a58528a946be3aafa0c6e0037b57f9b5e15c8fb2637d594c1c5bb43187e53c4b

Analysis

user interaction
yes
max time kernel
1800s
max time network
1779s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zed-i18n-windows-aarch64.exe
Size 77.9MB
Sample260825-befhjafe99
SHA256 a58528a946be3aafa0c6e0037b57f9b5e15c8fb2637d594c1c5bb43187e53c4b
MD5 5d2733da865ef4884203e62457a2cb11
SHA1 249d6fe85ee2cc37c73fc6cd3ba4c1c7fc2e4ff8
SHA512 bb027c97a4751baa3b141ab10bb1091410b0b166bfb202eab545b4993d2af48be485b3784ec63fe5ebf989f32d85ab72bc9fad10e4604ec9e45fcdedb0cfc0c1
SSDEEP 1572864:k2RdxfkJgeDOUJg19DiOE9xfywPNeQicqlWjB6ty7lrnHLvaij+:lRHrUJg/iOE9RywPNeQiNlWjUw7Zrvg
TLSH
T1BA08333F2796B83ED0AA0E347073E255903B7F226713891691F4A46CDF365721E7EA42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\en-US\dumpsd.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ndistapi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ProcLaunchMon.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\volmgrx.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmgencounter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdwps.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UcmUcsiAcpiClient.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wmiacpi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ztdns.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\fvevol.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\USBXHCI.SYS.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\HdAudio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mausbip.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SerCx2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\bthenum.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\usbstor.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tcpipreg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WpdUpFltr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BtaMPM.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mouclass.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wof.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbccgp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\watchdog.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msrpc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nvmedisk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rasl2tp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\refsv1.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpfve.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wfplwfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\flpydisk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tunnel.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\netadaptercxum.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ntosext.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WifiCx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelide.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mouclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\qwavedrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\buttonconverter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\circlass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hyperkbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\smclib.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Diskdump.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpsdport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pci.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vmbus.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ipnat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mssecflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\HidTelephony.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\1394ohci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\bfs.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sermouse.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\spacedump.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storufs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidparse.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msquic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\http.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\wof.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\IPMIDrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kbdhid.sys	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	Zed-i18n-windows-aarch64.tmp

