dfbbc09b63f105f414ac5d38be6504bd828d9bd64a63bbe44178e7b7236e4987

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastflag_injector_gui_enhanced.exe
Size 131KB
Sample260708-b1ajeahy8j
SHA256 dfbbc09b63f105f414ac5d38be6504bd828d9bd64a63bbe44178e7b7236e4987
MD5 9c2b21bc2ecd88ecee9d19d632848891
SHA1 d11fea650ac55a206abf2fcc051745f9e41353aa
SHA512 9ce77c6c615eddd1f98f5e2cc56fc2f41b071bb212d28069cfc71ac359c81029fa3aa7eec920bfbe11f02dfd6f9b16a1aba88ce84278bffade64a738ae5ed8ce
SSDEEP 3072:k3ZTBss7PK8H/REMnC0L8BaI/Ya1nM0RMvXSYo:kp9Ne8fRESJ8BhYa19RVYo
TLSH
T1BED34B2ABA59106DD27AC4B8CA530513EB727C860760A7DF63909DB10F229D4FF7BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1268	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Colors	fastflag_injector_gui_enhanced.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279482073607019"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f00922b16d365937a46956b92703aca08af0000	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 6c00310000000000e65c417a10004f4e454e4f547e310000540009000400efbee65c417ae65c477a2e00000076b10100000001000000000000000000000000000000441da6004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018000000	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\NotificationData	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "4"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	fastflag_injector_gui_enhanced.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	fastflag_injector_gui_enhanced.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	fastflag_injector_gui_enhanced.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 5932	2664	chrome.exe	90
PID 2664 wrote to memory of 2712	2664	chrome.exe	91
PID 2664 wrote to memory of 2712	2664	chrome.exe	91
PID 2664 wrote to memory of 1268	2664	chrome.exe	92
PID 2664 wrote to memory of 5916	2664	chrome.exe	94
PID 2664 wrote to memory of 5916	2664	chrome.exe	94
PID 2664 wrote to memory of 4760	2664	chrome.exe	95
PID 2664 wrote to memory of 4760	2664	chrome.exe	95
PID 2664 wrote to memory of 3232	2664	chrome.exe	96
PID 2664 wrote to memory of 3232	2664	chrome.exe	96
PID 2664 wrote to memory of 2924	2664	chrome.exe	97
PID 2664 wrote to memory of 2924	2664	chrome.exe	97
PID 2664 wrote to memory of 4800	2664	chrome.exe	98
PID 2664 wrote to memory of 4800	2664	chrome.exe	98
PID 2664 wrote to memory of 3036	2664	chrome.exe	99
PID 2664 wrote to memory of 3036	2664	chrome.exe	99
PID 2664 wrote to memory of 4544	2664	chrome.exe	100
PID 2664 wrote to memory of 4544	2664	chrome.exe	100
PID 2664 wrote to memory of 3472	2664	chrome.exe	101
PID 2664 wrote to memory of 3472	2664	chrome.exe	101
PID 2664 wrote to memory of 2504	2664	chrome.exe	102
PID 2664 wrote to memory of 2504	2664	chrome.exe	102
PID 2664 wrote to memory of 1904	2664	chrome.exe	103
PID 2664 wrote to memory of 4932	2664	chrome.exe	104
PID 2664 wrote to memory of 4932	2664	chrome.exe	104
PID 2664 wrote to memory of 2368	2664	chrome.exe	105
PID 2664 wrote to memory of 2368	2664	chrome.exe	105
PID 2664 wrote to memory of 5288	2664	chrome.exe	106
PID 2664 wrote to memory of 5288	2664	chrome.exe	106
PID 2664 wrote to memory of 2856	2664	chrome.exe	109
PID 2664 wrote to memory of 2856	2664	chrome.exe	109
PID 2664 wrote to memory of 2072	2664	chrome.exe	110
PID 2664 wrote to memory of 2644	2664	chrome.exe	111
PID 2664 wrote to memory of 2072	2664	chrome.exe	110
PID 2664 wrote to memory of 2644	2664	chrome.exe	111
PID 2664 wrote to memory of 4340	2664	chrome.exe	112
PID 2664 wrote to memory of 4340	2664	chrome.exe	112
PID 2664 wrote to memory of 2944	2664	chrome.exe	113
