salatstealer | c595218aeb6359a1efd4e5c57124d60b0f3c6da777c641fa60386641f9f2d2bf

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rust.exe
Size 3.4MB
Sample260727-btejsatzax
SHA256 c595218aeb6359a1efd4e5c57124d60b0f3c6da777c641fa60386641f9f2d2bf
MD5 7c522e9436bab58b7c102b1b1f37f89a
SHA1 6c700bb2e7012e10c6edcecce1d126e0fc7aa3f2
SHA512 5870b1692ae64c316e0b0c3d4f49fc5a503b08260ce663022d71eb5e74be769093ff4363914d81aa42dd2382939960a508d5ad223e8d8c6524fcdf168165f82a
SSDEEP 98304:CJmDtaMmVCSIcyhmZKCsBOQg7qMUNTBhKqWU4Y:CGaMjFhoKCsG2NTB8qIY
TLSH
T15FF533DE824E62E1D0D30D3A21BB31442DDABA49AF93AAC4D52C65D68857FD20377FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 14 IoCs

resource	yara_rule
behavioral1/memory/2228-1-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-2-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-32-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-830-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1091-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1123-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1145-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1269-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1330-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1359-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1360-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1369-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2228-1472-0x0000000000B80000-0x00000000017D5000-memory.dmp	family_salatstealer
behavioral1/memory/2112-1489-0x00000000008F0000-0x0000000001545000-memory.dmp	family_salatstealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
195	5940	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	rust.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
187	api.gofile.io
190	api.gofile.io
61	discord.com
64	discord.com
119	discord.com

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-2-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-32-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-830-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1091-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1123-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1145-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1269-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1330-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1359-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1360-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2228-1369-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/files/0x00050000000234c7-1463.dat	upx
behavioral1/memory/2228-1472-0x0000000000B80000-0x00000000017D5000-memory.dmp	upx
behavioral1/memory/2112-1488-0x00000000008F0000-0x0000000001545000-memory.dmp	upx
behavioral1/memory/2112-1489-0x00000000008F0000-0x0000000001545000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rust.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rust.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5940	chrome.exe
4740	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295891943926314"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B28C52D5-3ACC-4721-B066-5638B4390B7B}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
2228	rust.exe
2228	rust.exe
5656	chrome.exe
5656	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe
5656	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4136	4316	chrome.exe	105
PID 4316 wrote to memory of 1092	4316	chrome.exe	106
PID 4316 wrote to memory of 1092	4316	chrome.exe	106
PID 4316 wrote to memory of 4740	4316	chrome.exe	107
PID 4316 wrote to memory of 4640	4316	chrome.exe	108
PID 4316 wrote to memory of 4640	4316	chrome.exe	108
PID 4316 wrote to memory of 1100	4316	chrome.exe	110
PID 4316 wrote to memory of 1100	4316	chrome.exe	110
PID 4316 wrote to memory of 1684	4316	chrome.exe	111
PID 4316 wrote to memory of 1684	4316	chrome.exe	111
PID 4316 wrote to memory of 2212	4316	chrome.exe	112
PID 4316 wrote to memory of 2212	4316	chrome.exe	112
PID 4316 wrote to memory of 4424	4316	chrome.exe	114
PID 4316 wrote to memory of 4424	4316	chrome.exe	114
PID 4316 wrote to memory of 4116	4316	chrome.exe	117
PID 4316 wrote to memory of 3856	4316	chrome.exe	119
PID 4316 wrote to memory of 3856	4316	chrome.exe	119
PID 4316 wrote to memory of 2116	4316	chrome.exe	120
PID 4316 wrote to memory of 2116	4316	chrome.exe	120
PID 4316 wrote to memory of 3324	4316	chrome.exe	122
