hxxp://ski-manager[.]net

Analysis

user interaction
yes
max time kernel
105s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ski-manager.net
Sample260706-ejadvshv6x

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1828	chrome.exe
900	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277839189126327"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{DDD38FAD-5F38-46E1-84ED-45DDA7386079}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{2E7B656F-C094-4403-BC21-95A41AD7048B}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
632	explorer.exe
632	explorer.exe
1204	chrome.exe
1204	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
632	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
3252	sihost.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe
632	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
832	SystemSettingsAdminFlows.exe
4528	StartMenuExperienceHost.exe
632	explorer.exe
5116	SearchHost.exe
5044	OpenWith.exe
1668	ShellHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5724	5036	chrome.exe	88
PID 5036 wrote to memory of 1060	5036	chrome.exe	89
PID 5036 wrote to memory of 1060	5036	chrome.exe	89
PID 5036 wrote to memory of 1828	5036	chrome.exe	90
PID 5036 wrote to memory of 1896	5036	chrome.exe	92
PID 5036 wrote to memory of 1896	5036	chrome.exe	92
PID 5036 wrote to memory of 2840	5036	chrome.exe	93
PID 5036 wrote to memory of 2840	5036	chrome.exe	93
PID 5036 wrote to memory of 1872	5036	chrome.exe	94
PID 5036 wrote to memory of 1872	5036	chrome.exe	94
PID 5036 wrote to memory of 1112	5036	chrome.exe	95
PID 5036 wrote to memory of 1112	5036	chrome.exe	95
PID 5036 wrote to memory of 108	5036	chrome.exe	105
PID 5036 wrote to memory of 1252	5036	chrome.exe	108
PID 5036 wrote to memory of 1316	5036	chrome.exe	107
PID 5036 wrote to memory of 1252	5036	chrome.exe	108
PID 5036 wrote to memory of 1316	5036	chrome.exe	107
PID 5036 wrote to memory of 5004	5036	chrome.exe	111
PID 5036 wrote to memory of 5004	5036	chrome.exe	111
PID 5036 wrote to memory of 5796	5036	chrome.exe	112
PID 5036 wrote to memory of 5796	5036	chrome.exe	112
PID 5036 wrote to memory of 3004	5036	chrome.exe	113
PID 5036 wrote to memory of 3004	5036	chrome.exe	113
PID 5036 wrote to memory of 2600	5036	chrome.exe	114
PID 5036 wrote to memory of 2600	5036	chrome.exe	114
PID 5036 wrote to memory of 3932	5036	chrome.exe	115
PID 5036 wrote to memory of 3932	5036	chrome.exe	115
PID 5036 wrote to memory of 2160	5036	chrome.exe	116
PID 5036 wrote to memory of 2160	5036	chrome.exe	116
PID 5036 wrote to memory of 2640	5036	chrome.exe	119
PID 5036 wrote to memory of 3104	5036	chrome.exe	120
PID 5036 wrote to memory of 1248	5036	chrome.exe	121
PID 5036 wrote to memory of 5872	5036	chrome.exe	122
PID 5036 wrote to memory of 5872	5036	chrome.exe	122
PID 3252 wrote to memory of 632	3252	sihost.exe	127
PID 5036 wrote to memory of 5904	5036	chrome.exe	131
PID 5036 wrote to memory of 5904	5036	chrome.exe	131
PID 3252 wrote to memory of 1668	3252	sihost.exe	145
PID 632 wrote to memory of 1204	632	explorer.exe	146
PID 1204 wrote to memory of 4960	1204	chrome.exe	147
PID 1204 wrote to memory of 4796	1204	chrome.exe	148
PID 1204 wrote to memory of 900	1204	chrome.exe	149
PID 1204 wrote to memory of 4796	1204	chrome.exe	148
PID 1204 wrote to memory of 2884	1204	chrome.exe	151
PID 1204 wrote to memory of 2884	1204	chrome.exe	151
PID 1204 wrote to memory of 5132	1204	chrome.exe	152
PID 1204 wrote to memory of 5132	1204	chrome.exe	152
PID 1204 wrote to memory of 4676	1204	chrome.exe	153
PID 1204 wrote to memory of 4676	1204	chrome.exe	153
PID 1204 wrote to memory of 1360	1204	chrome.exe	154
PID 1204 wrote to memory of 1360	1204	chrome.exe	154
PID 1204 wrote to memory of 2216	1204	chrome.exe	155
PID 1204 wrote to memory of 2216	1204	chrome.exe	155
PID 1204 wrote to memory of 4412	1204	chrome.exe	156
PID 1204 wrote to memory of 4412	1204	chrome.exe	156
PID 1204 wrote to memory of 3936	1204	chrome.exe	157
PID 1204 wrote to memory of 3936	1204	chrome.exe	157
PID 1204 wrote to memory of 2920	1204	chrome.exe	158
PID 1204 wrote to memory of 4300	1204	chrome.exe	169
PID 1204 wrote to memory of 4300	1204	chrome.exe	169
PID 1204 wrote to memory of 3508	1204	chrome.exe	160
PID 1204 wrote to memory of 3508	1204	chrome.exe	160
PID 1204 wrote to memory of 2960	1204	chrome.exe	161
PID 1204 wrote to memory of 2960	1204	chrome.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ski-manager.net
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6635c728,0x7fff6635c734,0x7fff6635c740
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,3064560057709695420,8864754198681012094,262144 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,16744747045031034631,1089252091292383700,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,13007722657270020272,6394357069505665077,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,14614953675613333107,16963999952448316503,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2972,i,6409252767512012501,14614304795141578784,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,513010887248448335,17020917032214671983,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,16814454260316653392,4012611236385389614,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5564,i,2735718490017700475,570468473406964792,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5584,i,3861564163168462926,9007068786130628883,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,7264044043440210324,9673846301906192927,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5764,i,5266612042199895957,15082378829152215868,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5568,i,669551737350129755,12809359435019727607,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5916,i,15130914452469313252,4888690869689065037,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5784,i,601762229103819556,10927140396740683917,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5604,i,9694737554581104252,13102398192194437004,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,15477217700919475029,18369747547360697092,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,11916503683026650889,4740452213150651053,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,8998732212922786531,12120743609861084554,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4884,i,4875270995693480274,3395249495745873655,2097152 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,1032940304384016756,15763454404790862592,524288 --field-trial-handle=1912,i,7024914438229541540,13703760087353721606,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2992