PID 2664 wrote to memory of 2944	2664	chrome.exe	113
PID 2664 wrote to memory of 3032	2664	chrome.exe	114
PID 2664 wrote to memory of 3032	2664	chrome.exe	114
PID 2664 wrote to memory of 2608	2664	chrome.exe	115
PID 2664 wrote to memory of 2608	2664	chrome.exe	115
PID 2664 wrote to memory of 5056	2664	chrome.exe	117
PID 2664 wrote to memory of 5056	2664	chrome.exe	117
PID 2664 wrote to memory of 1080	2664	chrome.exe	118
PID 2664 wrote to memory of 912	2664	chrome.exe	119
PID 2664 wrote to memory of 1080	2664	chrome.exe	118
PID 2664 wrote to memory of 912	2664	chrome.exe	119
PID 2664 wrote to memory of 1376	2664	chrome.exe	120
PID 2664 wrote to memory of 4488	2664	chrome.exe	121
PID 2664 wrote to memory of 4256	2664	chrome.exe	122
PID 2664 wrote to memory of 1116	2664	chrome.exe	123
PID 2664 wrote to memory of 1116	2664	chrome.exe	123
PID 2664 wrote to memory of 2764	2664	chrome.exe	124
PID 2664 wrote to memory of 2764	2664	chrome.exe	124
PID 2664 wrote to memory of 4852	2664	chrome.exe	125
PID 2664 wrote to memory of 4852	2664	chrome.exe	125
PID 2664 wrote to memory of 3944	2664	chrome.exe	126
PID 2664 wrote to memory of 3944	2664	chrome.exe	126
PID 2664 wrote to memory of 3204	2664	chrome.exe	127
PID 2664 wrote to memory of 3204	2664	chrome.exe	127
PID 2664 wrote to memory of 2348	2664	chrome.exe	128
PID 2664 wrote to memory of 2348	2664	chrome.exe	128

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ff8ddaec728,0x7ff8ddaec734,0x7ff8ddaec740
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10449178786327189768,14680898335900520948,262144 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,15501812968006051751,6159291391623100367,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,16274701045276964621,5048347284825845229,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16232996383492959939,17249758604740298727,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,13751315846151257551,2340877326645942714,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,12621566259735408647,8263266294338293737,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4888,i,13041832935483051861,17208984118590085319,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,10576239694925035509,14785716786170475512,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,16913361405224661532,15990394437279802041,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4752,i,14756327367539043117,7733382945648202342,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5016,i,12405134503817272232,6684316267090214631,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3932,i,6785422773334773741,851561671734986683,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5748,i,8002619492082200542,14960334876554209214,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5764,i,15364655221947484228,2355842751717118216,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6056,i,323252592727102414,8713231645927215526,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5756,i,3183212919272448792,15336640720723086068,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,10637681741488638808,9988717421482475097,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4896,i,3662857059151848128,13619780458036874331,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6156,i,1888441848517543701,2336568740712273551,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6212,i,5668681086391677304,128763137776921209,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5764,i,1574721414049094648,18249580318438337454,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,16590281723797692941,14295780464525543724,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,6634283893079680052,2170039019652801136,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6104,i,5378788968866051783,3623284274548968662,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:9