PID 4316 wrote to memory of 3324	4316	chrome.exe	122
PID 4316 wrote to memory of 4736	4316	chrome.exe	123
PID 4316 wrote to memory of 5436	4316	chrome.exe	124
PID 4316 wrote to memory of 5436	4316	chrome.exe	124
PID 4316 wrote to memory of 5520	4316	chrome.exe	125
PID 4316 wrote to memory of 5520	4316	chrome.exe	125
PID 4316 wrote to memory of 5836	4316	chrome.exe	126
PID 4316 wrote to memory of 5836	4316	chrome.exe	126
PID 4316 wrote to memory of 2928	4316	chrome.exe	127
PID 4316 wrote to memory of 4128	4316	chrome.exe	128
PID 4316 wrote to memory of 2928	4316	chrome.exe	127
PID 4316 wrote to memory of 4128	4316	chrome.exe	128
PID 4316 wrote to memory of 5420	4316	chrome.exe	129
PID 4316 wrote to memory of 5420	4316	chrome.exe	129
PID 4316 wrote to memory of 5588	4316	chrome.exe	130
PID 4316 wrote to memory of 5596	4316	chrome.exe	131
PID 4316 wrote to memory of 5604	4316	chrome.exe	132
PID 5656 wrote to memory of 5664	5656	chrome.exe	136
PID 5656 wrote to memory of 5940	5656	chrome.exe	137
PID 5656 wrote to memory of 5960	5656	chrome.exe	138
PID 5656 wrote to memory of 5960	5656	chrome.exe	138
PID 5656 wrote to memory of 1028	5656	chrome.exe	140
PID 5656 wrote to memory of 1028	5656	chrome.exe	140
PID 5656 wrote to memory of 6128	5656	chrome.exe	141
PID 5656 wrote to memory of 6124	5656	chrome.exe	142
PID 5656 wrote to memory of 6124	5656	chrome.exe	142
PID 5656 wrote to memory of 6128	5656	chrome.exe	141
PID 5656 wrote to memory of 5480	5656	chrome.exe	144
PID 5656 wrote to memory of 5480	5656	chrome.exe	144
PID 5656 wrote to memory of 3204	5656	chrome.exe	145
PID 5656 wrote to memory of 3636	5656	chrome.exe	146
PID 5656 wrote to memory of 5408	5656	chrome.exe	147
PID 5656 wrote to memory of 2392	5656	chrome.exe	148
PID 5656 wrote to memory of 4592	5656	chrome.exe	149
PID 5656 wrote to memory of 4592	5656	chrome.exe	149
PID 5656 wrote to memory of 3520	5656	chrome.exe	150
PID 5656 wrote to memory of 3520	5656	chrome.exe	150
PID 5656 wrote to memory of 3108	5656	chrome.exe	151
PID 5656 wrote to memory of 3108	5656	chrome.exe	151
PID 5656 wrote to memory of 5616	5656	chrome.exe	152
PID 5656 wrote to memory of 5616	5656	chrome.exe	152
PID 5656 wrote to memory of 1572	5656	chrome.exe	153
PID 5656 wrote to memory of 2112	5656	chrome.exe	154

C:\Users\Admin\AppData\Local\Temp\rust.exe
"C:\Users\Admin\AppData\Local\Temp\rust.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc03d1c728,0x7ffc03d1c734,0x7ffc03d1c740
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,13329154416816798847,1478085829656018978,262144 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,15065543642282406786,1036267487892875680,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,14637108448681270122,15545211241431758884,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,18254303238478555817,7488865733861148639,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,13658871488506959665,10460806268065352003,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,9378398783444686917,1950157150356877525,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,12874193475060164437,10731185868944366868,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,8216665287147333991,4376302166352483037,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5628,i,3195869909449117816,6674495340123411502,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4684,i,3792672908386027652,9923250491845302877,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,5280140099761076547,3931208750396924006,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,947081629918737442,16951963870563913485,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,6744415300204347261,3648294000913434011,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,9663349740515451951,15012772521851336499,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,7551393505177488224,8644320985500964381,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6120,i,12240443609980698045,17877156628987818278,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5856,i,16830278448426763427,1684100290598605225,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6140,i,7901970559862515926,12632493964558454152,2097152 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,15022759984075413304,18428661334678957992,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,2484428585063222181,15514198066908504951,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6604,i,13016185709159762038,11132451375821578359,524288 --field-trial-handle=1964,i,5284667404710393141,3063290003877480532,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc03d1c728,0x7ffc03d1c734,0x7ffc03d1c740
