hxxps://help[.]ilevelsolutions[.]com/hc/en-us/articles/115004995834-How-to-delete-and-reinstall-the-iLEVEL-Excel-add-in

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://help.ilevelsolutions.com/hc/en-us/articles/115004995834-How-to-delete-and-reinstall-the-iLEVEL-Excel-add-in
Sample260813-p8a2ssbb24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3328	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310995886508578"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4592	4360	chrome.exe	85
PID 4360 wrote to memory of 1844	4360	chrome.exe	86
PID 4360 wrote to memory of 3328	4360	chrome.exe	87
PID 4360 wrote to memory of 1844	4360	chrome.exe	86
PID 4360 wrote to memory of 4572	4360	chrome.exe	88
PID 4360 wrote to memory of 4572	4360	chrome.exe	88
PID 4360 wrote to memory of 4748	4360	chrome.exe	90
PID 4360 wrote to memory of 4760	4360	chrome.exe	91
PID 4360 wrote to memory of 4748	4360	chrome.exe	90
PID 4360 wrote to memory of 4760	4360	chrome.exe	91
PID 4360 wrote to memory of 4524	4360	chrome.exe	92
PID 4360 wrote to memory of 4524	4360	chrome.exe	92
PID 4360 wrote to memory of 116	4360	chrome.exe	94
PID 4360 wrote to memory of 3928	4360	chrome.exe	98
PID 4360 wrote to memory of 956	4360	chrome.exe	99
PID 4360 wrote to memory of 1732	4360	chrome.exe	100
PID 4360 wrote to memory of 4204	4360	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://help.ilevelsolutions.com/hc/en-us/articles/115004995834-How-to-delete-and-reinstall-the-iLEVEL-Excel-add-in
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4490c728,0x7ffa4490c734,0x7ffa4490c740
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,3907657772637136497,10054825242684709731,262144 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,9006900654047784439,4293716715893335509,524288 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,7164513877418714391,12577765492624176254,524288 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,4884929276071596823,8921461665176388821,2097152 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,17730219999994410458,10191085594941575901,2097152 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,8193710826626287957,13843806623146166046,2097152 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,8878265741014160542,14329895711576481507,524288 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,16109530295924636105,6001743830475834305,524288 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,1159007293430769000,5054496693811046873,524288 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,17735813515054440501,15295884781732923175,524288 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5664,i,14771254847250589067,13453150961191033881,262144 --field-trial-handle=2000,i,15309971696107337695,11226298007568859785,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7f6bd850848d46db4f82ae9a02eafb9944aca3dc028b27d3f810de285ce6ff79
MD5 0bc857d38a56426cb992c19832a71c03
SHA1 7824bd4931f23f4d33c362b415641788f0687c56
SHA512 5bb7b9a6247e44d29be2854de2f5203155a177d76571bc842232d1e37f8555e529a1971e57130c2794817de038993a71018afac53dbf8b688ec1d37c4eb787e4
TLSH
T1B8E0ABBAC921AC2B0CFC131A2418060BE34423072F40851B3E3D820C8FB87371586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e6f1c8ef6dd8fdf32b5b462ea8f5cb53e064fb5de29e7f929ae59c1418df675e
MD5 5039d98a076f7cfb0ede221efcf0f64c
SHA1 43396a37161d6ec2f6d878329abea65f675b1251
SHA512 b6f5d44c0b9546132073e921173089cb36bbd6ee6c97e1ec02161ed2b9d2a3f6aa88c93bf5943870e25f12906df7bbc38b885941b39cd0cd14277993716213fc
TLSH
T1FEC092806A824862CFA422B098A60848F6688BDC44B8E64A90D49C8498589A699A61A8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4902f0d7ebee3192d2625d0a19f7b360b601e7b8eba844533eafba143617bdea
MD5 97a7cb50b93c3b05548636b1d97df787
SHA1 2f2c1226e75ce01bcd61c825358ea9811b2b29a2
SHA512 e0788481d3a36656aef982148bee33efe35eccf2d529768c8f501714c0f983ec6b761a2b8d385082e1547278f1f5f46c9a5761bd9e4625901d509ba14a1dce94
TLSH