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
363	raw.githubusercontent.com
421	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\de-DE\onexui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\de-DE\GenericProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\uk-UA\SmiProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\chs_singlechar_pinyin.dat	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\WinBioDataModel.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\c_fsquotamgmt.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\hsp.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\takeown.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\c_camera.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\c_fsquotamgmt.inf_amd64_f128b2e0c4bd0201\c_fsquotamgmt.inf	cmd.exe
File opened for modification	C:\Windows\System32\cscapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\csplte.dll	cmd.exe
File opened for modification	C:\Windows\System32\diskpart.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\mpi3drvi.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\cy-GB\mlang.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\IdCtrls.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\netsh.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\ssdpsrv.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\wcnwiz.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\uk-UA\LogProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\xboxgip.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\iaLPSS2i_I2C_CNL.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\bs-Latn-BA\comctl32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\vssadmin.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\NETAX88772.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\HELLOF~2.INF\FaceRecognitionSensorAdapter.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_c009b0cd3e63f884\ipoib6x.sys	cmd.exe
File opened for modification	C:\Windows\System32\AppIdPolicyEngineApi.dll	cmd.exe
File opened for modification	C:\Windows\System32\appinfo.dll	cmd.exe
File opened for modification	C:\Windows\System32\audiosrv.dll	cmd.exe
File opened for modification	C:\Windows\System32\BluetoothPairingSystemToastIcon.contrast-high.png	cmd.exe
File opened for modification	C:\Windows\System32\cdpsvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\CompMgmtLauncher.exe	cmd.exe
File opened for modification	C:\Windows\System32\C_20866.NLS	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\qwave.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\autopilot.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\laps.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\msidntld.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\dispdiag.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\mdmirmdm.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\microsoft_bluetooth_a2dp.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\nett4x64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\AudioHandlers.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\jscript9Legacy.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\seclogon.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\de-DE\IntlProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\ipmidrv.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\c_hdc.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\c_mouse.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\KDNIC~1.INF\kdnic.sys	cmd.exe
File opened for modification	C:\Windows\System32\ddodiag.exe	cmd.exe
File opened for modification	C:\Windows\System32\downlevel\api-ms-win-core-threadpool-private-l1-1-0.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\microsoft_bluetooth_a2dp_snk.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netevbda.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\DigitalMediaDevice.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\bitsperf.dll	cmd.exe