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1780,i,57189307456766955,10268836331207163080,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,413129422955427837,471728029101763198,262144 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,8978414965525275946,6727108410218613267,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,14369034991307163399,8599412795755542468,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,2699589179964156856,6554243928499836245,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,6075019807525875328,10514200072819500435,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,12745435960831166432,12060908518966347670,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,7242628006185697762,13742103157514088151,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,12331544020824529027,12085235842700043996,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,9977605756718169315,2847637385221356264,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5560,i,13280861088875741049,9520663259183694584,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4568,i,9664478530536085838,439452131621980499,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4576,i,9417079522759722014,87222972070013362,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3220,i,18251894611493686366,3387438907427898808,2097152 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,13902127331818701790,13318330733177657577,524288 --field-trial-handle=2028,i,18096626511536270375,11810966190372339898,262144 --variations-seed-version=20260726-030032.927000-production --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:1572
- C:\Users\Admin\Downloads\rust.exe
  "C:\Users\Admin\Downloads\rust.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2607de90f2293e5dc2145f6fcd437367df06b92c4cbd1178a397aeb171104cc7
MD5 79378c146f4914f6234384b7eac7b9c4
SHA1 c322f25f1eed4cacf423af69f92ef8925dd9a767
SHA512 244c38de19e19e6192d713fff9b9bdaeccc164f4339325c09055650b4d82894c3b77b392bcbc565f9d2c22ab1e325b03719962a3d6397b8271b54314cda6c45f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fe83299022692446e0b6f7c4d2a3c5a3572a3d863a508d0f9896e3604332e44a
MD5 6b857d35163f750a6f24e244075f1bb4
SHA1 75962cdaae87a94d7d97fe84dc05ec81c7cd7050
SHA512 aae4fe4d3fd1af9885483f8ef391349b2a192ffcd086cdb0f8e808f45aced486aaf12fbbc17c73cd881c3745b06ee7f62e457cc6cbb09c3d38cc33ffbaa5ee8b
TLSH
T1E7E02BBAC961EC2B19FE07A8A0554746E611135B2A81494B763C960C8FF0B3A5A4585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f8141f7297f4f8d0f4bf32435ff4d95b752e5a4d9c7933465c2957e0c8d7e96a
MD5 bbe9002fcb16cf328d49ec37aad992fb
SHA1 a0023613e449a0e29e6aa855fddb9f419d4cd88f
SHA512 ff29845fe139d884abc798e4ece14d74a7236284523e807e4aa1f49dbde8ee4dc112fe0033cda10763361cc892857c5505577a5ac2dd93dbc6c0bb19cab2be50
SSDEEP 96:PrBUflVdF8Iu7x0tnuxZkRah2asOA8T0i+h8jl4H6+0AND3wCwAGSkifJynQf+pt:zBUflVdF8H7x0tuxZkRah2TOAs0i08j9
TLSH
T1F4C14E8106FAFC99CB0E59373DDB7BD2BC717412A64F9ECA1080EDB0D3A67868950483
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 d9d45891f7928fe24fe4caacc295df23bb76170aaaecf13efd16c96f189c2aaf
MD5 fa333dd2232302284596a58aa2806e86
SHA1 dfe9a41b876c1aa0de10a2537ba3173e836fbe57
SHA512 b2ba69692d8f5a8df3690697741ce18cec0a2505a1f04cd590ab0f88582e3aec481d1e474d8964c367c4352121e30dc99cb0ea5a09b19056c8d102ef2aaffce2
SSDEEP 3:MsEllllkEthXllkl2zEkljZn:/M/xT02znl
TLSH
T15E4404047FC00C07C50014315411D3701370DC70051177C734D10473DDC55430F00144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 495f6073bd15749c1f5c20a48a96b4cea42671791ccbd8db011de3b3191b039e
MD5 f73ee15a2b4bd33e2f61eb974bef9b5a
SHA1 37b3ca08eea5711b333acdc6af6591159e8e643f
SHA512 eb2129658f8a1f59b19f93fd8bd484d34fa563121b698608b8cd6e2f73d58ae7bdcf3ca57a1aaddb507dfc926141d74d9610d05e09e2af9cd902196603bb4216
TLSH
T15DE0866BA4E9D16D505484A78A74731D8FD07805A6D83C43174D94547AC2919E7E0650
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 64KB
SHA256 f2eb3db3c8f523b5a5a05812d1eefb29c09d42d2f9cb253f220553dab5336a47
MD5 382ba9e2252ec5603f3d3eb3b208c684
SHA1 90c9090816ab38e82bda633e8caf6fd97b6ef8d9
