0f976a71b1863f5ce5f26218bdb0e7f58e3b0fb41043ff54387d95290eb4d06f

Analysis

user interaction
yes
max time kernel
265s
max time network
267s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
pasters.club.exe
Size 1.7MB
Sample260804-pxnhrabb35
SHA256 0f976a71b1863f5ce5f26218bdb0e7f58e3b0fb41043ff54387d95290eb4d06f
MD5 fac641ecd0523047d0aad59a69de7100
SHA1 76f587fe17341147da0a90fb844f078003d5b8a7
SHA512 dac211a67157a63fc11618633d10af2f2f6d9c9d3a684f2f11e9bc9f77b31b0701d3a10074a757eb477b584ef4e60f5c0ae930fe5d7d5a8219ba52be50a2390b
SSDEEP 49152:g5cUAiE80VWYYz0bo18jRbLJvz6pnAyAi:2ksALJe
TLSH
T117858E46B3B400E8C1ABD138C656A61FEB71344903309BEB67E08A556F63BE15F7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	api.gofile.io
47	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303210470555856"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe
Token: SeShutdownPrivilege	5148	chrome.exe
Token: SeCreatePagefilePrivilege	5148	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe
5148	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3292	LogonUI.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 2964	5148	chrome.exe	95
PID 5148 wrote to memory of 3176	5148	chrome.exe	96
PID 5148 wrote to memory of 3512	5148	chrome.exe	97
PID 5148 wrote to memory of 3176	5148	chrome.exe	96
PID 5148 wrote to memory of 6040	5148	chrome.exe	99
PID 5148 wrote to memory of 6040	5148	chrome.exe	99
PID 5148 wrote to memory of 5228	5148	chrome.exe	100
PID 5148 wrote to memory of 3368	5148	chrome.exe	101
PID 5148 wrote to memory of 5228	5148	chrome.exe	100
PID 5148 wrote to memory of 3368	5148	chrome.exe	101
PID 5148 wrote to memory of 1788	5148	chrome.exe	102
PID 5148 wrote to memory of 1788	5148	chrome.exe	102
PID 5148 wrote to memory of 4084	5148	chrome.exe	103
PID 5148 wrote to memory of 4084	5148	chrome.exe	103
PID 5148 wrote to memory of 440	5148	chrome.exe	104
PID 5148 wrote to memory of 704	5148	chrome.exe	105
PID 5148 wrote to memory of 468	5148	chrome.exe	106
PID 5148 wrote to memory of 704	5148	chrome.exe	105
PID 5148 wrote to memory of 468	5148	chrome.exe	106
PID 5148 wrote to memory of 3968	5148	chrome.exe	107
PID 5148 wrote to memory of 3968	5148	chrome.exe	107
PID 5148 wrote to memory of 3140	5148	chrome.exe	108
PID 5148 wrote to memory of 3140	5148	chrome.exe	108
PID 5148 wrote to memory of 5316	5148	chrome.exe	109
PID 5148 wrote to memory of 5316	5148	chrome.exe	109
PID 5148 wrote to memory of 780	5148	chrome.exe	110
PID 5148 wrote to memory of 780	5148	chrome.exe	110
PID 5148 wrote to memory of 4560	5148	chrome.exe	111
PID 5148 wrote to memory of 4560	5148	chrome.exe	111
PID 5148 wrote to memory of 3380	5148	chrome.exe	112
PID 5148 wrote to memory of 3380	5148	chrome.exe	112
PID 5148 wrote to memory of 1328	5148	chrome.exe	114
PID 5148 wrote to memory of 1328	5148	chrome.exe	114
PID 5148 wrote to memory of 1840	5148	chrome.exe	116
PID 5148 wrote to memory of 1840	5148	chrome.exe	116
PID 5148 wrote to memory of 5064	5148	chrome.exe	117
PID 5148 wrote to memory of 5064	5148	chrome.exe	117
PID 5148 wrote to memory of 5172	5148	chrome.exe	118
PID 5148 wrote to memory of 1208	5148	chrome.exe	119
PID 5148 wrote to memory of 5172	5148	chrome.exe	118
PID 5148 wrote to memory of 1208	5148	chrome.exe	119