File opened for modification	C:\Windows\System32\CriticallyLowBatterySystemToastIcon.png	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\mskeyprotect.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\ulib.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\mlx4_bus.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\dskquota.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\html.iec.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\Dsui.dll.mui	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zed-i18n-windows-aarch64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zed-i18n-windows-aarch64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3916	chrome.exe
4612	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1476-0-0x0000000000640000-0x0000000000743000-memory.dmp	innosetup
behavioral2/memory/1476-8-0x0000000000640000-0x0000000000743000-memory.dmp	innosetup
behavioral2/memory/1476-66-0x0000000000640000-0x0000000000743000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320937188247795"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{FE1B3A7C-8246-4ECA-BC23-863A93669179}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{E584A84D-7D74-469A-BA4A-255D3F5F875B}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
2200	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2200	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe
4876	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4740	1476	Zed-i18n-windows-aarch64.exe	89
PID 1908 wrote to memory of 1368	1908	chrome.exe	93
PID 1908 wrote to memory of 468	1908	chrome.exe	94
PID 1908 wrote to memory of 468	1908	chrome.exe	94
PID 1908 wrote to memory of 3916	1908	chrome.exe	95
PID 1908 wrote to memory of 2892	1908	chrome.exe	97
PID 1908 wrote to memory of 2892	1908	chrome.exe	97
PID 1908 wrote to memory of 2208	1908	chrome.exe	98
PID 1908 wrote to memory of 5032	1908	chrome.exe	99
PID 1908 wrote to memory of 2208	1908	chrome.exe	98
PID 1908 wrote to memory of 5032	1908	chrome.exe	99
PID 1908 wrote to memory of 5852	1908	chrome.exe	100
PID 1908 wrote to memory of 5852	1908	chrome.exe	100
PID 1908 wrote to memory of 4900	1908	chrome.exe	101
PID 1908 wrote to memory of 4900	1908	chrome.exe	101
PID 1908 wrote to memory of 1260	1908	chrome.exe	102
PID 1908 wrote to memory of 2864	1908	chrome.exe	103
PID 1908 wrote to memory of 2864	1908	chrome.exe	103
PID 1908 wrote to memory of 6008	1908	chrome.exe	104
PID 1908 wrote to memory of 6008	1908	chrome.exe	104
PID 1908 wrote to memory of 5168	1908	chrome.exe	105
PID 1908 wrote to memory of 5168	1908	chrome.exe	105
PID 1908 wrote to memory of 2920	1908	chrome.exe	107
PID 1908 wrote to memory of 2920	1908	chrome.exe	107
PID 1908 wrote to memory of 5380	1908	chrome.exe	108
PID 1908 wrote to memory of 5380	1908	chrome.exe	108
PID 1908 wrote to memory of 1392	1908	chrome.exe	109
PID 1908 wrote to memory of 1392	1908	chrome.exe	109
PID 1908 wrote to memory of 3464	1908	chrome.exe	110
PID 1908 wrote to memory of 3464	1908	chrome.exe	110
PID 1908 wrote to memory of 4028	1908	chrome.exe	111
PID 1908 wrote to memory of 4028	1908	chrome.exe	111
PID 1908 wrote to memory of 2768	1908	chrome.exe	112
PID 1908 wrote to memory of 2768	1908	chrome.exe	112
PID 1908 wrote to memory of 4700	1908	chrome.exe	115
PID 1908 wrote to memory of 4700	1908	chrome.exe	115
PID 1908 wrote to memory of 964	1908	chrome.exe	116
PID 1908 wrote to memory of 964	1908	chrome.exe	116
PID 1908 wrote to memory of 5384	1908	chrome.exe	117
PID 1908 wrote to memory of 4712	1908	chrome.exe	118
PID 1908 wrote to memory of 5384	1908	chrome.exe	117
PID 1908 wrote to memory of 4712	1908	chrome.exe	118
PID 1908 wrote to memory of 5040	1908	chrome.exe	119
PID 1908 wrote to memory of 5040	1908	chrome.exe	119
PID 1908 wrote to memory of 1864	1908	chrome.exe	120
PID 1908 wrote to memory of 1864	1908	chrome.exe	120
PID 1908 wrote to memory of 3300	1908	chrome.exe	121
PID 1908 wrote to memory of 3300	1908	chrome.exe	121
PID 1908 wrote to memory of 6108	1908	chrome.exe	122
PID 1908 wrote to memory of 6108	1908	chrome.exe	122
PID 1908 wrote to memory of 1392	1908	chrome.exe	123
PID 1908 wrote to memory of 4028	1908	chrome.exe	124
PID 1908 wrote to memory of 4028	1908	chrome.exe	124
PID 1908 wrote to memory of 4564	1908	chrome.exe	126
PID 1908 wrote to memory of 1684	1908	chrome.exe	127