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EnterProductKey
1⤵
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6635c728,0x7fff6635c734,0x7fff6635c740
      4⤵
      PID:4960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,18313962987832835783,4667698124200989207,262144 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      PID:4796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1980,i,12529786159684586851,15573859711576975773,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
      4⤵
      System Time Discovery
      PID:900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,4780003128369627573,5142228443084736995,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
      4⤵
      PID:2884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,11700749457518445377,507794550247084272,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:5132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,12160250180533783632,7416270978195492484,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:4676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,8378959318173233845,17383190423076670431,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:1360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,667412168690674955,11826170705634015061,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,3565494163423428880,12228408948444861228,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,5030789506146162471,1241073229763951528,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:3936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,14676467502959703522,12543986484678865293,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:2920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,13202483244234483220,8114339266624856785,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,10559047949098481056,17879368658123748572,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,10769823780193237088,15510988285479489344,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5856,i,13392694599680687754,9296366650308654161,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:9
      4⤵
      PID:3384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5948,i,4014033395727948409,3152336622282677063,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5536,i,7727112861900915455,5031070871808418072,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,10658294480247802363,6689089990716381919,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,3696737094709318473,8957835694637747502,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5580,i,110601955487058380,16600363446268297375,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,7004785385109158146,6118206633732063225,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,3941611242892312865,17723804162788834791,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3680,i,16518356254735794836,4280596217355213504,524288 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3508,i,10997608888518991926,680441181073408169,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3444,i,6407518430564196212,9213773351196050510,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4440,i,16436072745745581887,9980836781706787048,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5600,i,18336637585725752850,7928329745559973941,2097152 --field-trial-handle=1756,i,17258170927550056781,10536086623592963649,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:2928
- C:\Windows\System32\ShellHost.exe
  "C:\Windows\System32\ShellHost.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1668

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x000000000000050C
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 3019a1f81222bf7edef1ef8e46debc8426ad2fb79176c46b7e07f4c03ea7b8d9
MD5 d6ea4157e52d102fcf7ec3c7f6f1b9ee
SHA1 ac189861cde2620c83b8f3e804123040ec360903
SHA512 3180f59a7902a0cb54266bfd8e48542e1fa7f6552bb0e4212065f92aba9505b412a8a0e21be25baffc87c64cb3827ebb54a3ae73a563299da368a827fa988d95
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9a1dec19aca4b3c2d14381da6e79a10658cbcdb8e2168a7074ebcb53cb7603f6
MD5 8bb673c8543f66ba06f338000f6a2781
SHA1 682111020eb26cd9a63706404c31d8df17e0b3e2
SHA512 9cca1935290702e321bb7c273696a54ee145450f2ff5838019dd1155098bdf2fa108ed7a922e11290f55bbcd0b17b6178603dc17be4904b987995c3f376b8268
TLSH
T11C410F23E3C3558EEFA51B7810D03C22E5BE2939C3427FA74EAC652D4D971E819DA874
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 754dc27b40358d82feea6561863bf96e8ddf0c0fbd520bb62df0357789f37704
MD5 26987f46315255bd2159ac1ebe223392
SHA1 e9bd1a24faed56a9cc8680b4f38635979cd01ab0
SHA512 2e2541f121a09188740a19fc1ae3618996c85a4963eacddc958f45fe8c2f0b0107d3ae18ee9e984554029fea2802485b24fb2fb0a1db55e1fbccc7f39488e274
TLSH
T1A8E0A7091391424DC32BD7F055963C52757C5E14C0527E724FF4746741672AD91EE899
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cea328980b8bec6b51ee2279e41f104af6d95c8e9cba9285acbe5df629011cba
MD5 dfa8a000c32520c77f59dc2522d7534e
SHA1 f7cdfa9a1662981e58b468c9c51f77b4c16324ad
SHA512 11c087bea053afa60d65ec6d8ebd97ac3f3ac1bb569a6178fd41d7a9c983ed490b6125c1357398070730fb143c6d028d1d13753985bdfaca4a5b04537a1ca48f
SSDEEP 3:MsEllllkEthXllkl2zEkl0j:/M/xT02zn0j
TLSH
T1BE4404047FC10C45C54410314051D3501370DC10051157CF3C710C53DCC57400C41100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 18abbbbd0694932e5467acbbc2c366d1b98a1e358be6bc35094c7c7f829c04a1
MD5 9276afa4f442663641486bebd64dba97
SHA1 1862ce82a9ea230f672b19d9046cec78cd72d1e3
SHA512 860d279a848549afe445eddcb8cab0f2d1c067b3d41b9511d1d4d1241876b97c29fb4b154909442980f63214bdcfec5c836d9ed7182adf78186160d2a44995c9
TLSH
T1C5E026872688E2ADA054D427C2AC530D8FD1B410A2D838060705E84821806046B822A4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 9d5313f5681b80f969275cf3dbb6d11631dd59c11004966d394a53aed247b5f0
MD5 0da0630e62ebc840f48e7cdf7e279aac
SHA1 ef7268d942f81efa08b23c5edfc89ffc8bf1a57a
SHA512 21c0ba821f0f84c2ff17e8483148593a9e1156c11fa9e2199f48ce295fb91a05fc49200fa47279289911d865bb150de50087aad5b031615e549b3812cc1b0d87
SSDEEP 96:neBCP7GC9qT5UFmA5uJ8U/XzumPGneUoNHuhARU:ncJC9cEWTXMv4OhARU
TLSH
T19DB2D8970F3B3017DE854EBB162B1032CD3FE18DAFD6DC54747998205DB8645A2285EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 9472f8bbf6c6054a344006839ec15d70d648a4a467fd91f2fe317ebf611c4502
MD5 b06db672286f0d22c41abfded72f2ae0
SHA1 92974c2061145374e08e6f6a15fe4fe945ca447a
SHA512 9cc6d2dd09bfb2e9e0967e2501fa08c94a70cbed6a37e6803a6010c000c33ea8fc3b91e8ae7827034028ddfb84d45f6ca64b0bdb41852f1e6a92f98e1b601c72
SSDEEP 96:delL/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E00N:slL/tH+bF+UI3iWGVYWNkqp3r
TLSH
T1CBF3091E6F243202CDBD927768E744B3586DF03F876366856C6608B5CEE2652B06C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