PID 5148 wrote to memory of 1600	5148	chrome.exe	120
PID 5148 wrote to memory of 1600	5148	chrome.exe	120
PID 5148 wrote to memory of 3136	5148	chrome.exe	121
PID 5148 wrote to memory of 3136	5148	chrome.exe	121
PID 5148 wrote to memory of 4384	5148	chrome.exe	122
PID 5148 wrote to memory of 3664	5148	chrome.exe	123
PID 5148 wrote to memory of 4764	5148	chrome.exe	124
PID 5148 wrote to memory of 5124	5148	chrome.exe	125
PID 5148 wrote to memory of 5124	5148	chrome.exe	125
PID 5148 wrote to memory of 4600	5148	chrome.exe	126
PID 5148 wrote to memory of 4600	5148	chrome.exe	126
PID 5148 wrote to memory of 2560	5148	chrome.exe	127
PID 5148 wrote to memory of 2560	5148	chrome.exe	127
PID 5148 wrote to memory of 5264	5148	chrome.exe	128
PID 5148 wrote to memory of 5264	5148	chrome.exe	128
PID 5148 wrote to memory of 5152	5148	chrome.exe	129
PID 5148 wrote to memory of 1664	5148	chrome.exe	130
PID 5148 wrote to memory of 1980	5148	chrome.exe	137
PID 5148 wrote to memory of 440	5148	chrome.exe	140
PID 5148 wrote to memory of 440	5148	chrome.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\pasters.club.exe
"C:\Users\Admin\AppData\Local\Temp\pasters.club.exe"
1⤵
PID:440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff85f46c728,0x7ff85f46c734,0x7ff85f46c740
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,2926110922402339487,9584376983613752375,262144 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,10188507165969530255,16307579959045529205,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,7242779419160074647,2485988677587019686,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,690905536190688124,16393019719625788571,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,5724598615211559586,16777069931105296402,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4720,i,7776772249576333451,3406989040934952651,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,11173895928250938091,9143342335073843417,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,16345183938404018342,359931980378757707,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,17512498296685784177,11653858634580634216,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5504,i,1231404320194639703,1920415372824724403,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5860,i,11811792665133947902,14308628849814910652,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5944,i,2595872160670086521,1661046769739159219,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6132,i,12310397587061167139,7136975209994545168,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,8122353158363265608,2737744735442816834,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6392,i,9153401926967698094,2772956220829287386,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6220,i,12124801863465857484,15029159881743723857,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5620,i,7777103600413764501,5887845098689150265,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,7166955840451402809,9708398402604050260,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,17375946653758530680,7767896519816502197,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6596,i,4240054948950747320,5932709632414471011,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6892,i,15565829512278625016,6123764084318060126,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:9