SHA512 50e2add1b4c5a85021fed2ed2af435a14e601f6bb179c7840f56e883c5d47f614c7579de1cf0cd548ed84606379867ae93eebfcd304332990690e74ba877b882
SSDEEP 768:cQDgH1EtQ8EbGYG3wbMHTFcyC2Yt05pmEbGl13wwMHTFc8+G2YqgJ5gs:cgt+isqTFcyC2E0TPiwXTFc8l2Lgzg
TLSH
T1EC53E0799E3230C3C3690BB61B1B55B70F5443C7CC948A72344784BE8CA8673B6AB75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 8ccbd1c09d52d47c0997441abfd42f20e9248c09ea8a74cf769625ea50a49193
MD5 79b9bcff4eedac84985173df646e876d
SHA1 d9284e0037546613fd762da4b4b7a84bd39569aa
SHA512 af7fd75a189955d1a39909783a64f25c505a15a4bd83d6294439ac199adb51bc53860d06f391fe772514498d422425674a77d3e0dd6a4724523472b4e20b0f0c
SSDEEP 3:MsFl9tlGallhMTrkM/lRtkBTI1JzsHSGNll1P//CC/ll:/F3XGuwfkM/lRtkBCzUSGvv/CC/ll
TLSH
T10913926CAAC28B03CB06103479205BF177F2C9650A830BAE22E3A81CDAC9B1710CA14C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 ee099b64691fab58c5c19a72dde3768b4f1978be4677dae7b3c2d85956adb768
MD5 b6985433798e586992003455ab6cf2c3
SHA1 c7b93493e9fb3593ac4d567c4e3e17050f967c0f
SHA512 4fcd925b270c8d13c783a9f5ff117a92ed248a726c46c6a91ec9e721dccb642b2c70d4e9507cf1543f1be9787f523e23c33177470c97722a77df6b31ab9914f8
SSDEEP 12:U/LkM7CXW3PpzJW2aTX/6EvX8053PpzJW2rUoM3PpzJW2H8C:4WW3RVeTF8053RVPUoM3RVjb
TLSH
T1A344B11774900D47F805CBB27B322DA9FA3CD198E7831F5342541238F9A11AA8EC6544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
Size 1.0MB
SHA256 bfd09355bbe5b4d235e53b10246aa310c640f66acd89a861fb3712d74a2f71fc
MD5 e9998c537e151e55e50e3750d776529d
SHA1 b447cf7eb2ad674b22461ef132090ca19ee693c0
SHA512 88df9244f9bfd07b59682dcd4af634c5b13d2d29ff8a9c3a52b39aa881a8e5c9f69cde1af31c0b0da321693718efcfb6533e23f93befdd3e6922cb4c6f3f6d1e
SSDEEP 192:PmwzhGio4cjX/lrgj9AJ5HvW92uyFOdBRO73CGlm4:rGioBjX9sj9K5IiFO30rCGlm4
TLSH
T152259E3B39860DD8E636FAFC492D8C452DD666DB2177B76D8009FFAFB8884452040701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 9eec4aa976ec15ea9ad9a27e73a266dace71a4b39d84661b7e51d3f711eac574
MD5 2838a819a04eb755966d11429b8dd040
SHA1 dbf88d2abc66eab2d3e42b2bc859186592d1445e
SHA512 1dd479480d8a74287e84f57e09ce3de05e595ef270c81cf4815e169f2c2f0e9b2a7ef78cbd9267d53df352dfb19aff7a042def64e87bcfa2351635ba05307a7f
SSDEEP 96:I5HnA/uejzH+bF+UIYysX0fxQp977EHt/DfLcLq2piRk/E0GPlxr:QHA/tH+bF+UI3iWGV7WNkqp3X9
TLSH
T1C1F31C5F5F243711CDBE823668E745A7596CF03F872366C56C6208B4CEE2652B01C8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 10KB
SHA256 b10d2378376b5fb16f7da32fc78ddf5eaa05274ef8eeec88ee07c7780d2e302a
MD5 abe17bdeca300460f888a219c0f00776
SHA1 b0bdb7faffa9a71d4d9b126e229b1225b514901c
SHA512 17ad88fcf10eea66b0b20b49db6adf8c623939506b9001b6b3819998bb7f1cc4853c89910f0896bec1b391832240b390cc8fdb7db840a683aba3a313e4782046
SSDEEP 96:eE2nwejQjQ/GZtZZfsiADZXYAyKU3Q2mIAMuwnlOv3y/KEsKXl+CJF9o1uqNXTZE:pGjQtfuU3Rlnlyi/NMChWjv2O25
TLSH
T1A622207FD408847E477B8327928B391ECBBB297E184CF959D1C61D0C02AE26E1215A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 ee189d4ca4b5a22ee1da4a3d461dcaf617925ad650462cc209b9de4e7bc13136
MD5 1311681ff5530126d00ecd66ebfb7ecf
SHA1 65bd15461c0944eae76dbf9970cfdd06ca32770b
SHA512 9e10c6be305b09794dfdfb9097eed8b3b78a1f2fcd91366f18525681508c447e4d4fead62c1308cdd34824e8ce3147a07fbe3bd3d474a6a9f9600d71f0fde841
TLSH
T101E02069D8DDC55D1104C0174625735CCFF07D0BD6CD79411B0DB855F9C5408DBD0295
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 649edea40abd6c5bb7a69e583c8684827ddc728f2bb6c54a4ef8bed6724d16fb
MD5 c714e5430a56d93290bbc3a96043b778
SHA1 385dab656b79715a2ecdc732f0c52a61913d0da2
SHA512 9b3b0bc0f8b07b20cd04884c768b0ed90c8b77bef3d70d1dae0a657c3037b19d2466224dd53b3b32643aadcb71d448eb5ec21bd207f78abfbc3ea99d5f52802a
SSDEEP 192:DcHIcAO1S9IGYGv1WbtjryU5ufAVrDWrZGfYK4x:DcHIcAO1S9IP41Wbtjry8uf6rDWrZGfQ
TLSH
T185D16AB3C7E88B2DD95152F4AB143E1FCE391D2443183D2EC8D5AE4B97E2971E28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a8a0bf9e2fdb1e4c40645709bc943a8a03fbbbf419dca2428005660b7089ca79
MD5 5bce767c0dc7783cd53dedfada77fd43
SHA1 a57c356b2f7c41c25cc15548e952c71907c14ce0
SHA512 fb8d124ac3dd84dfbd0cb61c53c8a228c4123e0d0464339a659121545aaa93a1d9e2093ed97209f10eeca4c5b0173b3eef49b51ac4ff7badf1a07c09410beb45
TLSH
T1173168B7C7D8857D890156F5BB156E1FCE290D14532C3C5AC8D4EE0B53E18B1D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 16b4a6c6361ed69ff130ed988e1c7dfd4137d99f57651f672ee346867a113d9c
MD5 4730bb3a8ab1f9545af86741eb00d2c9
SHA1 e11e6d185d26724e61f4ff64f3573f4b3ae9ca7c
SHA512 943a3f4a850c9458cf6953acf688b0911410642b02d4836092627434c140f57bd6e4fc0d8e2d020bbd0c736ac91d638e227214087ccff31616997050361d760e