643d578d-3afb-4291-bb77-b6ee54767c7c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\643d578d-3afb-4291-bb77-b6ee54767c7c.tmp
Size 12KB
SHA256 c8e0c4da01ebb2490c81163e282402596d8dd59e62d8caa2e7f3809325333665
MD5 67026e07ba9cb6e18a72657f4c1d1b63
SHA1 68c75e4bf40028ef15bff96354a2c90ea59efbcf
SHA512 437099c7c8722a6bb6eaf7bea392cf65edf2924de9ef87790dd7b546d28a3edec4872d438a37365411eddbe4dc487b4f5d6a1cd37dee30dee2dfc733041a9d74
SSDEEP 384:DGjUGzmGRaGzwMYi09deGebiP+7MGl7JiXJ5u5VOaGkGzG6GQGgGHTYzGmxGPGA6:yj5zrRvzbNw4ZG2wa74XLckpCPlVjuzZ
TLSH
T14442B1F7C3E8C62EC91556F49B156E1FCD2E1928431C3C76C9D5AE1B93E2871E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d10959e985e91b3f521168388e73e0b2b63abfa19f89b50952882e3d01985c15
MD5 2eef2a62fce3a006b6fabe009807835d
SHA1 862396ffb072c75f8cc3ce3e60768cc253aa2b2b
SHA512 61b566363d199dc78e24d8b77949ea51f01dc2dde70f56ac6baf6dbee372bcadcdf1cfc47d174f56820acc992631a7911a0de4c6dd40aea0acfe72ce53abd492
SSDEEP 96:DGC2UGz+JGRaGz1+MYi4yOrnD7GkGzGBb0GFKGgGxXNTYzGtAxGLIwGu:DGjUGz+JGRaGz1+MYi4yOrnD7GkGzGFN
TLSH
T14AC190F7C2E8CA6E891556F5AB152E1BCE2D0918432C3C66C8D5EF5B63D2871E20064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 663f38e6443058a13f00fa9323f52458cc8d7cdf368f778801c0cc41a539c736
MD5 197fc6c85b4c09d6ca45378c945c9728
SHA1 429b9f35a2d1f53badc435afa3a1b195ce3598bb
SHA512 53192b8968be76730796a0e8b6e317998a0427e8f627d77c6a0c41acbfbb0820e454ba4527f087d5bebf4ff6d52878734c1e70c71feba85dec0d468c7551e8bb
TLSH
T12E31AF67D57FB49B502C4ABF1D04F806587BB8360692E4F4DB9AC26DA0431F70F1A417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6bc7424fb437c269908c15bd429ccb63aca2c520a7e6d946f3f4f512981315fa
MD5 c3362b5ca76ef1e3f52d15f5f5961e02
SHA1 21e3fb350b77c0a76681e9bc04179dedf62c33af
SHA512 6b1d5a8e7cbe7c78f5c9ecff394b277078120755232f3a85c7c92083c2cbdd18c8c12ca7d0a65078bc2ba833e729ecf4e2fa2c3e007991786fb1daaa148cc420
SSDEEP 192:tRGK53mGv7xAvAPRp2+g9lHsb+WNnsHkJTdb2apIeUVyIsnAUgR:tRGK52yVA6XMfw2G2nR
TLSH
T12332B62BAA14653F5DDBD229FE217757E3F6102221D02E44EBFC8A2C21E79DD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 413b2df9ef0aed29bcacc7a42c5b07e756234152a8b1048e7a591675d145a183
MD5 60907ce31cfd93f498fc9b7493c3c3be
SHA1 9534d4ae5a8efaba38d836cb3299e34bd3cfd086
SHA512 ec97c2cd6e4984d06b8f891d457e60228d82a734e8c57566f75e6f5ecae034e2cbc10ff410c653f6bd1044d56757a736388969fb429fb03fbd35653dd3cce019
SSDEEP 192:aRGKcBz53Rdv7xZAPRp2T5fkcg9lHsb+WN+7hUFh2GopjvWiKWv0HIea8yIsnAU3:aRGKmz5BdVkXtfwC605CWv0bE
TLSH
T19C52C81BA914597F5DDBC229F92177ABD3F6102665C02E84EBFC8E2C22D79CE2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 278e4c90ca75d216af51650c615f39819f5293d256e61710e5dadc9882cc5640