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6568,i,4624192958639600611,2442636194235175456,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,17172587041840064950,17780933886047434088,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,15281479144355070075,12101873809196894688,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3540,i,12843820353381812498,15937888047903239890,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5824,i,17956680675253410550,11508501486352205162,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6480,i,5727671388818569267,3609640424627253514,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6520,i,7954135337108859418,8471199685807434749,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5624,i,888087257389911169,12956410695723079920,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5676,i,10895565576505966019,3554870521198319045,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6756,i,12539010828592861267,1330711872997384394,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5988,i,13491493742269584190,13995290685956845711,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6776,i,17159920446529724156,17348003007928164893,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6552,i,15346211133679055463,13199277459987754689,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6652,i,16032215292309101541,564794388507907745,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6712,i,9081098385716370243,14388127251088300521,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5940,i,13804020060422422566,6512255744472252049,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6388,i,582528727996533289,10131023693241672331,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6004,i,5315231422142395394,1820373439938262024,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6492,i,9241136313059231467,17799910600691299030,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5904,i,16611557677430324355,6100724272471054137,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=4732,i,10340792176025245391,264001725743863964,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5940,i,15103226184982935385,4474360695413728404,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5916,i,18179280462906857957,14177323295025403030,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6856,i,12849312716311891928,2629771670609808674,524288 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6556,i,13899156337184193042,8944537919055759834,2097152 --field-trial-handle=1928,i,5514172560090049142,5537160935151202939,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000063
Size 914KB
SHA256 562124f5bc734c778f062726c76a476f9bc94df15def310ff36074c4637c2773
MD5 01a515f2044cac5929ef5cd5cd1f2f46
SHA1 bd907bc7e17007e111df1b3e8c0f6aa5aea97639
SHA512 9a73281856d1569beff6023a1736c462e4b480cb4326d8452e1f242da63e264ec9a85e9e4bd35c9d04bf669bf9b83ac2581015817e09c617e1989b1e503ae69a
SSDEEP 24576:qnv4FE5ZEFLjEAmu3yzvZwI6EEbcYr2pabMsqXhud2:qxopjEZf6EEPRgsqd
TLSH
T10A15339804206086F19CFBF7CBD69586119A3AA096D09B1873DECEC03F51DDD6872FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 f3836e4cb625bce3c7c1b2db2f6ae55d0feaae6afb110feaaf046b20be3b6624
MD5 4ca955ff23d5a38b55a2a774eb0417d7
SHA1 5e0a8bbe970079e0ec936f1bfcff3b58b2abd56a
SHA512 b08cb9c6df1566b57b23eff83e5e6b51ee9ac5aad5afc0579d7c935b1cc9b5e4ddaea77678e9f000850dfb2b1e222539f75d5638961792edf1d21f886af7cec0