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6860,i,17227523277500468815,6348300544631767581,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5620,i,1073115918736107626,16023334239052242828,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,10612094806166257125,8063870418277840541,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,6647842011274467480,8663463113097718744,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,15590058005788861286,12787363835397402916,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=1248,i,18277001345459365721,4288061581562406613,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6128,i,6310489866413477127,333622980182557572,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6476,i,17599624673967293452,15289345144153991864,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5648,i,15910393669583451344,15928817614200887359,2097152 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,7291332520853952812,10022787113170067451,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4460,i,9935083339044144992,14790091760271160519,262144 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,1624174703395126662,18180309205559905993,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,9987739906738494889,1950912010147773652,524288 --field-trial-handle=1900,i,15088989291187241889,1032283117601210619,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5144

C:\Users\Admin\Downloads\Pasters\release\pasters.club.exe
"C:\Users\Admin\Downloads\Pasters\release\pasters.club.exe"
1⤵
PID:4732

C:\Users\Admin\Downloads\Pasters\release\pasters.club.exe
"C:\Users\Admin\Downloads\Pasters\release\pasters.club.exe"
1⤵
PID:1968

C:\Users\Admin\Downloads\Pasters (1)\release\pasters.club.exe
"C:\Users\Admin\Downloads\Pasters (1)\release\pasters.club.exe"
1⤵
PID:5760

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 9b70fbe72f2886ecc3aae6f373608fd513f7a9c21b35d9a4f3f7faa8cf6d4205
MD5 1034234231f4b8f09d84de3d2572bb72
SHA1 3eb36ba0837f284af58c79e7b054a0ab05a8109d
SHA512 573d8c256c19f19c25777f6b620ffe7efdb538946d0f410df4ce7e56bd537c198c3147b8586e84b302960104c93a6aa9b5b596d7e9cc6b187d9985da263a7926
TLSH
T15D0197A1D8A69281CF1BAF3BD2F46AA03F3BB310013B4CC244D145F5943AB602C8371A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 ce080221ff8f83f4ac5a35505ca2951f5855c9ae97471f8d778ce40d464c498d
MD5 cbabe5f2cc7717fb5ff4e5d3a7d5ce39
SHA1 914548da54103f03dfd5e83452be40d987696f14
SHA512 67290ce6491281366a50ee6215f928777be55db4e79130472fd26550e4433beec7fd0c745b386742780cd07110388a969f49fba90a937f9b8d8147402a4cf902
TLSH
T1A7015C51D4A59296CF175F37D2F479A43F377310013B4CD254C281F5943A7502446319
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f398a18ec433e7e819d7beb3877bffd5060ef63cc75e3ee0022f3fbde9e44cb4
MD5 e35abfa9ad2fdca667aa5cb08e5cb375
SHA1 465f78c226f5f49759e0c456b94f8a652960bcb2
SHA512 75134eb649b774de58d0bb67e4f1567f27caacb251e345f6904fb4f4ebd1b6abe7b575bdfbeff8a657f0cf83c6fa7082e3687c93f25430dd5644798d882b4d89
TLSH
T1988189F7C3D9866DC82552F49B11BE2FCE2D0928432C3C26C9D4AE4B53E2972D25078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 061b76929d47f25692edf0d94e259bd0e6266ceeba6fa3c9df8ad06f796031e7