SSDEEP 192:eIEumQv8m1ccnvS68/VjztHFRtHMU///3SY:XpXqtHFRtHM8SY
TLSH
T17DF255FF17199704E59492B8D484198FFE2514680B95BDECE78109F3AEC72E3F068B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1c92524037049fe3dd883e5be10e8999e6666fc5574ffe5d67ecd0181cf4c5d1
MD5 d940483970ec3e843cb5a0e466d88d15
SHA1 cbf3f353226d022d6fda2cea010a35257ea7f57d
SHA512 bf5faacd8068c7e1c723479780c6ad847bb45192f35ba8ba39a42e43664e3a5931505e25d77924df4758611ff886bb593b6a9e9b144d484478b168c7599cfd13
TLSH
T14941BB63DA7EE49750780C6B1D45780A6A7AA43447C378F8DEAEC03CA091AF30B0B853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 283c56b20838b79071557350c637d151e2d17c3d1e3dd8a77cd909cf4afaa6e2
MD5 b852b868e59104117f42bb523b97bcaf
SHA1 5cc5b01a5270b1d625faada4424d2d00f13bb383
SHA512 1ad2a92740f33784b1c032c254ffa09980892f8fa5708157acb9a822bd701bd1da759fa3bcf74feec3334b57ca6629d94016ceec236501dded1acee95607503f
SSDEEP 192:JRGcHO3fUv72vAPRp2Qp9THsb+WNnuUO8a2/02mF0BVyIsnAUge:JRGcu3fQC6XDFw9c2c2mane
TLSH
T1C942B42FB920693B5CDBD229F9257B27D7F6103525D42E84E6FC892C14E76CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 299d9c02197f9368ee9a38d2355a7c0849707e1c0541737af200c33066a2aa6b
MD5 d0e35ae873c49a758a0ac6e612bef184
SHA1 5be3b57e3304b5b1a7ba2a67df38798b52ca27a6
SHA512 338f304f6d2a65eabaa157b71a7e436b891e55e0516bdf784cc828362b30629bf4605d0f7ec15663c360e4badaf0221d39067dac543402aebf91504ded9b4c2f
SSDEEP 192:JRHcHO3fgv7lPvAPRp2Qp9THsb+WN1FOuUOUSEb02mFtVQPyIsnAUgE:JRHcu3f816XDFw1O0Eo2mzVaE
TLSH
T1F142B66FB910693B9CDBD229F9257B17D7F6102225D42E84E6FC8A2C14E76CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ad82b686991f81c415fa1a743def0daa88dfe706be303450ea382523488bedef
MD5 4dfe3e2276d368ec3bd7241890e421db
SHA1 8249712ee2b44ec1259beb21209f3ed2f9bb4338
SHA512 167ab44e2119b0f20eff158aaa28144abee681195314b7bac3ccf827c840d24deb0820c8c7991073ed0daeffdc90ad26f4840ab5d2601f27639974fadd07fd36
SSDEEP 192:2RHcHOY+v7lPsAPRp2Qp9THsb+WN1FO/3dUSE302mFtV+VyIsnAUgraJ:2RHcuY61NXDFw1sfEk2mzV2e
TLSH
T10C42B62FB910693B5CEBD229F9657727D7F6103265D42E84E6FC8A2C14E76CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 88b38eba03751850a0dbee7d7a6f1cc76d49c4f7cd764ce0464d9b85daabe65b
MD5 c02c94c89e9de79da1e087fc308ad3da
SHA1 c276c239a10e06c7960da346e7379f104489abae
SHA512 644b30da6b226a8412e57c88641f3249a75482f2a649172f6b557c559b75acaf819af548f18a5bfa85568101ff00320c073150d52f161f558b8cc8c6929d3275
SSDEEP 192:2RHcHOl+v7lPsAPRp2Qp9THsb+WN1FO/3dUSE302mFtV+VyIsnAUgraJ:2RHcul61NXDFw1sfEk2mzV2e
TLSH
T12142B62FB910693B5CEBD229F9657727D7F6103265D42E84E6FC8A2C14E76CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 34bbed2ac1b9b01aeb4ae234cff8321079ef03449134d7c04d53a30385d20ae3
MD5 ff633d2b23d1cf657b9969801b775176
SHA1 2a9898e94e0df1c4b00400607cc14d589c7ebaaa
SHA512 663fcec8c9bd69cdda3ed5d23377de776bead4e5891dbb58a6c377152913f3d9bdc7b34235173139258b373e1e7e59a9d415105e4a6e0a891029fe1824379efa
SSDEEP 192:2RHoPOp+v7lPsAPRp2QhlO9THsb+WN1Fw8A1/3dUSnEo2s02mFtV+VyIsnAUgraJ:2RHoWp61NXwFw1e5fz2d2mzV2e
TLSH
T19C52A62FB910697B5CEBD219F9257727E7F6102266D42E80EAFC8A2C14D76CC361740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7d74296e560899c8d18e7dc80a0dfeed6be18529a34dee7b7d3a19219e23cf8a
MD5 a326747411ad52b9891c5f2ac5e3b091
SHA1 6201c09a9a7b000952e51023eaef71dd90a32278
SHA512 cfd63ee98c961185ac37e41693816170ecce7a6b3f09ee3f8acbedbe9f79ea0436b711cde38349bb9db55505f04241183457dd53ee655de87465031272327e74
SSDEEP 192:JRGcHO3fUv7lPvAPRp2Qp9THsb+WNnuUOJ3e602mF0BVyIsnAUge:JRGcu3fQ16XDFw9Qer2mane
TLSH
T11A42B56FB910693B5CDBD229F9257B27D7F2103525D42E84E6FC8A2C14E76CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 8609af186658ac6a0e2e7e414d8a285a903d9fa9f3b2d19bf9b33e5357e2c367
MD5 1f775c722ed0afa2bfcf74c4b6e1512e
SHA1 2674b559ad38609a2007949fdf65b1610abccdf4
SHA512 186f0bad19444576e22cc93586d967b3e205060c0084787c400bacf5a3a993417613b9f1e9ee888eec3d7cb497a9aa6ac5b97eecafc65257bb15850a96d4b316
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3BkHGHIB3Whm8GKoUE5:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHS
TLSH
T15E52E967688D963F0FD8DA8CDC267F4FADB1015666740C2493FA9C0803997CB125A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b340b3436fba1a1817591537a0991e35bf76350a16f9a6bf12756698f229bddc
MD5 a2f1f5c8ef8912c75331cbac163a84da
SHA1 62c39ef826d34aee791f7cd0936a96bbbf03b690