TLSH
T1F611A915338F4AFECFCB81BB73C6944131FB58A869D31E76724E64747502B8643B1529
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 bac590adda9a378893e00ea438d284ab0325e2f8c44ce54569632a8c9a578142
MD5 9231ea13d8a1b9b5e693e7f1ed31bc77
SHA1 9e1db956b99255b3ab91aa123eecbcad8626ae79
SHA512 06b1673ac72739beaf990775a8a43d2abfffac4398bb652eefb6b114c6a28f4e969b6b937f59ab57731c7042172752091d14956fd52cec59d3300753c65dbd5d
SSDEEP 96:1W9+SBs1usIXN00BxSO1Ko7ufjqZ2l30gdcb74WAF9+0XMz8R:1Wi45iGW+8ltK/ArmG
TLSH
T175D12052339796FCEF9A4EB233C2382036F5C4AB41532E97A21405F994637F76A920C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\000003.log
Size 15KB
SHA256 cd7463384323df4830ff20d118737ecd90286680c4d63130b14f467c6a86cfa9
MD5 48cf8ce4922f67c5a4314d6148afb530
SHA1 ed242a6b274646816ab1a15cbbad77deb300067d
SHA512 cd44681a51004e9c7e55d4dcee374ca4856d4fbb3fe026d337c571d6de01e321b0a5d57eb616779b648e76f27ad9e6a037bc42d4cf967922b1a924dc62054f98
SSDEEP 192:uVobItp4SNfBN68UnGNacaIafvNy+QXJMQNZVFmHloL5FPFbxF3Q5a2x8p7pa/4u:OVIBR8I6ISdhtBD4DCnyDDGBrdnyUv
TLSH
T17372356F99849E3BE47D85B985660FC96B327D81BC49CC0ED0CAB33DC872A015CB5E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\LOG
Size 392B
SHA256 7f2add26daf8e5bc55e464c6fdadce9979cdd54a7131cea678119cffa787b5e6
MD5 6233f9f4cf7c42bcc02cb9f61782b87d
SHA1 1f25308ae6c2e4367314e6ff9d2ab35d19635af8
SHA512 ba489fc53813aa24422a036dbf624c19cb51a4d6f4ebd1725dc3583da29050b3c44c14006ab4da1985b120f127d3221a7cdc5f8498a3c5498ddb6d0e63481b6d
TLSH
T1ABE02BDE31CDC2BF609451175274770DDAD33A0CA6CEAC450F16C46870C550465E6FB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\LOG.old
Size 351B
SHA256 4221d81e673250418daf2a517d21b12d3c550f6c0a489f7cf9b73f244b301e20
MD5 c3ad8aba314b5be3b6ef38ea0e139ec9
SHA1 efc3f100b697b3b20725613b8b2de16e047d1bca
SHA512 83eaba1fc15e80f846756f9871f731e749e0b2231a7241089faa23e03ab6c79962a7eaeb1797eddfb2623f787a9e63692f32ecb2e2476bbe89c88cefcf0c9458
TLSH
T113E068AEA9C8C65F104081766420770FCDD7350CE7CFAD450F13E42830C600C88AA6B0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 8b590f6687aa9512e374d7391cb5ee61920c650d368b765136bedbce881a54b3
MD5 a7611f9c8f95ff6bce0a405bf75f9653
SHA1 c2f6dd0306554d038f8e1641e67fe73f93742e64
SHA512 a8fec22d7d2e6fb63b8a1dbb161759920812decbc58363a279ef26bd5bedc74809d6138e25adf2aa4af7396681d354081d6f4c70b5e3c8bf1bf2eb78bf9e5256
SSDEEP 384:DbSkRKBSw+5BbNomHh8JfJpb92LlM2YVb42fQt8OaGN/kGEbGVlz6uKEl2srUV+8:MtYBLPD+rnfaG5Y0GuYxYPbgLQzB
TLSH
T11CC2BDF7C3E89A2CDD1152F4AB152E1FCE690928432C3D6A89D5BF0B93E2571E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 14633c3da7334a2c3ff27a9894656282b4308722f659807b37de044747fe8678
MD5 26d40d56daf0492687069aab02f00bed
SHA1 f11336b616ad3edddbf56b351fe2ff01cbdff8cc
SHA512 6b931205b81b14fed622bf28d754f21da880a97462d6a7771f468a19013a58751f29f68cdf35af6bbb2033bdf553f2de825d3f71a0348f6a89dfa9c2c4003871
SSDEEP 384:DbSkRKBSw+5BbNomCt8OaGN/kGEbGVlz6uKEloHs1/WQ5gwNOasfTSV+b7o9ZWw2:kPDrFgv5
TLSH
T1E3529FF7C3E48A6DD91152F8AB152E1FCE290924432D3D66C8D5BF0BA3E1971E28164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 aa96d1c8c1d4c9d1955761c6c95d5b9fdb0caec1acfa32362ba18b50f3af9a0a
MD5 66fdae86bd314015f1914f5f23c597a6
SHA1 e5c00dbe322e6b4adb8eb72b162e7fc6d5802ec0
SHA512 82bd48820d6542f8ef34a747bf6d5cb8bc7fc5cd139d08b37aa13586c8c30ac099e6b80243af11619c763cebd07dd2e5aa96a19d0a4e62c93ca482e91b69a3fb
TLSH
T1F6515C5BD27EB86B103948FF1D45BD066979B832039164F4DFAAC2ADF0824FB1B16463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1ced05839cf20ee75150a11868ae339afd8e55947623e2833349717f3765307d
MD5 235ce16640b09267f99217fad59375d4