MD5 218200fc09f90a40db37a55228f18578
SHA1 632e5de5fc6b8c26937ebeded9412e138b39d72d
SHA512 cd48d5f9bf97d2b378385e7141b5d45112a9fd3c652c3f4672c09756449f0e75cd66dd04401b04d56b9736374d6653c8435324856c0e88595e52f6233b5b6d57
TLSH
T15E8189F3C3D8866D881556F49B11AE2FCE2E0918432C3D26C9D5AF5B53E2972D25078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1021B
SHA256 b13466492e4033ba548bfe4b5e0b84a69ab644f6ffca1adfd163fb49c2285414
MD5 fbce796ba7a7ed0f4eaa58e03a7ba626
SHA1 c851e6018a46dafca5a572e3e430fb955cf845ff
SHA512 cfafbfcec1c44144d07b4ed7937cfaf97117b3ad33f1473be8e4c3c6e940a9f3737cc241c1d244d82d7de2b5c505dc962fce200d7f6b8acee131b7a01b082349
TLSH
T12F11CE9797BEF49F50689C6B1D197C067CBAF832058168F0EB97826DA0815F31B16493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ca9c27e13abfa9dee5bdd43e4ca28d31f8edc3ea46429596a890e5075ac06382
MD5 1d563209dfa5ca3407315336b8e8e30b
SHA1 4e3be4c53562bedc8de2ed44ff0ca31266994cf7
SHA512 cdd172cc32169c8390dbfe1c09ceab1122eaea9fb5553267ed65ade5c5060f96d253a124305c98ec99fe9461d0c34f67a7bbf37c84aeb50223f4d5dc7c1fb2ef
SSDEEP 192:7RtRb4udv7sAPRp2X964Hsb+WNnfk0Z8e8CZVyIsnAUge:7RtpDdBXUbws0//e
TLSH
T11B32B63DB964797B6CCBC219FA657B53D7F6102221942E80EBFC9A2C11E7ACC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b7d96a53019dc7b5acc49676d932fdcce9c4bd21445e31a9de590c45255bb82b
MD5 062817bb8553cf85a40c2b7ed9be0459
SHA1 c0adab01d96a1358f318949e6ff102f2134837f4
SHA512 fd3695724d229182a09606f4da06e901239f016aaa894d473be45f61e8d84de45ab1cc6120cc6f2975d7493d3c466d87371acb22a237438ce3a63f1a8ca0c719
SSDEEP 192:lRtRb4fOv7vPPRpf1l+964Hsb+WNn5nYUzew8e8QZVyIsnAUgE:lRtp6qTXObwJDe+/E
TLSH
T16E42B73DA954697B6CCBC219F9657F53E7F6102221A02E84FBFC9A2C11E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 776f742bc618a3036237f08e8816382dc32f24c35388f91cae807394d1ed0f0b
MD5 1c0d027cca2ffbd1d7374ffbbb1274f7
SHA1 ff75e50515da9d10016dc70d03453dde2d9bbfa6
SHA512 1629705e2224c270557f4be9eb655ff15d09dcbf3635e925391504da8200351e2a940ddbb1b1e4662c42bd91cc9f551d38c4712b8459177dee07ea8b9a2c40e3
SSDEEP 192:lRtRb4fTv7vPPRpf1l+964Hsb+WNn5nYUzew8e8QZVyIsnAUgE:lRtp6rTXObwJDe+/E
TLSH
T10042B83DA954697B6CC7C219F9657F57E7F6102221A02E84FBFC992C11E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4d164f7d62653798343542a2138561d5a95459b69f115fe1cd474b3ca6b5518c
MD5 db33acae8adcbdb66d030c80bafd8f02
SHA1 5b5e1641487ad4ca9c7581fdcd4c0fef945d90a6
SHA512 624f7bf7a8c147af3153191832e47e6e3f6bf4852c618cafc345e3610471eed9e70c779b9aff49782da35c655ee0ad637383d578843a76c4eba1cd70078793af
SSDEEP 192:lRtJb4pdv7vPPRpf1lThc964Hsb+WNn5nYUzQS4eL8e8QZVyIsnAUgE:lRtx0dTXDmbwJD2e5/E
TLSH
T10D42C73EA9646A7B5CCBC219F9657F57E7F6102221902E80FBFC992C10E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9378859a80a34ade9214cfdfef1db92b150bc02aa7a247f534d4263577951428
MD5 09932a2ad19765a5c72f99d8f578b259
SHA1 76b20268a1fd85bd67ee4ec6979501897f50253b
SHA512 c81727580072bccc2b4894b5581ae88865b60d5b4a8eb7b709cc34f8898ec4aa6075dc8f9a478da4e4b3e6d43cfd79b604d9c760669051c072c53bf018449814
SSDEEP 192:lRtRb4pdv7vPPRpf1lThc964Hsb+WNn5nYUzQqo2b8e8QZVyIsnAUgE:lRtp0dTXDmbwJD+2J/E
TLSH
T1B542B73EB9646A775CCBC219F9657F57E7F6102261A02E80EBFC992C10E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4a5461a0e3d704d2687a6cce3db0d7f36f9b63e267a463e474e379739fc77904