PID 1908 wrote to memory of 5636	1908	chrome.exe	128
PID 1908 wrote to memory of 2836	1908	chrome.exe	131
PID 1908 wrote to memory of 2836	1908	chrome.exe	131
PID 1908 wrote to memory of 1552	1908	chrome.exe	132
PID 1908 wrote to memory of 1552	1908	chrome.exe	132
PID 1908 wrote to memory of 1704	1908	chrome.exe	133
PID 1908 wrote to memory of 1704	1908	chrome.exe	133
PID 1908 wrote to memory of 5336	1908	chrome.exe	134
PID 1908 wrote to memory of 5336	1908	chrome.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Zed-i18n-windows-aarch64.exe
"C:\Users\Admin\AppData\Local\Temp\Zed-i18n-windows-aarch64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\is-X9IJQR6AZN.tmp\Zed-i18n-windows-aarch64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-X9IJQR6AZN.tmp\Zed-i18n-windows-aarch64.tmp" /SL5="$901F6,80368992,1003520,C:\Users\Admin\AppData\Local\Temp\Zed-i18n-windows-aarch64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffece08c728,0x7ffece08c734,0x7ffece08c740
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,8579984051393328448,13250581804669655647,262144 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,6508979942610424752,12281823556590650203,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,11104982879970774474,11140382534565079471,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3324,i,5527049256266185377,3542260008256562911,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3400,i,10746367451383789821,12660457196863603329,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,16018984377178926277,15950474782986017752,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,3749047284441985803,15162147887837213780,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,17550056567343124577,336818587985734207,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5424,i,14161062233371200647,8853759837993079400,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5504,i,12884486426251256917,13978533215095881928,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5828,i,8208150917180516604,4967468635131963449,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5972,i,1407085751419281114,607562006023076176,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5840,i,5828041635559975253,5258808424685467471,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6288,i,3828385509328681711,12340601231675002706,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,12449872956895429925,14098834773076492189,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5976,i,9624906943421660494,12993139127622588679,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6220,i,4838955897140028074,86418662438617662,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,3057427454890911723,16556323986447856479,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,9207989039785502074,16220934344971895391,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6576,i,18158463667008397945,9452460507773248734,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6260,i,14634044140819252612,6681739204731310186,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:9
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6288,i,11597947751502705406,7279696569814375653,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5944,i,18142292531085703870,3380326735566029305,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5656,i,2932461641673704684,10524349314288320799,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,18000423535193504485,2350600717827454904,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,16674405016827822652,16488690359411409972,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,2021595183632426036,6249614612574995218,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:12