SHA1 7e0cfc8b4dd1ee1c71e9c26236a5fd70fc80f417
SHA512 42b581b86ff18149db5be58702ebb0a5d6c74fc7c0a0b745fbb16e0071873ef2b6a93da205343f7a00cdb996b755ca1d46405ab7ff1ccc8d41ac4f576e450511
SSDEEP 192:sR0gSVpuHav7lAPRp28cV19SHsb+WNnyRb2l2Yie/aVyIsnAUge:sRuVY2UXuYwAI2iae
TLSH
T16232C82EAE14A53B2CDBC31AF935B717E2F1103176952E80EAFC8A2C12D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 61577659a655c965a399643d3ff6fa17e49286309dadd5652dee233a9d731c6d
MD5 de676da269999d5dd8741b44fc9fe97e
SHA1 e05201f659df032538273b7223f049f669551aa5
SHA512 b1adb8dda021b34b21f53ec988b903a2c87bfa311b1cf42cd35f6f0af2ca81237327e6def83040abc9616278badab6fbef2726e3136eaa7c23209e108d5b50a2
SSDEEP 192:3R0gicBzVpuPav7GfPRpDQvHEUVsInlef6be9SHsb+WNk13FD/7etAvv+tBtWFA7:3RWmzVw2OXhYwKtEQW6Ar2kaE
TLSH
T1C162C867A820567B6DE7C326F922F72AE2F11021A6D55D80EEFC8B1C12D7ADC6117807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 45e1f7ce6008a5b25aa12779792777f9a60c3b1f8c9027d00f441f8e301c0f6d
MD5 5faf9643a700416ff26c2ee644a9ce07
SHA1 bdc8ff5d55f8fb5fddc803ca735f938da3981ede
SHA512 31589533af8849ae41a1adabee158a2c880276d328d15989965f0791f08e5480199395476fb6736f3fc46a83ab17a01a5ba87e730d5955636581cf9f0cbab8d0
SSDEEP 192:sR0gicBzVpu9av7lAPRp20q1WI6hd+79SHsb+WNfdsyR44V0+NWFYKQie4aVyIsv:sRWmzVW2UX3CYw1raY6aE
TLSH
T10F52A72BA960967B6CD7D32AF932F717E2F1102166D52D84EEFC8A1C12D7ACC2117817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 19429ed0f513d6ce5f593fc26bfdf816e404d0db263d23fd66fc8bf99f1936f9
MD5 5151260e98db32a130fea0eb186daed8
SHA1 d5f3ca4983aa938eb4623c0152477288c91e90ca
SHA512 74ffd3d63d7abb207d3a409df1574a7e6b2fa2ffea5891999930b27a8aa1702dcbc9b989634b065e9a92ff62177e5511faaee346250badafa85f5656ee3c79ef
SSDEEP 192:3R0gicBzVpufJav7GfPRpDQvHEUx/csInlefgFbe9SHsb+WNMt13FD/7etAvvOHe:3RWmzVC2OXq3YwstEQCW6Ar2gaE
TLSH
T1AA72B877A820567B6DE6C326F922F32AE2F11021A6D55D80EEFCCB1C11D7ADC6117807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 85b62190c8000dbddb1466fc47b1c8c72ab6bda68201f0b845e44fad34715088
MD5 22396b27c61c5cb200120e7e1c5288fc
SHA1 6f3b75295d22c97908891db8bf5ff7e71954244c
SHA512 58af259955c5b52067e26c8a1e9567e4556ea542fef758ad9089910a840f99cbac69de2abe2851804cbe5b108faf2bad4b6d82bdb71fc8a928bfbe64150147ef
SSDEEP 192:3R0gicBzVpuFav7GfPRpD0q1sInfeUIe9SHsb+WNk13FDmetBtBtWFAAWV2Xie+p:3RWmzVS2OXbYwKttZ6Ar2+aE
TLSH
T11652C86BAD20567B6CD7C32AF921F726E2F1102166D52E84EEFC8B1C12D7ACC2117817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7b226bdd60f222012a09974e8f792961a832b870\140c3cce-bd7e-4f01-8377-5863c223d5ea\index-dir\the-real-index
Size 72B
SHA256 0c44d91159599b1733e54dd2c231fd1334ac3e2b32ab9f559f53c53b2386e177
MD5 b555203cb6dd10c2d2c855f5060828dc
SHA1 9da5fe49872e8f96936b4471d62bea7d16a9564f
SHA512 8ee8134878fdcd4b9e78de9b266c1c6d088ebfc27888c224ed54cba9e241aa7e13a680f1103ba4978d04af8915ab92ad0ed4c7cbd0ce22064c765d931e1f98b9
TLSH
T1A7A002D203451446E53372F8742B1559164048759053136ADC94A5B4CC79098768754C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a39ed.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7b226bdd60f222012a09974e8f792961a832b870\140c3cce-bd7e-4f01-8377-5863c223d5ea\index-dir\the-real-index~RFe5a39ed.TMP
Size 48B
SHA256 8a24bb6ee2a0cf5380f906b425ca2b1010bb8667f728c7ca1a5782056511ae60
MD5 5aab6fe587c135648af85cfeb239b024
SHA1 f75312ba1e9b83a897002232cf651a4bfc05ead6
SHA512 0309b77a5effd3c624b2c26e9558372061cca3d1bd2584480e2a965e320e9975f13de808e048be0f45573b2c60bec42e50c1ae063910325205cf395374762c73
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7b226bdd60f222012a09974e8f792961a832b870\index.txt
Size 141B
SHA256 a4030abca0818dacde8b1ddbfe02dd739fdfe63419c3c9da213f7548d9268df7