MD5 040408e488f49746e751388300e5e573
SHA1 8af6dbdfb4e0365ab82416bd679e26de5dfc74e6
SHA512 8de7319a8a5490fbcc8a6eff1f1b7c2f9bbca1534bf5aecfaa18b04c6822a0772582feaaa578c2aae1347ec46ffa2b72080cc0ccac790f9556c49c1cf60660c4
SSDEEP 192:7RtRb4hmv7sAPRp21l+964Hsb+WNnfk3UT2F8e8GZVyIsnAUgE:7RtpoSBX9bwsM2n/E
TLSH
T16B42C83DB954797B6CCBD219FA617B53E7F6102221942E80EBFC9A2C11E7ACC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2259ec9395ab34eb030c4fc2fbeb0cea404ed17438ea01b4d9809a9d85782e78
MD5 134cefcf87c1bcbba419415836480674
SHA1 801af7a9168dd6c5a5a8da7b442bf5d52be58097
SHA512 3e7134bc27549de1b961caaec342ed8d96c7fb5aaf2d848a56babfa3810faec9f83bf0f3a5b73125e5e0e05058ee66a4ee89345d273a08e6beb9ddbc5c7563c2
SSDEEP 192:7RtRb4hHv7sAPRp21l+964Hsb+WNnfk3UT2E8e8CZVyIsnAUge:7RtpoPBX9bwsM2E/e
TLSH
T12342B73DBA64797B5CCBC219FA657B53D7F6102221942E80EBFC992C11E7ACC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fa1a4fee1a2f01f96a0ed762169f677b95957521436e0f9d1ede1f41133f3e72
MD5 22ce1705cb24ba3dd9fd28532eb70828
SHA1 744f38eb8089e91aab47b0c99accf7a6dc31dec2
SHA512 85e6c0567e296ab7f67f89832f95f67cecbcbef3cab8904ce511948ce2e8516dd982fad8303d927c502d96941a002d794cad52fab410fe5963b82c08e550583a
SSDEEP 192:lRtRb4lNv7vPPRpf1l+964Hsb+WNn5nYUzew8e8QZVyIsnAUgE:lRtpgtTXObwJDe+/E
TLSH
T1C942B83DA954697B6CCBC219F9657F57E7F6102221A02E84FBFC9A2C11E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 b59be5fd49fd0b234e92ded53bea0589bafc67decc5716224e031c8df34e0822
MD5 b4677a2028787c2fcf1f27a08621c20c
SHA1 acf3e3b7b0c47a3ea06897002baf855f09abcede
SHA512 37b0220ea7362ff8451729b0f1a47d55b33b085474f659b3489eb8157099ed55bcf5c6b9f5477cdfcc86058d53c036012d4734bf064a87ea1a144853cc307d04
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3McHGj7Rq3KS:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAON3
TLSH
T1BD520967648D9A3F0FD8DA8CD8237F4FADF5015665680D2497FA9C0803E5BCA114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 61770afb605790557006914e803d6aa1898740f2723a4b0d5fb6e34118d82b56
MD5 1bf62a2f7d5b88e16a275348a4331a1b
SHA1 3f77fd4f756d24986e6b30a62aa8e78d87f4250d
SHA512 e81cb272591183eadcf45a224bcc0a592209cb79973f07ccd02672de4d6fc2437d5572760fcad178efde3beca624b30fb7f1730642b2538064f6ddaae0173de0
TLSH
T10DA0025286C44921CD1043F8A0660646A77248145951570758B10948897F1D86211100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1d3c6bca544e446c9cb9a1412589edbf4914d101b9c120cec56b70573527f0a9
MD5 4d4885355d7452781e4e225a3b165c4d
SHA1 f375e72d1cddb5ea5d22ab95df984f6a65f04fb2
SHA512 e243e80159895e0e4943a3c4cfdba25490d7fc40a3625e98dd9dcaed675153b0a171b4f6990a14b880805d710c41e3767736e83a03b5465425d1e87d1a74f89c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5d088e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5d088e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 34edc572fd3cafc17c15f9ace48428202dfc7034b41a69a24af78b4f6dbec8ec
MD5 79962624352b760482af2ecb4c6847af
SHA1 b5ac5a036ba8b900f38ad8f803e448b1303e2e13
SHA512 f55c65a1f6f3607045f4833d05148fb51f400877e1947ca188d1b33ec19122bfad50fcb42e5cc093d55a5802dca7e1703d7a508957dd01995fff9c60bcf2e891
SSDEEP 3072:xNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72n:qOlsPQCfjiXVzoJHg6JOMxheoPI
TLSH