SHA512 fce4216578a63682961c3ea506cb597f56d8fc89a2426020b15623a72e9d932dfe75249ccc6397ebd41461799c490e1b03aff6a8b753d70363eda66bb89859a4
TLSH
T1AAD09723A0498EA0FBBB4B500A2314294710B8C490D8844EA40202364C2BA1B6393EC2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 2af0d8ad73146fca07caca3db4d7fde8a80981392eebf5d0d0ff43bb6d2e70ab
MD5 59194c09deca31041a79212a3c1167ac
SHA1 c20c0a1b732522c3cc38d89ca85748930835c0f3
SHA512 2950a8af40e3501dcb3a6e2ba792004d2e1c10aa185564a849a8499b4ac9aa0178ecdeab8047e8e192f5938303961382c6a60f2145d291c99232950c065f9827
TLSH
T130D09723E0568EA0FBBB07510A33145D4720BCC494C8844E9003223A083AA8BA3A2EC2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590cd7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe590cd7.TMP
Size 138B
SHA256 dc9ddfd556acb03cb13cd58f438656256af13cae0f1e1793756541bb46046609
MD5 289b66a53e78e72cc2d332a34a6cc81c
SHA1 7d2a3d6c9ccddfd11ca146792a1c19182383a831
SHA512 4a68e3b618a279b45a82d49943b02ecd9cdf3488dbc99ca71e5975950324d870c26a45f1b3af73eba2b0263576a84b410dee480e45d2ddf088864bd565032cde
TLSH
T1ECC08C63A0880A51972902400233041C83043CC85889848F601334352439E2B2346ED6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 15271ee066a9d8b5c0818cc88325ed9f48417184a915c68df4ae3f6eef1376b2
MD5 b54253c5fe1e102f5728b0b0d658a207
SHA1 636f4ee3a6bedd23b0fe12e8f9bf367c25db3bdf
SHA512 2719f0d1697c971fd231ca0787cbff452c006849116380723973ccb5fef56867ca96ee466de079a45002cfb620ede1846480a638361f1741e6f443a824428102
TLSH
T16AE02626A5E9D1BD109580934A30A30D8BE4B80AD2DC3C431F8CC84466C6808F7E1680
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13429589244304413

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13429589244304413
Size 3KB
SHA256 0d57c0c78dc943e1f7cabf588bcd0f3f0e48b81ed9e666cc73a18fdb783ad672
MD5 6efad63ac3912088721543727d324103
SHA1 3561ffc14dc648292341f4f982c5efc4134bbe90
SHA512 c3b45546c6372ab974bd2fa7a75f4734534419d4ce497b9e1b438f02b02b8d89dab74ebbc67e8c37116b0c64e0910c6673e071d8969f7397db61748603608d2e
TLSH
T1F1818B269AA8483ED37F443984B712F6BB76790035D2CE1B516162084C63743ABF4FDB
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 b405b5657afd2858e5b198140dc43864ea2af1b9e6e7898304d4219135d758f8
MD5 df5ed0e6c212574c8f66f3dee00a53b6
SHA1 0016190bb5b38c323ee67d737a0210a61719480a
SHA512 7e9b05d45cb442c16153ed7956144f4c41d20c2ccf5b10d22803a02fd94a2f0e49b85d5f6b2661fa999362f7a1b05918d837068ff4ec5946d1cbec25b5be8cf2
TLSH
T186B012983B209A2BC586087213E0C7C05704F41111D1A603D958DF930F056D83E528C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 c364fb9ae0d81774cbe78e6fdba13b93b48e55e35f69cd3364d4ba8af04d9d6d
MD5 8d8e61d8e53301b7eae7768c04e666d1
SHA1 3f97c528eeeed56bc97514bd92be375910140969
SHA512 7c9db446f96a4050f1affabc74da95883ea49225cd969d6c7953d5235cc950a1ece7f75180741d0042424d4ffbeb2f14db3131449c90aa88990c08115ab333a6
TLSH
T1B3E0203566CAC76F218540679624F30DC9E2B805D6DD35511F0CE0449386405F3D1340
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 5a1923627dfa082164146bda0a170b9a21008d8e2f6248ddf826b7e873190192
MD5 6b49b48312655eccdc7ad997e961f081
SHA1 08b67fd90e5a06b95121281055ca4a952bb93ea3
SHA512 df42c189e695bc74bccaaffeb1df3f771175e47bb47500a58fa1de49a2dcc5294dd6b91c8702f52d595d32b44548f8ab20a7ff71d297b16f289d229d36a736bf
TLSH
T1ECB0121140000952C55042F11061227133323A0C5622230911DE8450AB5F2D52444604
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598b1f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe598b1f.TMP
Size 72B
SHA256 2bb2d17118e168e446d3024512bc22b18b025ef5fcc3c46bc37c883432aee533
MD5 9c610186759fdb8d441ea0f7d7035f6b
SHA1 9ca196de9e956ede2b879a5f77fffeb1a384eb06
SHA512 1f700fcfd1fe6056132a791a5350ed9451c9b30e8bb226f7a5ce69f3b1e37840aa6c222144e8f9b43c93d2c6bf40f5e82c34525336f29b11703aaaaef80db494
TLSH
T19EA0022452404111C5115A70A0E1128172B3D95CB566060385A714A9EC693804543900
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59b0d8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe59b0d8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 01679ab15186e94960336995f4437279969e6cbce8954d23035e7f4bec5c86c7
MD5 abc3af2e0ddebd13316b71d34ce60f1f
SHA1 2549119133a7a50536559c671048cc3fb8c09b7d
SHA512 7624202c0dd7d3470db41d8667fe157c4ce0693678e5ed651e035fbbb692d6a0f7a571bc3c0f7ece2ef845a81b73b46103b787b042f6626ae0da65d22637ad2d
TLSH
T1D2E02676A5C9C2BD1044C04B4A71B71C8BF0BC05A3CA35868B0C5444BA82208E3F0280
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 9334586bf88b4248f64bda6ea7e536ae199c2df1718c93818f61f0d8409d22ff