MD5 8524338ae2d8ace68a83b0ee8e00d029
SHA1 2769c322ca0b5d1037da53e924110e11f03dbea6
SHA512 e9b55a951de2fba84a07b763f02cb22a876f7ab45fef4f84fd270fa2bcf1e2d35fbbbf21858f9287000fbaf2faf78ef6b62e9f3b8497722301d2d05758661c50
TLSH
T1A1C09BD3474057246A85E6C53C357174953FA844D5D999D6D4371F71201891A4C13BFB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a4269.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7b226bdd60f222012a09974e8f792961a832b870\index.txt~RFe5a4269.TMP
Size 146B
SHA256 5938cf2cc4aded1d0959736c01083be05fe51acf6d6d3e92d9585e9393eb01b2
MD5 675d4014e63d8f573aadc357d5c4581d
SHA1 88190891410971a62243a64f334812d9adc94a54
SHA512 4a25aa2b760fb5836f443e82909ba2c927bd1e353082748538066593f5fa5ed58218628419997eac01bb753cc6b2ef4c3cbc6b8729bd900da6213f690fe89422
TLSH
T1D0C02BD3034007245A84A1C53C307168883FEC44C4C489C2C4333B20203495B8C03BFA
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\91c504622e8cffd20b3cb2eb48fbb0159e9a1ee8\e305eef7-c399-415e-916e-bf5dba02df5a\index-dir\temp-index
Size 96B
SHA256 d341f69f375fe67f45aa633c18df53b0399c1e5ea778134d56811deabe0e30a5
MD5 1d9336974b30b094fd5076ff4771ae2f
SHA1 abbc4e6877d3080d1ac4d0e7e1874ac58b701beb
SHA512 1a5d1a50598a8a1013d7f11777d34aded97a36abad8a3da8faaaf522d040e1ac3b8683f448d0ebf1f922c4921df5211c8de8838cd298cbac3ef7732e01cb2a4b
TLSH
T13AB022328A202C03CB330FB83880A00033330C38030333A282F0A23080E838080C8388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af7af.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\91c504622e8cffd20b3cb2eb48fbb0159e9a1ee8\e305eef7-c399-415e-916e-bf5dba02df5a\index-dir\the-real-index~RFe5af7af.TMP
Size 48B
SHA256 501a03c29cee6ff90b4f88024d7f551bcdcce934c0ed1114ee94db2d46440d22
MD5 d3baf322307c577c92fb581d7022ab16
SHA1 c42060bc7926d92c751a5e7c924c247941d2bd54
SHA512 3399e950db88959bed882a09f5fec7262013e97e1f2bd5d82d764a4f137218f45dfdc263258b249520c390f9e99544c28389f56a9945563a8e165008c9d9c530
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\91c504622e8cffd20b3cb2eb48fbb0159e9a1ee8\index.txt
Size 170B
SHA256 f6819f7c882a1bc1bb5d5ae713c74c4c51de3bb07967952669e715112da2a062
MD5 1959bc10e2f580b944e81482e50db9cc
SHA1 5d47fee316fc4f462c8b49fd4207af926e3e033a
SHA512 28e06025a7807256abe1bc3e37eaba240e530369bee4d57f0205c44e2dafd1807ecd6c74f043a710ff2ad86694b824329dbdc964232e860171aa45809db01e93
TLSH
T103C0806FF44170940930836ABE83F659F4775049F090A84C48D64342045682B8C4784D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5af7de.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\91c504622e8cffd20b3cb2eb48fbb0159e9a1ee8\index.txt~RFe5af7de.TMP
Size 175B
SHA256 fae8e929403c0ed7dbc0308e828c109933da283470b5dfa59d444f4aa6d307a8
MD5 c7f024b3296c03d43a8ff5d45af18bf9
SHA1 eabf106550e67175408c6596338b3beaaa7694a9
SHA512 70a78323bd9f7f87cc7b6c7ad9c448a73cf5df79617a703f9a60c1a2fd4e1ed6b41bd356056b58441392d3e91f8a9073330d747d984bed841444fbfa79626f01
TLSH
T1E1C0807BF08170540A30476BFC43F599F4769885F480944C58D73351047A82BCC4784D
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\bf500f39-c85d-4531-a3fd-9616d7b01097\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\bf500f39-c85d-4531-a3fd-9616d7b01097\index-dir\the-real-index
Size 120B
SHA256 0aee6ce36f465ced72444833a39d7f67a29bdd45aed51a24642b789beef049f2
MD5 f6371616e99c08d3fc9e8a5f8e6b4c4e
SHA1 23500ed34af25cb73068bea2e095f97e3c6b0b8f
SHA512 9ee2862df72c9a1eb4252ffb8bc1e955ff3fa5d204b5d87d5c138ee5afb303570326e5fe73283e179440795b6f0a3338e86db2f624d9316709659c86b0c78c06
TLSH
T153B01203EC804407C8101770F163C1C363DCCCDC1202131301C912846D52544E1628C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aaba3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\bf500f39-c85d-4531-a3fd-9616d7b01097\index-dir\the-real-index~RFe5aaba3.TMP