T106C302769D241DBF5D34A90A71058E47FEC4C88EAB4E7EA087C53B9A131F0D4AF4361A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 bed809dda55886ed4880c09b2fcbf7f4d255d20a039077a195275ad12d46b17c
MD5 e63e95a5d5ed62c5428931477084bcfc
SHA1 5ae10df791c5c52bec089006467ea3b344097857
SHA512 af715b98d253a525a1d1f0821d84bb5550894ea78f65d58747e8972a5cf73d3f3b9187813857e0fcaefbd42981f20ee00023fa7b8a959682044f1d4994ac7600
SSDEEP 3072:DNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72n:EOlsPQCfjiXVzoJHg6JOMxheoPI
TLSH
T16AC312A5CD241D7F5C74AA1A71098E47FBC0889DB78E6EE083C62699231F0D4AF4331E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a5f89de3074bdbee79ff61ba2a03ecbe9259f0c6ebaa61b0ac8593f18781eaf2
MD5 06b7f6af2a8f07c3019958b9ba214a38
SHA1 eb1301f29a2ca4b11e1657a34f42dab54f2affd0
SHA512 0105e1e8115b469a51b64adf2a5f0bdef9f4e476e3a18fde983fcc85594ba1d86b0f2ced1cda03dd4387ff3d18bc0ed12b79a26975ddc59aa66bee8ed3a36e14
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok59NCDGB6/dGyv95S5hbb2Jv4a:gC0LA/TE57cDUD9SWUweS5hbKl
TLSH
T1ACA1F871B8A95EB75D75C584F5827E83DF68A127A9226E80D8DD1F0C10E71EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 890823e6dd5467c86c85eb96fe6393d9f914f65306248f32c086c4bcdd14ed7d
MD5 1e9a54b952e4176db92eb1a3025a713b
SHA1 c89d4d652ee5f556f69c6dd44140ee0639998bb6
SHA512 6aa6df52f559d7a1a570b589705c9b4bd096ac0f33ecd91b7c801df46dd5dde16e9fd259e0ed32e0184417176bde108e679533c287d2549c8e6ed814a07a9076
SSDEEP 3072:wNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72n:vOlsPQCfjiXVzoJHg6JOMxheoPI
TLSH
T181C312A58D241D7F5C74AA1A75098E47FBC0889DB78E6EE083C62699231F0D4AF4331E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 2d48744196add992cab9b48115eb7262d0aa4bea946bfd2f8269281d5f526d7e
MD5 29c3b5baaef24cbbd5466a2cbbf75348
SHA1 51447443948cab4b2b3a6bdc6e0f637e390f8dde
SHA512 b5426048ce308bed5c04b785269540390687fc5f2c69260aa4da24a7e6f9c3ad38d17c4baa6dee594fce4a584ec7841d264328eb6bf58d00e966c61fb6f5d677
SSDEEP 3072:JNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72n:SOlsPQCfjiXVzoJHg6JOMxheoPI
TLSH
T171C302769D241DBF5D34A90A75058E47FEC4C88EAB4E7EA087C13B9A131F0D4AF4361A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 05ff6020e9250d868b1acacbf03dc37eb3595f1c7492604729b5066f4289dc95
MD5 3e7520ffc5ae0c3554ead41912b997fb
SHA1 f06b9407f2b7ea79220c0bbfbbf664089834cf62
SHA512 c56941aa72f0230878ac7532fe48e3070281111a9b33f955d53ff04d4e9bcf6e199e33d3a1543a5564e94d73944ca700972ed6cfb116337124e27def9c3df9e2
SSDEEP 3072:sNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72n:7OlsPQCfjiXVzoJHg6JOMxheoPI
TLSH
T12EC302B69D241DBF5C34A90A71058E47FEC4C89EAB4E7EA087C53B99131F0D4AF4361A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_934128337\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Pasters (1).zip.crdownload

Path C:\Users\Admin\Downloads\Pasters (1).zip.crdownload
Size 16.9MB
SHA256 8b1adb586822922aacdd0aca69dce9bda6e56c4afcd3ede54b1d75c46859c6f8
MD5 b9fd01bd32b41ba9a2b89ad5bfda98c6
SHA1 1e364355cd63961d07e4adf0e453514f85a1abcd
SHA512 e8fe7ce30d14a7fb6596ca8441ca47a474ed24486f68226a20ac655b99354e213e065eb502b9e2a0c43c50ccde424fadae5e6165c66319ae64cb2e5b52cf008b
SSDEEP 393216:ZqMeOTR35jt8ljis6cGEt/1HIF2qbluFDa1N99nke5/:tf3pt8oI/Gcabzj9
TLSH
T14E073306A976A3A6D0427371DF5BDF822414F06335AAC35B08BFA72D4D5A4B425CE33E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads