB9B8350391A8F5DE9AC36EF0815FB2B1201A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 a988eac80ce1102957a4a6540d808075d1c601217bcc4e334ff167cf0646e025
MD5 0b5b25d5d3d92f96525101c903f954ad
SHA1 d2804e81090e58cb4aa455153b1ab370205a615a
SHA512 ac9f31099ea16c21578da7d533d5a36362bc5152245f9c1f3819129e6b7ca7614c32bb9ca3b3a27d613642e3cd1d25b75b133a1d13f5128c9420a1d519be269c
SSDEEP 192:FRQcBz7Iwbv7DDAPRp2L5/99Hsb+WNnNKbCh2WAFVyIsnAUgR:FRQmz7FjmXI/wY02NR
TLSH
T15D22762BAD54653B5CCBD22AFD617753D7F1102166D42E44E6FC8E2C11EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ab6f8c9dfd9dd7ce6a43d77953906a949875ca2f53b0260745a34980a82e3ef6
MD5 83cdddde6d1168507611daa05657ff03
SHA1 586efb643de44fb9712be468c0670d1a9bfc3d78
SHA512 a6bf808d19c6e6467fa628592be1bf5a2f0bac863f69cc873d102aeb3e00d9480e7ff560cede958fc19d36a274f21c4c0b1ddee70ac150961d0d08107bec8632
SSDEEP 192:RRBcBzhGjpEpgv7DDOPRp4xSe5NN99Hsb+WNutqPASzdax+doWCIFVyIsnAUgE:RRBmzhGtE6kXK/wb16tWfE
TLSH
T10A42A62BAD20A53B4CCBD229FD657756E7F1102166D42E84EAFC8F1C12EB6CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 42a17d24d19ab01516c2332fce7e875fe41b4c8972e5650638646e760789b1cc
MD5 977f97d15a1e73f3cfdfbecc2163234e
SHA1 7f42908f56129745532050122cd43307e5cfccb7
SHA512 2b052c6e5cfcecd53ad8ae4d85fc8586035ba4d79a8c59948c8e6b337544eee8f0a47a4b708c7d95d3867233ffc29b19e9a8b56f4e54ae03672a414643d3070d
SSDEEP 192:FRQcBhTIwbv7DDAPRp2xStN899Hsb+WNBtNKoax+Ch2L6FVyIsnAUgE:FRQmhTFjmXO/w4LF2SE
TLSH
T11442962BAD50653B4CCBD229FD657757E7F1102166D42E84EAFC8E1C12EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 989ca9f47c09820f4734ef153b4616ab67e64fe4d512bbf8370049b66928e53b
MD5 4d9d4d7195c752bc799336cf227db9bf
SHA1 857bec2f7f3264b1c4d5a810b121babfb3e080d5
SHA512 7277937b6b767f0667f70caa940ac0e7d2b9c0c093515987f45a9fb6f6a7e8f50ace98043ba034dc2bc59e1a4151d50fb9765ec3e9ac3d7ce53e22199002828e
SSDEEP 192:RRQcBzTGjpEpgv7DDOPRp4xSe5NN99Hsb+WNutqPFax+doWbIFVyIsnAUgE:RRQmzTGtE6kXK/wbCtWkE
TLSH
T1DC42A52BAD50A53B4CCBD229F9657757E7F0102266D42E84EAFC8F1C12EB6CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4542b106ddb2eb63f348d851f3c186deec01506bd8c36456bfeb58f7754e2604
MD5 17c9921d6e1a22753119fb3b08b60d77
SHA1 8567fd3b433a650dfb1e80648f58fb1dc57c8e5b
SHA512 a83ef3d25f1cc845b339c51a6dae7348673d22a15ee9a928851898cb11d0dd6c7ad392ea8bb818ac5045ec40245085f72075573164d10ea83c36eab591bdec63
SSDEEP 192:RRQcBziGjpEpgv7DDOPRp4xSe5NN99Hsb+WNutqPFax+doWbIFVyIsnAUgE:RRQmziGtE6kXK/wbCtWkE
TLSH
T16442A52BAD50A53B4CCBD229F9657757E7F0102166D42E84EAFC8F1C12EB6CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 94249893ea5d56392908c5e875bb4d0978bae968602e1a8c59d9003cf91eff60
MD5 3a220274b1cf296d1832efaa79f3ecec
SHA1 2af9e61e8bb84fce26ddbdb231179f3a542259f5
SHA512 c15607ec82e6e80c7df0bf233b75cf71098054a73dbab0b7a8cba33a1e728d8a6879c6d8ce686f0738f2b534fdd6c45d628f66b2217fc0cc261f63a716d3aa45