MD5 b51c40564585d10baa10ae9f356f519f
SHA1 bafc720e90e5381e0b1748fde2219ce3789d7837
SHA512 4d39c9c708a3bddda9b3fe0436b80cc372b56dca9958571c39295a9a95d4eb7b3e046526443913c9ac0b37399624e161a4cdf317cf1a3064d80df30cf9411533
SSDEEP 192:aRGKcBz53Rdv7xZGPRpkT5w6bCg9lHsb+WN+7aoRl/U7Fh2GopjvVtx+iKWhs08y:aRGKmz5BdVaXEfwCaw9u05FqWhs0uE
TLSH
T17162C95BA914197F5DDBC229F921B76BD3F6142665C01E84EBFC8E2C12D79CE2203417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 720a466e544eb2d35f10abbd32c4bebaad37300bc43acd9ef786f91e7bef877e
MD5 7ac2b9d1246222ac56871684efd54793
SHA1 652452c727c7befb8dd11a9811af89403ab1fb4b
SHA512 1cbaeb05add5a3b2d6172abff62acd69d0070046692ddf81f56d8857ef18b5fd669b54c4446ca79a815387798f010c75d3ce8f666f42c273dca495fa13362db2
SSDEEP 192:tRGK53mGv7xAvAPRp2Tug9lHsb+WN+7LsH+GopjveA0HIerSyIsnAUgE:tRGK52yVA6XafwCqM5eA0oE
TLSH
T11442C81BA914553F5DDBC229FA2577A7D3F6102661C02E84EAFC8E2C22E79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 59fd18d0870660e977661a91c7d4623fa94a986ab698ecb1cadae131797b605e
MD5 9f47efda16d190b4ad76f7152b11ced7
SHA1 ddc96e6cafad7768038c841020b0e16b3a9f0fd1
SHA512 0381fd3b000551fd9071dd7f810ba0dddbd4003bba293c9d25ef75cc57975c84481b6df09589c59e55daad2f92d446151e544fa691e10ddf6074c17fe3c3bfe8
SSDEEP 192:PRGK53Rdv7xZAPRp2Tug9lHsb+WN+7L5N3GopjveG0HIea8yIsnAUgE:PRGK5BdVkXafwCbz5eG0bE
TLSH
T19452C72BA914553F5DDBC22DFA2177A7D3F6102665C02E84EAFC8A2C22E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 31bbb0a62b9dd1893e5d2b5d1895d7c9a2c74dd087acb86bc83e589810dfc1ca
MD5 b4d60461b79774470fab1962e66d7fda
SHA1 b5cacd5acdb8c7c5fc08897d8d035a4820d0766e
SHA512 2f36a56d6ab3da6a942070d305b1780334770491af09f514b61be026a4ec122ff82e78fa8eca591e906cd7e04dad5e4f6a8ca47eb4702d538fbd45f1eeb3e6e7
SSDEEP 192:ecv4K6eE7KxkXqK4I40pUZNCgVLHrKHfFKslETUWXzKD/ls+ErUkKN9ufOvWyN3g:JvjtE7KxkXqKf/pUZNCgVLH2Hfgsl9WJ
TLSH
T1BF32D927A58D9A3F4FD8D51CCD126F4B6DB4029773680924A7FB5C0803E678A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8d8ec0ed3eed6388240ceaffebfb14b6b854f7c5\dcecc5b5-cf15-4386-94f2-832562a4b7f8\index-dir\the-real-index
Size 192B
SHA256 661b189cd6b2320336400ce8d7cfc6b3a5a4e009fbc0591e39c43fbdd947f7ca
MD5 926d6d6c3c313e0e06a8937e7d8aeadc
SHA1 259fe1bb63ae966223689cf356e301ec042b66b0
SHA512 930f26fa7a051bb7d9f53e08726f317ddee99d38947927352337a77678ab8df2a57147305764da7da291ce6482599c91f7f4959323c91c4c5434f50a9ca36051
TLSH
T15BC08C194002098EEB8002BC50A313A132B44C699200DD9026FAF93980102C0539AD44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5959bf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8d8ec0ed3eed6388240ceaffebfb14b6b854f7c5\dcecc5b5-cf15-4386-94f2-832562a4b7f8\index-dir\the-real-index~RFe5959bf.TMP