T1C3518CF797B4857E8A1192F0AA147E1FCE6D0924035D38A9C4D46E1B93E24B1D24578F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 178e44988522bed542df19f75926236e4539a296110a093532d4a3d5105b5101
MD5 9e7e3bf41f2f65b8367a78c3e0ae1c10
SHA1 94468bd4be7a39f94ba31f511fbc09b1e93137d5
SHA512 18b2eb79c71ea7fe936da74967eb04b247dbc8a8cbbc5db99b865d0f43b3ef19d0e34064bfb6abe77367c6a57fee5e39f62ceb5fc592ddb8431ce557f6c702cc
SSDEEP 192:wRdcZedOd8v72ympAPRp2Hs95Hsb+WNng8abA2+kAoVei2mgVyIsnAUge:wRdcgyoQUXH7w7V2XAoF2mke
TLSH
T1EC42D92EAA10657B5CDBD21AFD227B23E7F5107225902E44EAFC8A2C15E75CC322B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d9c53d9d1f18f69513617847fe3490ca5d17c470b9a41e0f8f5f662074a32ef8
MD5 850645cb885d0787a9a78a7979a23f6f
SHA1 20b881c2cf4f0a4b0173d3d0d394d16baa43b90b
SHA512 62b28316b906d3abcab4919502cb8f36bc4a67f0e8115287c464cb35df6ad665c887821cfbf65badd0ca8e5910be533ae5c14ac58436476ef924c92639291a82
SSDEEP 192:wRdcZedOdXv72ympAPRp2Hs95Hsb+WNng8abA2bkAoVei2mwVyIsnAUgE:wRdcgy/QUXH7w7V2oAoF2m0E
TLSH
T1CC42D82EBA10657B9CDBD21AF9227B23E7F5107225902E44EAFC8A2C15E75CC321B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 be08067a093959838e25ca2d240352f59b2bd7e91f0d86bb339be9e5ffb3fdfa
MD5 6edfbee3c116327904be70dc02e60c91
SHA1 a9421cab3dd30259df1944560ba2b0258a63b016
SHA512 2e5edd83b33531bc227922bf378d6f9466e2c3ec8ed130af859e10cac5da6dada431ea0ee7ec9c1bcf28097629fdd73dfd76c2d0883abaffac13997e5117080f
TLSH
T1CEB01200C801A101C0A202B417529488B2145F14D60E170143E069A7C829161C419150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585697.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585697.TMP
Size 96B
SHA256 70875b6f8bcd8f97a2479e3f87f555c7d10c9d68647797024370dd9b788e741e
MD5 d21056cb6b125aebe6107d756e5bab8f
SHA1 77edfe693f7834e47c29d8f6653250440dd29543
SHA512 3ec97b6c91b5891aa5769b1f263451395c9d0794bbe0f601fceccd24a40d75537820feddaeb6a33bdc2b2d3ce4a6a8e4fe0a34dff14382abc229ebac0b43dd5a
TLSH
T1C7B00257C1066312C05607B039E5D5D9B171EF2BC6031256D2E03A6ADC396754A661A1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6e2c5151c058d5cdb0d31cbe52516d358a75556c1955644896f3e24827ff72e0
MD5 2055a8a287f79a8494b6b3b1eeaada91
SHA1 cf86b30d398c61cee1dc07e8179420f8fb549d00
SHA512 cbb444c45b1a4349c55b11eac07db5537a65da9ae39617fc518c80d56d6e42cbf387deb87705838cc880da9b18aab9d7fdddcc653700a14dc28a612b76b18ae0
SSDEEP 1536:TRQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:wqfd7NtZL8cHQRZEQ6Spsk
TLSH
T147C30237DBC21F339D92CB60B9530FD697B644A99034D301AA7D77BF6C8389168428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 54224761cddb4583c4991be84952fe946ae1bfb61182858faa3b799df077641f
MD5 19e5951e3ec75bf9da2173d72e8006bc
SHA1 6e6a88e000b5be30cc8174b1f63e66ae0e4534be
SHA512 64ee274ac35ddad10965b3a66aa5d8179485b1e76ac88c8b1d7201086a57a114d00a59ed14e42cfe4f6fd2d9d2b95f2c8ef525469746003ec8ac430cedfdfa26
SSDEEP 1536:sDxXyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:G5qfd7NtZL8cHQRZEQ6Spsk
TLSH
T131C30237ABC61E339ED2CB70B9230ED797B544A9D034D301AA7D2BBF6883491644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bb440acd4695576996129f5cd2611059e9ab6f457e392a687d74b41eeb0028c2
MD5 f20c5165a03b40f39623febed29c1755
SHA1 52d77fa946bc4fa04ad5d09413b8368d09997d15
SHA512 ace6da8ec84eaffa18d1589deccab8ba5fe5d4c6f59e29e5b12a38c8f288dea52d2f6dfd497b80747f2fc1eebc759b44445156ab21fcf94d7760f281024d8903
SSDEEP 1536:sUyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:jqfd7NtZL8cHQRZEQ6Spsk
TLSH
T111C302379FC61E339DD2DB60B9130ED793F644A9D034D305EE6D6BAF6883491A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8c31b2299ea7a75493f25d75813af2ca0cba486352e1ac6b4b20a8342d02fde4
MD5 d934cce87db60a801bb7d57efd8b1b48
SHA1 7f080b14966b7b477fb7a1269033c2df6f698a3e
SHA512 ddb69ce582a7a995f8b33c6b4f77019a028eef1d2f860e033bfa5845f60f5d2b0846d7b7e9b4cead56e9cb7b9177e3b599706d035358411d7fbbf901c3b82528
SSDEEP 1536:fDxXyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:F5qfd7NtZL8cHQRZEQ6Spsk
TLSH
T14BC30237ABC61E339ED2CB70B9230ED797B544A9D034D301AA7D3BFB6883495658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download