SSDEEP 192:FRQcBh7Iwbv7DDAPRp2LV899Hsb+WNnNKbCh2YAFVyIsnAUge:FRQmh7FjmXf/wY02/e
TLSH
T18032842FAD54A53B5CCBD22AFD617753D6F1102166942E84E6FC8E2C11EBACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 32552d4aabe074b7b3ee1e1b84997e48775023c7a1feb92e90c2bfd97fa294f5
MD5 4b6215fee8d77b5b6d154dc924f80019
SHA1 b621bb67ce46f09d1ec4ab47715f096872c9fad8
SHA512 bd278833f4a50e047f184d5b466333b38ece41c8618e050891540292f187262c1920fdf4bf27f1c67fdf86fe5d5c3cd87ab59209a0459254cbaface4f32cf514
SSDEEP 192:RRQcBzhGjpEpgv7DDOPRp4xSe5NN99Hsb+WNutqPASzdax+doWCIFVyIsnAUgE:RRQmzhGtE6kXK/wb16tWfE
TLSH
T12A42A62BAD20A53B4CCBD229FD657756E7F1102266D42E84EAFC8F1C12EB6CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 428c89309d80f331b6e14222a2309d98a7bd6922fa6b4be9c4cc531684dea43b
MD5 dd4e3fac7a82a8d21d4b2d7c026824bc
SHA1 8ec4e861b682afcaef4408a2910a7328ac6b3c54
SHA512 0bf5a89aa72b0a7accf452b6827911de93eba0eee727f6bd435204b97054010c88dfdb15c3572504956c292250d19caada1289830f19e4b09366948ea9b02342
SSDEEP 192:FRBcBhTGjwbv7DDOPRp4xStN899Hsb+WNBtNKoax+Ch2aIFVyIsnAUgE:FRBmhTGcjkXg/w4LF2XE
TLSH
T13442952BAD50A53B4CCBD229FD657757E7F1102166D42E84EAFC8E1C12EBACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef65ac6f1099b3b27e456d66657d1a64d9d2966d920a01af3a0d8befac79a162
MD5 29fd7d4a6ad3f66ad36a827affddc3cf
SHA1 5746e3dc8db0c4d798c602a9ed196d130f363edd
SHA512 7e1431a7003f8b9e02b2f86a9bc9ea7d991d5c1f158213ca7a8474b5723d4997b6eb834ee53499034e9e341f73627cc728a89daa07340b529c7333479078163e
SSDEEP 192:RRQcBzhGjpEYv7DDOPRp4xSe5NN99Hsb+WNutqPASzdax+doWCIFVyIsnAUg1:RRQmzhGtEEkXK/wb16tWf1
TLSH
T16D52A56BAD50653B4CCBD229FD657757E7F01021A6D42E84EAFC8E1C12EB6CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8e5e27559424eec09758f42371ee426e1ac696a47a1ab1570f2799bdae90cd77
MD5 3fc123b1cdf5082e06515a76aa2a7725
SHA1 3d0caf4274e268aeb434a6f00e60b8baaeb60376
SHA512 510bec8b074b79164c7495de949da0e5bd9f7b7c81242eff32287b0416a3e13c0834f045b2b51eb10864276e9a20dd59ce2c9ead67a6b73ec7c0969a73a84a4b
SSDEEP 192:FRQcBhTGjwbv7DDOPRp4xStN899Hsb+WNBtNKoax+Ch2aIFVyIsnAUgE:FRQmhTGcjkXg/w4LF2XE
TLSH
T11C42952BAD50A53B4CCBD229FD657757E7F1102166D42E84EAFC8E1C12EBACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 19ba691b6733f9dc951a7b88e53f3514ca6fc7421528358ebb8445fe2dcb613d
MD5 b5bea7ef0e9a963c0c3293832f0b4441
SHA1 7ec2039240a838a10d6a2543e381417ade250590
SHA512 b5ff846bc60c334791a86af1420a52294c269fb6b42c5fe623336a41aa076594ee9a5d70a933a9bd9ec29ff60fd44b2a5008cd6aa414f8ac79e2967426e6a660
SSDEEP 192:FRQcBhTIwbv7DDOPRp4xStN899Hsb+WNBtNKoax+Ch2aIFVyIsnAUgE:FRQmhTFjkXg/w4LF2XE
TLSH
T1F542952BAD60653B4CCBD229FD657757E7F1102166D42E84EAFC8E1C12EBACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 5d419091364e950e1f726ac0282fe90b1b2082f733ecaff3bf597aee94b21a8c
MD5 60a211c98142e082adc1fc2c563f0a47
SHA1 6f1aa8ca27b53c06e4238affd4065a144ca3ea43