Size 48B
SHA256 132019710b22e2c474ec2b5ccfd07b214014bac028cf11bcf6e3b926f8778f9f
MD5 c4aa7195b92305bb4c683161a4ee8af6
SHA1 00853c7c0e37baecee85324943b9efec412e221b
SHA512 98036c2d52ab2675860ac5d45a9c9a9b537f509e3ece7f7e39888c4edabd5796a1d35aef1fba790d79cc7d765642e2d37fd677c6a91d945c789fd6a69d565d03
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8d8ec0ed3eed6388240ceaffebfb14b6b854f7c5\index.txt
Size 150B
SHA256 6dff9bba21458a9801e4c63f15cc27c9af0f77fbce6dc83cda6adf4230ac43a1
MD5 7fdc08387e568fa13e5a4044747d7b0b
SHA1 bd48d7abf11c0fc75caac011b5217ffaaa8aeaa0
SHA512 0445dc29fcd1b3a42c0734aa6814299a9b9e2d900ef5b2ea1d77dccb58513960835e68ff5dc712f3253152cc6f60d33ba0d62a31473b788fd5f6115ef01e3ae0
TLSH
T19CC08C2B430F8218EC9A528AB021903B420754839CEDC83A81329C24E49F6D2EBC0AC1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5959ee.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\8d8ec0ed3eed6388240ceaffebfb14b6b854f7c5\index.txt~RFe5959ee.TMP
Size 155B
SHA256 cdf4158095611325b3685a9447b8e9e388948aca52f4ce5187e2f04b8548d95b
MD5 59184364f4c05bcc6ea6af23526eb1d6
SHA1 32348625ffbeb9f8855e20efc58a0f39934af6a8
SHA512 89848e22b7449eb5ed1dee764d6c80251f5b8d54ef0a0f107f8af2cc95cfc03d1e7aa315566a0f71ecd7a62ea0ce3b06228adab68cde254c37ef3143aab67f0f
TLSH
T15AC08C2B030F8109FD9A004BB031902B42074C8398DDC83A8233BC24E4BF1D2EBC0AC1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 1KB
SHA256 38fe25d75fff1253a161441cc81277106d649f9e4f166de9bdb40949ccd121ff
MD5 3c08444a915f8c12de66f020cb021461
SHA1 b882771e6952a6e2bd7c77596ebcc4eaa9b252d5
SHA512 cf2fe887cb306f52bfff9ab6a823372ce4ad93a9a83361a5d8ad5e6688e253183eae5cd60cea239f74668d796c1539c5323db8e4059ea14717acdb1ea8a093b2
TLSH
T19D41E1EA96090058D46C48BBD89F71186B2ACF1E6FFE6717F6F2480C1D8C58F21697C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 055608c4c23ef3388c5ab1b1efe41d792dfef1cfc0cb3400efe9620dd29e2a2b
MD5 c79c0c76df71751582eefa46218a9676
SHA1 708f5ece5e6a751e4edfc8dc333a5703673260db
SHA512 6bf165dc0de966b4f206695100c5df55ca70d021d7d0ebb67a79c6134240396348f5e4e845a1497b854f0e527a04323a0f2215b4d909b1e8ac8c1b357a65cc38
TLSH
T115E086922BC9D1FD2065E3134776930D8FE4F415E7ED3C161F65EA5815C5F0877922A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1b446744d64e2b399c62d2088a87742068b617779ba69a54055673671a9b52db
MD5 b2b04cca751b43cd3ef8aa0a22683a81
SHA1 c32c82496169805cd968e54240e43e3cb7ed37f0
SHA512 1a2c7019d32c1438c08b694d71b94295b65cce88cd769ebf5e7b8005da9d2d1d0de25e80ee6f561ea0514a267db2d92baa08a958970f8125b82bd4a882983cee
TLSH
T131B01201C04B1A40CC6342F01504148821415E3180401A029AE4959A98830E02154149
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13427783940802941

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13427783940802941
Size 9KB
SHA256 bd6c54f3edf553ef7be8919c66cf5088147c33ab34375f85dbee4288708160ab
MD5 2dc7b7b78b27cb41cadcff10974c035d
SHA1 f0ea83492d7a2410e02d1410793bd2d1e3d5399c
SHA512 87a9addf9e1d4c3d28be5c842de0f27d02b1ffc393f9805254c9351a9ff4bb9007dfa8940c461a8197369f4061f4c2b54f0069165ca23f9e0e1f8805383b44d9
SSDEEP 96:3lXdxI8SvW/KihkSBvEDkBgu9mVHO9D/S0a/xZe6egab5d6XimmgSoKE:3ddd1/hnVdDq47sZKjLVpE
TLSH
T1F21249264AE8043ED27E8679C1BB04B2BB75FD0235D18E1F42A151180D27B93AAF5FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3fed44bc8f479d1c6e47d4477235714019f18bb133b30f25733ac7b6533faec7
MD5 3306daafe5b420aeb484934e22229e92
SHA1 288405620fc9f9fc57d71b3c78dbcc3b0cd1889f
SHA512 bae80d8392a7c9dadce97587bc538ff3b05f09a5fc101f68d3c61cea7220395cb14eeb683db0c9e9d33bd5df06b241848d9b2f0a08ecfbd09a5148c402a94f3f
TLSH
T18CA0022122D34C95C85052B22AC383C8231658900712D67785BC02A4CA975634511315
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c8efe0e5c96032392ba20c05b676f7826903a92fd005ca94b66ec399bb2ad887
MD5 0193d5fd0c08b39ed63f6d5edbd8d8e7
SHA1 3bfd341f7003a6f6e70276d2907f85fb64bb938f
SHA512 f8a9a272a61d2e9e3f2d310ead60e4675cea00d27f27add9df552224eebee2fcc0cb043758580f41beac970d4364944440fb34ef8118c4ea5e3465a147299332
TLSH
T1A3B012B437308409CC8C08B385984B315AA1F0033060E0435D44DF201C0F7FCBF115C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 f224b8207899f667d11449e35d2f095356682bc405eca0bf72870da87b92cbaa
MD5 b237ce1c55c8a9a3b2d89fd430fc0b0b
SHA1 293f4fdf830ba920f189c11a9a198e77e19944c4
SHA512 22b82159cbbf0982f98d5f195ba9463f9af02c8c158cd0c3adc5cc0958ba8681ffa1b96a5f4b99ce93a7562e404acf66fbf2c70c0dc58cf0789c9c2c3f5a44e4
TLSH
T175E020352BC9C7AF2046F01BA330E30DCBE1F400DADDA5251F04F55456859047793690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f130d90ad72e466c7a983456e335d5ed94a8c3446dc2b0ac5b305736fc4f97f8
MD5 c38e72e8e23e86cecac02b0e67133f31
SHA1 23dd9d98889a2f9459e1489271da6b8a16a7ecf1
SHA512 579037f76e04698386d1fd054f18e4ab78809b3ca5ad8a02446c27ac3f217cd7d6038d3147da8dd46631a1cfb5cd3efc8b6b3bb0fc60d69b08e38b67b706c5aa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 21647abc94a13a2b28101e97a5d7994e2107d8ab6009356bc408d582b6d211e1
MD5 dc3172166cb79c2c2d855d99367e3adf
SHA1 8598eb800888737e66df08965f188fb04e14bcd6
SHA512 d1ea837056d0908eebed99d347ea673092f74a8b5a0b5fb0cf4d5321e233ed617328e61a1cbd7a6d6b5126ee07ca4dd68dd6184ee056686c21ea4be507a31963
TLSH
T1F6A0025845C00D11CDB0827560A21B82E6934818595543235CD24C48A85B2C28191D44
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 522b30fbe444c9ecc970db55cc15a0804e17ddafadb4d9aade14d3a69d9d409f
MD5 f5c39ecb0d0d6ba6d8c8ac3bd9a54038
SHA1 cd78b894a330dc11c76414144fa19a57ce75f2cd
SHA512 60ee0ac5a2148361ecc296b79dd3209d8efa9e7e263bfdb7ee47f3e93b698177f24a5f223cd1edb726b950dd758c6e060bb7a1228f45eb7fcaebcb5f7e2d31c4
TLSH
T156E086B227C9FBBD2045E0579374AB0E8BF0F8089BC9359A6704A454A581A18E7A16E5
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 9891f97919e11f44a4577f8331a723bc1d83b5769efeb514ba38d61cc5183b07
MD5 a6c3b328bd560966dbb52849dc7e60be
SHA1 715c574d9a0d2fcf38a71da20cff66534850dc64
SHA512 074a4d3d2c3f6eab774df1e36d58e0dc7a53b7d8663d902cd6138a354723b019e800fce9be5c2e45faa65684a5307d176216852a9ce40686a31923595db3b3d1
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBBVSktLUL8nZLVL4PLytRSMn:f7doKsKuKZKlZNmu46yjUj
TLSH
T106032E8F966840F3C0B6C63EE9C205D5FC7D2108D75369E52AF80BB99E8C036A155296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 eadc76804e56680b17b0efff500a5b9e1786ed7016a5b3b166eb1f7129e9b577
MD5 a51d413b9529e9f92037ef3f93f86d4c
SHA1 5a1d8da2bfbf0d257738d906021290994e51201e
SHA512 58159580b64933423034f1a8b296b7ec6d149fb20ca93e9c5bd327f940695d54a08a283ee44f195704e7ca14b5776b6ba64917cec323fc8c255db2a4b3c71c0b
SSDEEP 6:XvlqVk3zo/lbTuQXCxXaDpvyCc/mLEJOgLEJLWK:XvlqVk3zolmQyx4pKmLULIt
TLSH