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,3761492818442347605,2984661075937110048,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,1050651663713284515,6245382244735774478,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,4083009548572109703,11350109886994949295,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6588,i,10248812175671204960,9647202908544766784,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6152,i,9137946607634920913,3876082989650683578,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4708,i,7125665160591689811,1481928460686587,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5668,i,5014866284954280294,703274826577967569,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5908,i,16962138291346581157,1827709160386509308,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3732,i,12822308800916407989,4040458621813190119,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5836,i,15326309260950387003,13383596932255739051,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=256,i,13974970699373014384,6437363563820300558,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7004,i,1142231097076357504,15377944578205334572,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7504,i,15396799814840526846,14376979882668605442,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7616,i,5698975570772782835,16169039634331421658,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=3692,i,6791261224905499905,13966226549459014602,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7536,i,5101770053595660639,14720450767882344676,524288 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7428,i,1497476611931460301,18384268183846123695,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=4756,i,131831030400492153,9283392132742776697,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7472,i,12078406795896421199,17893643498275240072,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7932,i,3562179499968129347,8122938193784362282,2097152 --field-trial-handle=1932,i,9918516891219948437,16265659522044913361,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:3052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5780

C:\Users\Admin\Downloads\VolcanoExecutor\VolcanoExecutor\VolcanoExecutor.exe
"C:\Users\Admin\Downloads\VolcanoExecutor\VolcanoExecutor\VolcanoExecutor.exe"
1⤵
PID:4732

C:\Users\Admin\Downloads\VolcanoExecutor\VolcanoExecutor\VolcanoExecutor.exe
"C:\Users\Admin\Downloads\VolcanoExecutor\VolcanoExecutor\VolcanoExecutor.exe"
1⤵
PID:2832

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Users\Admin\Downloads\VolcanoExecutor\VolcanoExecutor\VolcanoExecutor.exe
"C:\Users\Admin\Downloads\VolcanoExecutor\VolcanoExecutor\VolcanoExecutor.exe"
1⤵
PID:4760

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffece08c728,0x7ffece08c734,0x7ffece08c740
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,7918806115215477259,16677221281445214439,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,4134580022379496535,1520376586150316336,262144 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,17811714599981931476,10093800271707825206,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=2256 /prefetch:13
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,8776986915180072060,3067708894214095839,2097152 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,836798034217880643,17712345433453293403,2097152 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,11872966796778908926,16100104398601453853,2097152 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,337949538225080805,5819446436817827652,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5756,i,4959366438703548966,18018994835270445754,2097152 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3560,i,3378146789661741562,17958047301955427550,2097152 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,11385145096133142572,2138680271015625468,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,8438176997411076845,4269127920985290595,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=3696 /prefetch:12
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,3869375103943232015,9945145111392765568,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,10885741784783285088,7803132770758904500,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,8114776429269841703,5829294165529882349,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6120,i,11384985521222277327,8183613324757186413,2097152 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,17472205701182729250,11145511930841931953,524288 --field-trial-handle=2068,i,14595696918021718543,14967274229685753246,262144 --variations-seed-version=20260824-090111.390000-production --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\delete system32.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Executes a command shell one-liner