Size 48B
SHA256 3f78e5cccdcd0028193419ff470a5e1bb9771e778fae3502eb89f6d6393b7dee
MD5 975546c60be40136ca5ff420538e1a44
SHA1 42a418208f6f179abf2ce7ae05effbea2a54726e
SHA512 287d1d2ceadaaddc09124a088f8cc9f79877670177a2523bcae3c3545207843026b083e72159e0076398f80ee736513a3a06e6922b485bbe1aa3a6533d883c7c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\index.txt
Size 168B
SHA256 1919462be50313bca428074f0394a194fa97624dec196eeb782667dd79e113f6
MD5 a7fae55e6589e662943b066c235b0d6f
SHA1 cb7d92ff2231b08048d712b735f602ec3e1dea89
SHA512 a072ba9d9e733e0891bba8bfd370e60f6d2f73b3a635452031319d74af3fc51ef5ed2ea0dc8eb8a7ba042a0056f4a3400944353b3fd969c4dbcbf6798023a55b
TLSH
T170C08C4F58182A144F62E3B40831B225EF3EE2C8C8A22F8C94C500C290E9C33102AD39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5aabe1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a550c5315c4b5edb2a3290e3158070215776a0ce\index.txt~RFe5aabe1.TMP
Size 173B
SHA256 4b26036a46dce0a847c640430a4764c4115d24b02b1ec788421c533195a70777
MD5 8a5fbe2a1f9cfbea197ea7e5d5b59a94
SHA1 3b8d2dc59c27c7240022e0152c5c39240fc6510c
SHA512 ae61ceeaf5cf004d313077bdf622a18d4e2abf344554de157acd0d07b40d1b936d087397afb854535176c3b5f3d35311077882c4ab47854c41224ae7c0fcb19b
TLSH
T19DC08C4F542822004F62A3B00831B244DF3DEEC888A62FCC94C530C260B9C33511ED29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 08b8dd88aeb3f1bbf27ac2d35fcb5df687d3fb21af41f84980161a04f9ce694e
MD5 549247bc2b2817636093b060a20831d9
SHA1 d87a24294e0be66357eded4121b03f863a1f5c63
SHA512 361c5bee0cf9f3015895d1933c714c9e3fef444ab93604d83ef7ce2bcde3803857326e03ef7b254202a597f1cbd5392e22e622eeb4ad34a4aa454fe58274890d
TLSH
T125B01202C0861633CC809570124460C4B3E0CE25C141274382E057A78C5F3E10260500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 236688111edf7af83dc75ca32cad5ad9b85550bd9fee6726987b6f42cef7668d
MD5 f0a433c717f19b93e2debd635c82a255
SHA1 cab73634316877335fe20f01519f9717343e1eec
SHA512 b2b22878b23a7e5f20f96eaee001e3d9fdeebdb9a92283f674b8cf72d30f125bd756a908c102a7cf57f466c819506412b06d2c312ff8287174e8a5e630d3d9c5
TLSH
T1F3C01243C44A3922C80CCB741E86E04832D09E3AC1A303DB9BF0A6BFAC6A5B20525601
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ea3df15b8dc075e3b9fa70e35914bc970f00d81bab66a0ec21a849deb6c4bf7e
MD5 52686add459a4b1488418dc00db6976b
SHA1 c0055035c144af65e5a69a93695a62080e0bf28e
SHA512 c4a6495f07267fc703a85993a7e8ac30761b0e6168227eb6829888dccde8235b7aead349f612c38c5670758c42409f42985c67494a94f13448c98aeb678b6540
TLSH
T15CA0022121C14803C9549771739A05F8A7285935430B9707D4B02194DD925468321251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 259c0eaba6b082dc03f8402e45c28a93646a25175d47c5b8adeccd5eb64839da
MD5 be8d76af65597557a0dc3851e9aae6e1
SHA1 24ee486d9a068a6b085007c1eff28c2d2b34234b
SHA512 dd46046fde95080b076f2741678fa4f38dc184e309d18888000c1d680c341583846821c19f17dc41f89c021880e0319bee11116945801acac0f795431a5fc847
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 692deebb447e0ee9c35f7f70c36575f107cfbdcaa1074e5f0fe993a7500d3faa
MD5 7804e1a632cb5848d56df2bf6a3a17ee
SHA1 5d62fac676b5013d97d1a10a8ca680e2025f6e26
SHA512 b550d16b15f5d1753216a089d4d1b57ff7cd5273fe7839436de5648cd68ae3cc52ff8a61ea534ca43477b1a80b54d6d071e4e95bab72164481f0c2b12b08c544
TLSH
T1C7A0021185C16A55EF138B7070B1054533E158185A574313549B2959E8AB2D44902740
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b1181.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b1181.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