T1B50286AAA0894046C856067E91CB6898151A09693AD365297AF449197C6D153E8543C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efb96f80-9cae-4397-8351-aa16759f80fb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\efb96f80-9cae-4397-8351-aa16759f80fb.tmp
Size 414B
SHA256 773db17c9ef16d11206a58a177630b5c1f45a52e640754f55d2d94c58a644346
MD5 c569c886215f37c44b7aa6ea6242f4d2
SHA1 a9b1210968e28afeeae0d209fe1747867f606c2a
SHA512 794d8747dead7d7dac7b153be902b50ef1b76e4b9bc7b757d81e3a499f00534424603aa9534516668b4ca8451bc64c02672455795f6ab72eb061422a8a37e076
TLSH
T1D5E022EAC924DC3B18FD675C60240386EB00172B2A52895F3B3C860D8FB267F06A6C1C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 23KB
SHA256 c2cf9ac6740e47443527cf32ed523eea46a4acf9cdfb0b3ff397d8b3e6620c7f
MD5 54cdbe7e585af2f4e1879bc02656cee2
SHA1 47075832a5b61abcf02873c7f666490d928f7c43
SHA512 4e4c29f33efd30aa039680bb696e49a2a9ae08d7efce1e8d33f9992308625c92c828e5bf79866be5517bcafebe0654dd749f3330d864ead8857e77b4f6f9a359
SSDEEP 384:RvBRsdGFwbvPlsdGzS1y4sdGMuXsdGidG3VQSQIIIGb2MIMtBh9fpsdGidGd0:dwzVuVQSO0
TLSH
T173B2D75693B04BC2DC8B93FB7C558C2F17B6BCC941561007A99757BA38A3E160C4239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 fcecb0720add6d69663f849211d62ef72689731e4d295f458941babcda100a52
MD5 6e74de1c589696e979e1513389f3fded
SHA1 f4a460a65d84ac67b824a41035ac305081c42985
SHA512 813345bdd6db257dfa9b59777b570b9ecfe1ef244584bf4ac4af2b9bfd1a66ba16cffaac9f67bbceeb61ea7ce334039ff5d6494e7ae741e6f4291b6b8931c74a
TLSH
T1C6E026027BC8F2EEB015D00B812C630D8BC5B809EAD8240A0F00D06C5680304ABC96A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b8e5bcc1b7ec1ba1caa7ae3bf210e30301b9f9da298c352e3ccbaa39242de0db
MD5 81c249287f3f7f2077a353fe161f6774
SHA1 631e951c8c508c98cbfdf009ac06523442a15628
SHA512 6ea0ab451f50dc76f3ca0527c0be4b9ec7d4077997aedef63450ff6590b4aa13e1b604878a0674e6cf67d93c60845884ba9b397e58e7d382651578cc1001a4c6
TLSH
T10F21D2A5F331C209D149863A543EEB250734D8166FB8FD0F15B624792EB2A100E4F6E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 1259ac2a995a17f890233ea11a2f316eb3627f8a535ed71315e3722e21798900
MD5 73ce1075889e7d1c95cd1c30bef3e1d2
SHA1 1749cbf38219bb370bfe844ff33396b4e7641584
SHA512 ed1d5eae7be625036935b6203a645045afdae076f03e4d0367fc706e3195ebcfadb6472d3cfa78f403b8291eb57bed18d1f2933801ee6a03624e76d449b56023
TLSH
T168E026827AC8E3EFA011D027426C934D8BD5B815EAD83E0A0F00ED4C55802047B872A0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bb11b9af0b6a463f6d8c49f01bdd7aeab17ccf4577618b14dcd4841853d4e0cf
MD5 a31841f147c90ff424f66ade0fad911b
SHA1 b5e24df04514febb7c9ccb11d7baff3ff60e2492
SHA512 6b5295a46a2aa61ba501b6df4988f5cbbaae77426f736b2c95b4f8c4309dff09fb2c34747db3452025a99209955570684a05c4963518e823c9344de41fa31c31
SSDEEP 96:ibJ6cd+geMi2SMvXpgWRXfZowHqzPLSl8h4otop58bD6B66rGyvut4WtXcxwzQv8:itvvTSMXuWRRokIZiU2iqYIOcxdhT5ED
TLSH
T1BCC11871E56D5C3356F3E549F4062A87CEF420ABA758AE54EAD80F0C01E71EE1382A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 0ceb5ab60cdc3e3c7c9d0b5557dd601e53e99aa9490409faa434c869c07b0746
MD5 782811a3e54b4051383e687635d87d60
SHA1 c26234225edaaa3111c17d243450fdb257528e01
SHA512 c611e3048e8c0aa504a107f7474e9c1dad0e9ad2eb3500eaf7da217a92bb7c6a2edaba7b3f86fa376d5f8187a18d56f6c6784a81fb221c1d05e53f578efd07e6
SSDEEP 192:itvvTSMXuWRRomSIZiUDbqHvtOcxdhT5d7/Ug:itH+MXPR4IZKHFPxdvh8g
TLSH
T1B9D11871A56D5C3356F3E549F4022A87DEF4206BAB54AE54E9E80F1C01F71EE1382A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 b5418b53b2e704be9441b21a9eb0a2a9b035e26bc7bd3387b9feb2bd08fbe72a
MD5 9c48fe025a5767d15143d55dc4cf477f
SHA1 9c641e63b057f4686d8f8150c8da51448bc31b08
SHA512 734e4e16cf65f8414c29c2137847cc7581a3252a3cf90eb3cc2d8f04cf96699b7440fe89180f860a478d442555912d5d5a009a6175cd665453893973f7649521
SSDEEP 3072:643p9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRro:Z5P8pYw80nubFS/sBNxxo
TLSH
T1C3C312503C810F7BF6A9BD28BC022A9FCE155C19D611FF959EC48FCDB0A510D67885B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a21607d983e619899c4d72e48c4223ea13f2c5581c41dc5bea44cbbaef4e14ba