SHA512 10f288e985977ef88e15d052616dc6930d2fafe655877984b28a25624ca82e8d44f60f87d044d6ff0a461474f140dd2be52c074dd05a7b23146af870a08a114c
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEFPdXzKD/K1+ErUkKN9NlwLBHxCo:3ZjyV7KxkXqKf/pUZNCgVLH2Hfgslwd3
TLSH
T1FD32EA27998DAA7F4FD8D51CCC566F4B6DB5029633280C2452FFAD0803A97CE114E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 43c36cb7386f992367580f4afa45e35ef14987ed8cfdb3dde2072306f1d8d12b
MD5 a5a5617b3942b4e49d19db8f681c802d
SHA1 23c4d5062297915a866d8f5fea3825e03c7d1750
SHA512 e798e3a9a94cea2040ee5b116c0fa400bbec472cee26d042af04c8bbc093c229feaf1672fa0cf85745ff25024d7bd0cfd7a6c266251c6cbfc2e0b553f11d6f7c
TLSH
T112B022E003E00803C83C03B332F2A8BA33AA2C3003028003B0EF0800C8333800A0BAB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ca621115c5736cfbe1d416c23b9231bdee7c1b97ce974f6f4d7e6816c5d370a4
MD5 746f1296dfe85af37080ab7efce91fc3
SHA1 7d41f0c69238aea5278c388f1fa4df80d7912621
SHA512 cfa25a06c3999dba0f2db6aed1dde654a362b0de304999da8918b10f9b5ff01bf0f6d734007d57735f60764a4c78e8abbca5f45db356c881b9b4b96344d9030a
TLSH
T1BEA0025891C81551ED10437164B6654536E5495C9A59430365F104CCC8AF1C051F6594
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59de41.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59de41.TMP
Size 48B
SHA256 0d81f7ccd173daed9c78c1a001b7552dc03950453286e85bb021446b4d78b367
MD5 fb93b3cdf9acdb7be4f1d039e5c1a14a
SHA1 b0b923f01b9f81c1d171c339637c4f38ed29d1f5
SHA512 238b5bffa5e880bf9a0656c6d7de6796dca6b6ee22cb6c4af87e1fec9b19705ccbee46eb95b04f1512680acaa2ad131df6122ad1d20536b09a8bb745825fb75b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8bbbb2e996000d34e858d837c7db08612aefc3031be4b6c643d0e3d0beadc198
MD5 7e71693caa4707eb358e794899a08511
SHA1 bf9adeeee70dfb918ab474df148f94f586314c88
SHA512 dd4bbfe0684a590c901429b95b5dd2c292d2680f3cace3a0ac9cf99a909cf948e25af1cd1a09b134b9e93975029c78de472cc4ef4baa7647c76d34e5493e43c9
SSDEEP 96:FMC6dZd+T5Kj8OfQo1LrvGSl8h4otop5iQCD5B64Gyvba7FxwzzlYK6rIeqc40jw:OCoTjVSiU22fg/7FxhKUIeqc4U2
TLSH
T14CC10C71A86DBC7766B7D445B1123A43CEF860ABAA509F88EAE90F0D01E70FD1306522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 129e6aa22136556e62b27dd46e31141447af83b21358505569c20a8b8232c9bb
MD5 4f376a6421e4bb7ee0ee91d5123e3a11
SHA1 2fcdb435b4c0a21b0ed943a59d4e6cb43dc09018
SHA512 f8a437708766dbce7f35c7e2e34c3d0be5ebc25df48bed6a16b029253be377c2de34545de985c2124a1100cda621130a2df357f8cb02e6ec9e7dc37c4c657ffd
SSDEEP 3072:incuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMd5:kcBaj2tiHpCbVDpaJ/v8w2
TLSH
T139C302B3BC19B869583D8082B04646CF1F906FD395757DFEAEEF6F89020A0DA5315938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 962a4769ddf423c37abec1e8003760fcf7e7d02efa833776fcda8849aaba899a
MD5 9479d10f2da96784dd98d0e82d331867
SHA1 157ed9c9609a08f46eeca0478c8d6161b2793a57