  PID:3692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5408

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 42c4fcd383e47854e66057644f88979287b077564fa0e83dd5097623e224804c
MD5 d5b8e33845632b223ead9f7767ee1379
SHA1 5c1b01562bc2bd424d2d703de91e00b40379f3c8
SHA512 5ca20e1fadc3d123a174427c582e6822453d233accd614ae0e0d77978b631e9c0b355a0090f2602cfb451f5aec4021898e6a294597d7787424e761071834e2a8
SSDEEP 3:t89llGlll/l/lXp9ZjrPBY06llqlHeU/ZP:sl0dPBY0OcPJ
TLSH
T12053244151C30317C443033004CF07443F75130C4343043143105370C45CF0040F11C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 960B
SHA256 565de87de825884dfdd98f37a1b05d5293eb72bb28ba1950f879e0082b0344c8
MD5 41771ed4b8806ab6a027db8f95942da4
SHA1 7fa42f8cc0b391d46d29dd25c08ca7483646c430
SHA512 5b6e35b911a88c142ea61a14ebe98987da3f5e1b1d6898b28558a1f80f45ca27fc1518c21464bdb9ac86e2f1b7cbeaab02cedb2b89ba34ea96e46b4f6116b44a
TLSH
T1EB118C483BCB2CB0E33A7830002992201203B12208D2D20C8AC084668A31104D032FA8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 bcfcf1237e3e768e1ef8b21027442c00abfd18ec4c5a84382de109485147181e
MD5 e5c86e660bb257f46e9b7b9c16f78543
SHA1 794ae88bb4ebd5dc867bd60bd516d717b6f15a2c
SHA512 b59b64d78409c86d35993883d927e89d38ddbbd74c08d04fb0e9db4234c5b7957b777034c1b47b0f32bc05c5fe96e830f3aab36ad10243c1777e32f0ea496197
MD5 SHA1 SHA512

Submit Download

0132e7d9-cc43-4cd0-9d45-4daee1222e46.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0132e7d9-cc43-4cd0-9d45-4daee1222e46.tmp
Size 414B
SHA256 4995bd37ce51f8634fa2c24e93300044521048755bfcfc87c2272756e6eee1d5
MD5 34325e84841071ab15e7cd52adc9168a
SHA1 91546f73cc2927c35da10b53e1602d2a200f2507
SHA512 2b3afb44b62e6556f1763db62410e38fb397cc759ad85c79865dd498f6ef802b02f1fd534a1e75a7d7e6c01d4ddc636c278149fe2a7c30a04650377811c516b0
TLSH
T1BAE02BA5CD10B83749FA076871940746EB5003571A41455F363D940C8FF467F45CAD6C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068
Size 73KB
SHA256 c8043430b14ac4131646da23a62dc6fce6d0944dbf1c8e07ac69c4c40ed8a67f
MD5 9ba3c4d5d5171672e895b8c124b89489
SHA1 8df232845179c211b3e4891a6e7f6f9be49e335f
SHA512 3413f3a6a3d780d51b891cc0eacc80364cc9718f0d5aff8a599df32552fbe378e3cc3e76e6ef98efcb1dea665ea586a6c986ad0852081fa11d49dea30b8c1d05
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQaPKuSeUJ:cjW1b1U09DGyQPKzSUFVXCQaPBzUJ
TLSH
T1227302860B8A47752A27E73C9E1D9851B7B0C4B1B15FDFC7A2B8B15E712113861C73E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a233b110e215d34595b9c7bf01b413ebd5f9e3b7fc0e55f4cf0bc96d3b92235
MD5 b54c606474a45752433fc04b5f9b7b84
SHA1 d307f2d65987d9da87bc8539f8e9a7a5906f25ff
SHA512 c0c7a9156da056643431b76dfe212f379a943e06efcf44a8e5d96df4c07ba9bbad6658d93379dc7cff7af9a16253a5f7084364743ee73ad73bafa64206e4bc09
TLSH
T11861000158CC735CCBD01E7099FB3DCC3BBA5967801BEE52481412B22A63BFEA2A6435
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 90322f512dfc186346adec2d469e53e51028fc60a697f8dafc838435687a0618
MD5 f3a8308cb8c141b4364a2cbe945c90db
SHA1 8f5f3d82b2b5784c093fcd031f8a6c2b5c5247ce
SHA512 8638c06347bd7d2f6bdc64e493875fb218813bc2fa748e0dac854074ec0f4ac32f8d50637aaad91fcd4b48a1cad34954148d3a71b47c0b42d7e4fb5b8644b27f
SSDEEP 96:w3OOBkgoVbS3ibiAtVgwcPOF9z3VHht42:wHktVbyuR9pU2
TLSH
T130D10E4C288C6E5CCBAD0E7054FB2DCD37BE5612800BEE3648D8127E2A537FE9966474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 d379b77fdc4eb21e546e7c7c3dfc4771dd49d655d4f2b20372b83d1cef4591f4
MD5 b3209af1894c3f11be433928c5d4c9c0
SHA1 9babc793a7fb59ef82cb70197404de33af564da9
SHA512 a458c87fd15394e9d161b8e82bdca7ad18ef144b731a82a3f69ba4c22d58dbd112721ac0ad8db053dcb9ccac4a199618de115b29fc768d0e26a742c9bcf17541
TLSH
T11D11FE49CDCC3658DFF627F159187CC823B60C378017FA67816100A8BA27BFE02E2652
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 05e3e62307778411d3d5a5036ef856226d2e2da5aa432db22ebe848d326c9d49
MD5 d06d542e8fb6f102db576fc257238353
SHA1 5933034ea3a02c557a30cabcb5c4057abc60df49
SHA512 44b045394470b33c467c56a686433be7285f284c487d0c9daf179ded8eb003ede70ba3d847e3df24750995d5b9ed503d2e6fd2a3178b39db92c553b9a11a3824
SSDEEP 48:+rFclMYWCiJsMBXF1FzyJdqQD/RwuYpd3clNyH9IPwDhcAoetu2u6VsOhgNYMAWi:HlwBtg/5w3AgdIPoccsWVXhfGi
TLSH