MD5 f8159b5ebc7f7703bf66a78f54634902
SHA1 477073b41f0545b636e25b286fffa98089871f2c
SHA512 fa2ef6760f3c7d049757b25c8bc4129cf9329922c6dc05138176dd49f89ec19595252a2bfa9d36bdf95feb5c8959e48a43d79f81605db43468bbeacecd2a0e94
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBiLULYLQVLJLyLDn:f7doKsKuKZKlZNmu46yjUk3
TLSH
T1B203308F966850F3C0B6C13EEEC255D5FC78221C97136EC519E903796D9C037A0259E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 7cca3913728c89d31328680c0c71fe3ac34b66d686e46a86cec82bec877d0d83
MD5 e2a7280d720e809af6e852b3dd62433c
SHA1 deb74fa1ac01ab5ebf5c3f6178f27fa266a3a0c5
SHA512 d0b64241c43f7e37da20906af825cc6dfc78b3dd76ea182588a0d550919190095d5f461771d388b294984a1ffa9adec84491507d40d413ee9f253b4937b49aa8
SSDEEP 6:2qVkwYjwnLMr3uYRKyCc/mLEJOgLEJLxP:2qVkwLnLMFKimLULI5
TLSH
T1A9028C8BE444A412E927807C868A79C829260DB83E836A862AD0052D386C6138029ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 27KB
SHA256 acaf5e4b4fe15e4f5a00c9c14cd3d665cf0e4801d66b87b7215d700bd3a27063
MD5 a04189c8efcefc80a27c65d86bc9107a
SHA1 a45d747416a68d6841aa8304d9c1c38f5bf179f4
SHA512 fab2be03942deb8b62e15dfe2f46aeca2cc1e8de4a63a8653041eaaef6430214ea793a6f28a80f27397a3c4e042cd86cd97158126d6a5189f0e692268fce1303
SSDEEP 384:HWXNsdGlhu9+8sdGOAQ2IIIBb5MIMIB5BwJsdG4uEJgsdGRdGlsnCEoo4sdGRdGr:ChzAQ758AC
TLSH
T1C7C2D89693701B85ECCFD7FBBC658C2E0772EC8D45592003A49676BA3C33D3A598139A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 c6ef5c8d0f9b03afb94687f3f670faf8ff0a24c93ce0995c82d2556e9b2bce64
MD5 66ad92de421070f589145c8be47ff466
SHA1 19b83076e03e1a9a6756c1d5ad336c064160c0d2
SHA512 b7dd6e268495c968b6ff2bd830ff99493017a68219cb8c575b93ee36f23cbd12ee9606b4cbea1102e18e2c636877158babd208423fbd982cab6d55cb66b11ef3
TLSH
T13AE026B5FEECC1BEB01480070D30A38CCBC13C03EBE8248A0F08C08C96C2004E7E8280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 1aa7fe4d05bd0240c151de48140b5c72b89c9aa637ed1fa38ca8fc6fc9d14d5a
MD5 d83bc8776be7360b951ce0790837ddaa
SHA1 ed309036d62355f82f4418b983c2abe588eac2c6
SHA512 bc028f242749b3ea6fdebaa1c9d916e4bdc051020fe14f79f7768e5710d56b2f275c6fea210de1c6cf2489446de1296ab0cab7025b330ff203d61462f7cc67a1
TLSH
T19021285AF731C244C10A433A647E9B251334D8129FF8FD0F55BA24692EB2E540E472E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 b480da4f5b814b5dc9cd5f5baaf9812c1ae6e732c0e0e8998899cad8fed084ac
MD5 a16c1d7a21fdcc949f6fc95c7ab0f696
SHA1 c2cebd926c0064f4c7556dc717dcb5fbd5370706
SHA512 6050c9c2edd440140ccb190e347ec3f942e93a89a5224d38c568c1d169c8b6d308f647245a5d9b61d3663ff84c62d35d97a04142a63a1fecf5f97c15b8a2857c
TLSH
T17AE0262AFCC8C1AF80D080A30964A34C8AD03C02EAD83E820F0CC8489AC2009F7E5641
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9c2ffeae4c6c2036866b3f6099a318b33a098457f1bfd454058cabffb60debd3
MD5 4b5153a28f46222aa5bf1552a8e5e555
SHA1 c4bab64aa8796a7e2e0d274ad13ed5413b124f7e
SHA512 16cc6cf203c064588c632bb8df35571badb0b650b9468e2e556a9a1115a6444cb0e88999c81cecda5b8ce65f7a93fa5b4d6316c270e84589ecffca4be7e93339
SSDEEP 3:MsEllllkEthXllkl2zEklkb:/M/xT02znk
TLSH
T1C74404047FC01D0DC50430304011D7501370D4100711574774D10417DDC55410C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a1d196b092e89c3f010f493c67fad1232219104d26125d9c4742ade76f2524d4
MD5 9f95742714bdf0fd41cb5c3d91ce8ebd
SHA1 bef0e10315a5194994b6379bd2c581f1e7b13b7a
SHA512 f5b47a9e0a105f24251a43a11d9ff5e0456ad62393f780575a7bbc2fef987422fbb0e1f7cd18d761bdf9ac86872d7a69a218bdb275fd7f36db7e8d47a725070e
SSDEEP 6144:O3HtTsBXhZexAtClnkhqq1YQm7Rkm1tYpBeh2BAo9:2HpsBx8qtClnu1Yj9oBGcAo9
TLSH
T12434122A5DA9BE3F4D39612DB0CE4D6A3FB14F72C9188DB188C55704B66B6CC0E44EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b6b7404fd183b969861fca7c37f18de7a4dcec6d866a34a7fc6a9261751b257e
MD5 b9457760544323af4f2875a8596aeed8
SHA1 4f1856fdb9ca4fada7325187b89262c5738cca86
SHA512 cb548c0b7e34e8bce26ce0c550e592b069279698ef71662a9bf24c2872315bdfa6f00f922bbd3e322757d4eb77b00f5da8fc8153443ae421ad390dbe0a954485
SSDEEP 6144:/wHtTsBXhZexAtClnkhqq1YQm7Rkm1tYpBeh2BAo9:IHpsBx8qtClnu1Yj9oBGcAo9
TLSH
T1613412265DA9BE3F4D39612DB0CE4D6A3FB14F72C9188DB188C55704B66B6CC0E44EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 83a356b0b48b4c77719e897ea26ca85c37b448df984256447dee3003d1c7af74
MD5 1ff24cb32c1b48e6f5d307b17b1154e9
SHA1 6cd81975065e2f216651d40ad90bea74e3ddfc8a
SHA512 18ff220a6ebc0719a935fa328f5b156b758315e66ae35f7d274bf154602f9f671b881d545120b90e4b090772589a5ab53b86a500b436301ab90039b35d2e2dc8