eb9ec214-fdb6-45d1-ad28-9991a8a9037e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb9ec214-fdb6-45d1-ad28-9991a8a9037e.tmp
Size 13KB
SHA256 d91d4a4eb9cd6440bae958b317977303a27f0e5a0d39df0e4e05f6c8839cf297
MD5 56c9d21b552478a3eb5b841666b2f538
SHA1 57af8f79a20cec74b7c169d41107fe893eb0c6dd
SHA512 c70976b3c1ccca73eeeabe0e634d82e9608a11a477b3a6b92b17aa87ec966d22881bb5f964bb830d070a0ecc751afe1d4c94649c6b721b141660218e59dd7db3
SSDEEP 384:2Mj/O7KxkXqKf/pUZNCgVLH2HfgslolXODSt+ErU360HGg/bhnHe3:2A/O7KxkXqKf/pUZNCgVLH2HfgsKhOOv
TLSH
T12852EA27A48D9A3B0FD8D65CEC17AF4FACB5015766784D2492FA5C0803997CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 860a96603e873232fff9e7c9c5f11b72f1f38d0792759e6ec240c5cb67348bb6
MD5 d9fde723b17b3ba06f567db13618c303
SHA1 e180543d82f595c2ae3f93ef948b33130be64bcf
SHA512 8252350f0aa1baedb7161b9af55569bf1154773b1bcccf43cccfd203fece9241eaa7db9b40069b601ca6207f636db1bcf344e315c4d3479084ee84c0929778aa
SSDEEP 3072:SjX6YB/WuuzdZYjHwXlKMR9cAsXorloZjfgdTe+moW:SjX6YZgdZmuv/OjsbW
TLSH
T18FC312B118992CF98D2B688FA12E3A079FD46757DB79B3CD59541F0111BF8BC0602C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 4d34e7d546f3a540232161f1bb088a57ac7cb1d553fc015dff6657f312f2535b
MD5 1d1d3aaa8e0ffc0b656befe0fe4fe4db
SHA1 692635453a828a8b2f5882c21a14f9d240a78712
SHA512 9c466f32b9b34bf17e4e1626e3eaab14303c04961d563400508b09f67f9ba4139d7bb9ff5dbb02fc12a10c5a8dec241c2c94496d8bf0e5f10dc586aa0673d280
SSDEEP 3072:mZX6YB/WuuzdZYjHwXlKMR9cAsXorloZjfgdTe+moW:mZX6YZgdZmuv/OjsbW
TLSH
T1F9C312B158A92CF98D2B688FE12E3A078FD46797D769B3CD59541F0111BF8BC0A02CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 8905139c1b18cfadfdf5edb2e84a99ff9e55abc421bc993e0419140614125c84
MD5 4a1ec7e6c8c042805a05ef0845192f61
SHA1 3476bb6eb7d4f43d92b7b0d27e1cdfba4de722e1
SHA512 20985661a598d2a3ad0a66ec3426ea64503585cc4e76efe6a5a1101d358e1190f4036afb977556ec0d8e18a84e97974d864c8a555443bcb49f6de521f4a8fa18
SSDEEP 3072:+X6YB/WuuzdZYjHwXlKMR9cAsXorloZjfgdTe+moW:+X6YZgdZmuv/OjsbW
TLSH
T174C312F158A93DFA8D2B788BE16E160B9FD41796D77573C909905F0212BB8BC0302DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 12d68e66c9fd4c28a2ab3420b5e8b7515fa604cc7859164420595a59131090f2
MD5 c319e8589668742bd5595007812c7b51
SHA1 074aba3d39b63b32912de748f8d169910223e428
SHA512 61f268d481abe4ca6d0022593b0f88b270ef429b1ec80b0e329183e9cbfe6428ec8fabd72c3ef8c5d4f01d9df86fe9c43a46ed9b1f817f04373f76351f8545b1
SSDEEP 96:ElC6Yzd+nTANLxvf8xUrbOuLWRDotok5N9DzjB6DGyvkhG8YPEgxCv4a:ElCPzsMNLxsGr65DUDzz9fBG8Ys1
TLSH
T144A14B32B97E9C7368B7D28DB9527E43DE64606BA461AFC4C9DC5F0C15B74E80306513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 cc2a3197da04ab5e1feb2abe108ba480a1ad90b0edd910c2d4c61fbc80b98275
MD5 6355b23a3a1bcc196726a95617adb982
SHA1 a5c845038f6f57566cad9666e0931c2081ac3262
SHA512 9335edddb9c19227d26090c29a9f967c8f0cc1e8c8821eb02ccf118800e645c9a0729aea142141d6641e5d0195d10b13087f773c189ed2ca6fcf9a71f84f2fbf
SSDEEP 3072:NX6YB/WuuzdZYjHwXlKMR9cAsXorloZjfgdTe+moW:NX6YZgdZmuv/OjsbW
TLSH
T1EDC312F158A93DFA8D2B788BE16E160B9FD41796D77573C909905F0112BB8BC0302DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 4c7242d9970e31db8e5f583adfa3f1a49f9594ea4b1c336e6cee622c2aa76e0e
MD5 5d5cec28aa8aada5e7daaf2ae94afa1d
SHA1 4ea5b7b361af75f8cac32383b5f95014f7c66161
SHA512 d145183f801c86b31d536ae9a69c99ec37943c99699383d8b98d7f5962b41305175962d7e6df533c748525195aed4dfac878537387f93419f3e4fc8fbcec10bf
SSDEEP 3072:AKX6YB/WuuzdZYjHwXlKMR9cAsXorloZjfgdTe+moW:AKX6YZgdZmuv/OjsbW
TLSH
T16BC312F118A92CF98D2B688FA11E36078FD46797DB69B3CD59541F0112BF8BC0602CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2664_170626328\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download