MD5 a45d4f7a5c94839a5478f930ae2ab83e
SHA1 5fb73282732831ac6d175ee680f791e56b22ce85
SHA512 b2275bfb7c8339dc0ba4ed14291bc9e4dce4555da2cd30b9328eb9ee70adbe1401ce1bce6b3907147ff13c83b1bbd133b911ce25334a2568bc0699f90cc5c9f5
SSDEEP 96:AC6cd+geMi2SMvXpgWRXfZowHwzJRDotok58fD6B6yZGyvuttIE6boiv4a:ACvvTSMXuWRRokoDUDCqFEdIE6boM
TLSH
T16CA1F73191384D3355B6D489BA462B93CFA8712BE651AE84A8DC2F0C26F71FD5382633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 17f0811afe79d54b6b65e9672551ed762d3feda31835bd217463f6ad0dbe5efb
MD5 4680a32c899049aae117061a63d87e2e
SHA1 ead3891756897a413a81cf80fd08c247c32f26d0
SHA512 a35c84c93ca39fbeb71c1d03c406d9dd6ff64cd3c2243c79095f40f35680f07928538ab55146efb889ae0c0c63d5d5b95be2534758b05574db23aa0ff560f80b
SSDEEP 96:AC6cd+geMi2SMvXpgWRXfZowHqzPLSl8h4otop58bD6B66rGyvut4WtXcxwzQvGf:ACvvTSMXuWRRokIZiU2iqYIOcxdGU5ED
TLSH
T131C10871E57C5C3356F3E549F4062A878EF420ABAA54AF54E9D91F0C01E70ED1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 ede4acaefc4f6d7ecb9ada1ff3cd6b1e1bc66959fde5c7907a11fce6645e8fd1
MD5 0d5e58b82bb919b6e50b6af6bd9f3d58
SHA1 909635b60610a386f1c81716c4feab2aa8c0e3fd
SHA512 907c8e8d2e80baed23a57b0c91a7051509bd5c5cd12458dbf9d72e455207f5c4a545d2fdf7438ae73d8a324e3d523380279fd3f25abdb6f87ebdfe49ccaf75a8
SSDEEP 3072:6i3p9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRro:35P8pYw80nubFS/sBNxxo
TLSH
T17AC312503C810F7BF6A9BD28BC022A9FCE155C19D611FF959EC48FCDB0A510D67885B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 b62f6e6cc00d6ba072f676028d9ad875f9e15744b4f80e6da142870b9d9a56d1
MD5 ae68440ad44b42ffd78fa472830008f0
SHA1 edd339d119bdfb62aa16815cf2036ff9d737c6e8
SHA512 ce7358fc15854e211edf1dca32cca398a8261551abf2ecb2b457701dccb1e284bf6e230d6d2ada5162d3d2720cd1f45c760e544f722e58f05d2e0705a8dcfec7
SSDEEP 192:itvvTSMXuWRRomSIZiU2wqHvtOcxdhT5E/Ug:itH+MXPR4IZSHFPxdvE8g
TLSH
T1E3D11871A56D5C3356F3E549F4022A87DEF4206BAB54AE54E9E80F1C01E71EE1382A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 2c39e4bc0239c9c466f423dbda26f66cf96c7b73b05074060fbbc8470abf01d9
MD5 fc36e0d79d0cb423d23c689bce27b260
SHA1 9702720b636eeb2a5013e175d1dcc209b982d27c
SHA512 32d96ade45b1686d612f55c132a5acdd201083eee6b0eb14e0e097afd9f60160e8371d6db48bea0ab9fc1ea707d3d2c1496a7205c9ead7440769c0a9d1f9cd91
SSDEEP 3072:6up9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRro:lP8pYw80nubFS/sBNxxo
TLSH
T14EC312313C810EBBFAA5AC18BC022E5FCD459C1BCA11FF999EC49FCD606410D66858F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 2781bee1c12a87200ccf3c561ceaff42110defff22df10eca89af3c55ab42800
MD5 981e4c1aee80e41237d5f85641e223f7
SHA1 e7686899a11e278e745aced825a692793d44dbfd
SHA512 94700a3c55c8e8963330278841fdf21391f77f76b4c8c794597be88ab807cf03f8684bb8badbb26b3f603cea9c756248386758108fbf1416dcf852a297f0fd06
SSDEEP 3:MsEllllkEthXllkl2zEkl8uqM:/M/xT02zn8uq
TLSH
T17A44040CFFC00445C50014705051D3F00370D4100D1177C37C7104135CC75400CC0001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 7e48d3ae2639406e51a6265785305c2e266a37cc2b19c63a421eb701b4bb5a7d
MD5 2660da510fc94f3b6462fc15915cceb3
SHA1 ced15b68c22a8dc2e136fde6bb2699a639319948
SHA512 b381630e7ab938cf2a6f1b0d9a77dad057bfa151bc3eb440fc11fec289df65c6451468f126e15eeb69439f3b9d9b8d018b57094298662deff63fd233f4f77afd
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JF:TkkhCU2QB2zbBxxr8587k2EZg
TLSH
T1CD23BD4E1A6811E9D1D6193EFED30C917CBD0F598B2B69D209E00C768CD10EE612F1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1204_1197729104\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4492-624-0x00000135A10E0000-0x00000135A1321000-memory.dmp

Download

memory/5116-316-0x000001D8001E0000-0x000001D8002E0000-memory.dmp

Download

memory/5116-322-0x000001D803920000-0x000001D803940000-memory.dmp

Download

memory/5116-325-0x000001D803C80000-0x000001D803CA0000-memory.dmp

Download

memory/5116-340-0x000001D814130000-0x000001D814150000-memory.dmp

Download

memory/5116-323-0x000001D813E60000-0x000001D813F60000-memory.dmp

Download