SSDEEP 3072:FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Mm7Rkm1tYpBeh2BAom
TLSH
T1C2C3123B5E70E97759B9A74EB08E0B1F1EF14AA2C930DA82C8D85A0437F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 05c893c8d193f32045d4ef080f914440b32ccdec427f4f8030f7f016a3eee5fa
MD5 aa9c6de479a54e240f53f8d37d8f493e
SHA1 01801c9146b743cc2b30e23a8e5cd230543a049e
SHA512 c13c8a6796e96d205379d37127a497060371af4b664a621e3e7240822d177663946c3b541e93e0d4e2fd53a98b520efbe53a5a97acddc9e02437afe66a7b9fc5
SSDEEP 3072:b3SWSAdfL/sBXJzp+cZQBEGAXQuVsllRkPwYnnnqFvg1YBIuUNr:b3HtTsBXhZexAtClnkhqq1Y+
TLSH
T1F5C312A55CAD7E2F5E3A002DF0D69CA5BB644F7686880CB09C870709A42B6D84F45AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 1ba4ddfc6212da76ae7b40cda923543dbe8e368e52bf18770e06aec2541b44b6
MD5 51081989996e51bb09edd4681b929fee
SHA1 09eb5035e11f7bb21a26abcd393cc16d3515d1a3
SHA512 a96e953104185dacd8b29aff5ed13eb2f2710ce4eb52c09e05eacbe121ca7a86ee8f82a5572c4d4576df68055b4e51b000dc6bca795e40f4cf99ac70f9a0c9f4
SSDEEP 3072:03SWSAdfL/sBXJzp+cZQBEGAXQuVsllRkPwYnnnqFvg1YBIuUNr:03HtTsBXhZexAtClnkhqq1Y+
TLSH
T17BC312A55CAD7E2F5A3A002DF0D69CA5BB644F7686880DB09C870709A42B6C84F45AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 12990482e60a7706d2e1442338bddd4f17ac5426095999bf8b2e866823267859
MD5 98c4c18b21ecc87f4f94f71eed7034d4
SHA1 847f2bd10f33b653f77bcb9ff2bae772a3d442f7
SHA512 986f62d43a81036990ad5d4bd3a36ebec2d6a051b85f2041bb196e55f5c55cdc527eddc97f412ee1fcfc51e128c5487d7618820f41b4e088d8098b863a4686d3
SSDEEP 6144:73HtTsBXhZexAtClnkhqq1YQm7Rkm1tYpBeh2BAo9:rHpsBx8qtClnu1Yj9oBGcAo9
TLSH
T13B34122A5DA9BE3F4D39612DB0CE4D6A3FB14F72C9188DB188C55704B66B6CC0E44EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 738edca67c88a84c2e572378332ac32cd2d93a57f6db4c4860b18651149a7ad0
MD5 ec948c64201b61d13a1b4beec4621688
SHA1 5c226c4faa8dad51289d2f3b0bf7482f76da1f79
SHA512 41491be8b1e33f481f06cd586c54172bc5842bc85226dc0b665f52948f16898bfa99a8d6c98950159ff39886c3c212791fcd204ad484e53d73bd415151076239
SSDEEP 3:MsEllllkEthXllkl2zEklKPGy:/M/xT02znKPG
TLSH
T16F4404057FD00C05C51010705011D3501370D5700511574F34D10413DDD5D410D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 2e7585c2523b73354b0282f9630cc73a3c575d735df4e8c734cd3b8a900a5b15
MD5 8d0d2d0affec32e78f2daa4ca6cda804
SHA1 595167d7adbf3cc281607532eedc1706c3d57134
SHA512 88be998a51a50f3e7b7158137b1f3fcede996af53aed9890c328c53137b33e750430e99a4d7fb6533a76d83f96a712849115f810468a63a58c1434a7f59c7804
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0J8:TkkhCU2QB2zbBxxJJ8kEOM
TLSH
T1CC23EE4E171831D9D196183EFED34DA17CBD0F68872B69D209E008764CD149EA12E0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4316_23485171\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

c36041c0-de93-4276-a631-f2aa7e4fabd1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4316_23485171\c36041c0-de93-4276-a631-f2aa7e4fabd1.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 248478.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 248478.crdownload
Size 3.4MB
SHA256 c595218aeb6359a1efd4e5c57124d60b0f3c6da777c641fa60386641f9f2d2bf
MD5 7c522e9436bab58b7c102b1b1f37f89a
SHA1 6c700bb2e7012e10c6edcecce1d126e0fc7aa3f2
SHA512 5870b1692ae64c316e0b0c3d4f49fc5a503b08260ce663022d71eb5e74be769093ff4363914d81aa42dd2382939960a508d5ad223e8d8c6524fcdf168165f82a
SSDEEP 98304:CJmDtaMmVCSIcyhmZKCsBOQg7qMUNTBhKqWU4Y:CGaMjFhoKCsG2NTB8qIY
TLSH
T15FF533DE824E62E1D0D30D3A21BB31442DDABA49AF93AAC4D52C65D68857FD20377FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-1489-0x00000000008F0000-0x0000000001545000-memory.dmp

Download

memory/2112-1488-0x00000000008F0000-0x0000000001545000-memory.dmp

Download

memory/2228-1359-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1369-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1123-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1269-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-830-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1360-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-2-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1330-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-32-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1472-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-0-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1091-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download

memory/2228-1145-0x0000000000B80000-0x00000000017D5000-memory.dmp

Download