SHA512 4a5efa7e43ae04d370c1abe270a5dd3d9b17b8f504b9900f4ba418bac8a50b0b4264aebec3592cd654eceb0d2c1deb859e53b49072d5c68edb0805896766a8a1
SSDEEP 3072:6ncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMd5:scBaj2tiHpCbVDpaJ/v8w2
TLSH
T193C302B3BC19B869683D8082B04646CF1F906FD395757DFEAEEF6B8902060DA5315938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 c0d8f0b683540f2fd614d86974246cda64e36ae5e904d25938f9cd8ef4623f32
MD5 56e2a71cb3badeef9cae4ce52158ed64
SHA1 cb54cfc231764a1406ac420616526bbfa00e0ab3
SHA512 65e32bda28a3a1fd7c80dab5098cfa0b7a58d7cee367623e72ab621b77459cbcc2321b1f2b95844b2bbefa337fd108694bcbd4765c7a91250d7dfa78f522f185
SSDEEP 3072:Xfncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMd5:XvcBaj2tiHpCbVDpaJ/v8w2
TLSH
T1A0C302B3BC19BC29943D8182F04606CF67906FD291B57DFFAEEF6B8902460DA5314838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 5de6327cacaa21a1361d5fdebf483ec41b405d0da1fb1b11dd4016a63ccf6156
MD5 eecc0eb97a9b0123fbfb46a1c624c905
SHA1 2a05ce7c7bdcc8a585f950a40c3d613bd5840a1d
SHA512 20643eab7ff3f754e39a4d29b8c0283b3ef655be311b4a4e8aaafe3792d79d90d6887cd79f65d0281e21fff42bce23ce5050ebe9ce4ecb1d3eeac2f75bffef21
SSDEEP 3072:Dncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMd5:DcBaj2tiHpCbVDpaJ/v8w2
TLSH
T1EDC302B3BC19B869583D8082B04646CF1F906FD395757DFEAEEF6B89020A0DA5315938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1425e8aff0069f04b7e8e5506ab0b5f5f32523906e3420572bfc0f18d98e971a
MD5 28bc5dc9ee137b60ca39a0e0ff0f7b32
SHA1 a809aa970ed890f03e71cf2ab7681abaeaed05df
SHA512 401d860a107c511c9a067b120c9e9bdfdf48697b0176e48bb3ca495d024bd1e1b4cafa50bd7afea2913d0c139cf26dec0b0e98dca61d360946638ea61d62ba4e
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok5iQsD5B64GyvbNsbcYbcLDqv4a:8ClTjVWDUDAfgosbcYbcLo
TLSH
T14CA1FA71A5799C776476C488B5423B03CFBC70ABA5919FC8A9EC1F0C01F74A91306A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir76848_1699841764\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1448-27-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/1448-21-0x00000000004B7000-0x00000000004B8000-memory.dmp

Download

memory/1448-15-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/185624-76-0x0000000005650000-0x000000000568C000-memory.dmp

Download

memory/185624-73-0x0000000005BA0000-0x00000000061B8000-memory.dmp

Download

memory/185624-74-0x00000000055F0000-0x0000000005602000-memory.dmp

Download

memory/185624-30-0x0000000074942000-0x0000000074943000-memory.dmp

Download

memory/185624-75-0x0000000005720000-0x000000000582A000-memory.dmp

Download

memory/185624-77-0x0000000005690000-0x00000000056DC000-memory.dmp

Download

memory/185624-22-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/185624-78-0x0000000074930000-0x00000000750EC000-memory.dmp

Download

memory/185624-558-0x0000000074942000-0x0000000074943000-memory.dmp

Download

memory/185624-567-0x0000000074930000-0x00000000750EC000-memory.dmp

Download