T1E1810F4468CC635CEBE10E3055FB3DCD3ABE5912C05BEE464C1422B22B237FE99A6474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000014.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb
Size 17KB
SHA256 e29b42d610a6870af55756675f8bfb91c573d69a74ad4d3e2eeba48db790d26c
MD5 beb8876905e99e774adb8d8c55394eb7
SHA1 0f79956e197f2c7cf3738fc77d26bb09f4ee55fa
SHA512 40db42797c66b307b0715b1602e4c37fa7ace691c3e247e1006333ddc602fa0ce01758c4e798532d84882d22b52ec743fdedcf71692cc39020b586279da57b8f
SSDEEP 192:wTwqpw+FjsftNqU0emdCCFhqrZiHysbqMYfho2FamJCmhlN35GEyrKvLcszkTpJE:Iw6YIU6ZhekgQnm7PvKJegSqtg
TLSH
T14682AE6B29D850DAD265D1F394FE51491F31B90924C9F0EC7587314C28AB7FB26A8E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000015.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000015.log
Size 742KB
SHA256 10e901797e3164f00c3e84f7895a47c337435ce2e027db33d05a92df3d7e516d
MD5 902bef7022de0bbce8b512dd175fbb89
SHA1 ee0954f65956c115ad499e7bf6665d6c5dc7f66b
SHA512 693fb9db83dc7fa2048931738b0f08a742749b00237b7d02fd37de06980ff0aeb787133d3e269e74d58f331553735b5a76b24d61a143dbbe17fbe9fcd92b6db4
SSDEEP 3072:U8991ee343dH67jEVEakVpTjlV9vf5r2kVpME35GcWcLiLq4P7M/UZ+TbehUCdnY:p447LprJzh2LDPQcIbeiCdhOe32DRv
TLSH
T143F495A47177A3D4703E434B2706DC1BE632F5C8C65BB491AAB12E483AEBB443E1536D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 17KB
SHA256 e0667fa1f6a8b16c199af9c1f0d142abb22001f5a713ee7cae770475c11a26bd
MD5 1f270c56e4752475bc5dabba0422ed2f
SHA1 97996cfb4ce003d3a35fc9ec14046d9583369e43
SHA512 43e5ee27a5e66e8ae5c9a3aac23ae2634a2200384887811795ded407f9d13c2a706618509146cf14fe8654d45023ff94e4f9b47775ebe6a097eae5bfd6549bcc
SSDEEP 384:DSRWKjJ2CIUTyUY+kgQnmrPvKJegSqQI6Hy:DKl1yi1QnmrnKJeghP
TLSH
T122729F6B19DC41C9D266D1F364FE06491F21690A34C9F0EC7596304C646A6FB66FCE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 6KB
SHA256 9d32c608cd7efb7c4e000828f4410a1c969a01799935ba14125702f7224a6099
MD5 7d6110759bf0129257fac602d61baa12
SHA1 9dd1638abfe3976b2cf5cf80287a45c755e409c1
SHA512 37c0629578f676438d6354cecc19943c09fd583bae8b10bdcf07a5e9b73d32cf77b5d22e677f9e4694d01eca339e3d698fbaafe1f0b26f7951d1fb4cb810dbe4
SSDEEP 96:d/Jm/JC0xNIBC998cNC99viccHaGo/jmaXNFCC6RDzgGod6cU/:fgeI99PM992HaqCCnxgdq/
TLSH
T165D19CFB1E0844E804D3C262E9A9F347CD5C9512570CBF58658EA78F17F160ED45B9E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 1KB
SHA256 535e032199748c36d08b7554525b1d2eb897c6695d303c6f2d5d42afed6606e4
MD5 b1d5ffa3013ec4483c709904b847d1fb
SHA1 6ece845e8177450160b8aa08061ec979e29c7271
SHA512 76a95108d4451990a1e11485e65e7af63d05783fbc0a8a52108f225faa62e630aea6df5546c661bd29cff5d94a16e6058f72617ebab5249f231b0aa2062dfd9e
TLSH
T145218E10FBFDA5C1F0F616B159BFB94E2F25B98F0D0ACA1F2189215E24A36019D6063A
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 312B
SHA256 772287cbc270b483ae860cb30f092743cb8310089e67ae0bc54aa352f72d9ce3
MD5 9d0306c2afd46a435b926a32178af89f
SHA1 f95d090280468c7a25706f99c92b5eca72a4506f
SHA512 4c1b00a1af8b7cd910ccce56721c37610a3a974d571e8519cf4e2af9498c65e7341af134c040c47371692d17d0e113b4754bebc17aabe30bcd7f9e16b6ed85b9
TLSH
T145E0C21263FEA544F0FA29F69EFFF8465C32FD2E0D0AE62E7205424E10D66006C34276
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a7e431d6dde7775d82c338c7b281a78a4121abe86fcd3bdc1900aa5c2c8c1024
MD5 b6a84df6e5ada7b1289e46f9c6306cc6
SHA1 ed361395b9167f4e5d10bee9cb8dae7835636859
SHA512 a91354871b4fdecbecbd1748d022aeae8ec601d6c44f3d67fdd9cb223664c8ed02bb29438c48a493a868e80c83b2f0871513605323fe2bce8d81ea5e8c8f2f32
TLSH
T1D5319AB7C7D899BD890056F8A7156F1ACE2D0D18521C3D27C8D8AE1F57F28B6E20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3270e1ca861e187c750a1fc022b2fc7bd60f13ff5bbf15bbc42eb7c0a7a2ce36
MD5 5ca69923a2bc64f6fb9ac16b6fd723dc
SHA1 0f7ced23ce25a473c56ce21e066bd0cd2acbcb5f
SHA512 3e4732d007a29035b91daa0836f53e93a20dae067ee8a4e1fbb7e39a48d46fb85c24c8251987fac79df690e17a845fe677a705fa2f161d00dd4054a42d7429f4
TLSH
T1F8319AB7C7D899BD890056F8AB156F1ACE2D0D18521C3D27C8D8AE1F57F2876E20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 3ba86d7452bf815db30b6d99cfc322ae6e85171103b16009f2a52c25e7e9653a
MD5 5fcc3ab3a5baa6f01d9103f4b1c96831
SHA1 0385bb5546992137e417f629f473aa106f6c340d
SHA512 29e8637bf7c8438e577a645aba624b70162d1bc4ac23ccc0bb7706634b970987834681a0f392750671524654c28b62314ef3875818b7dce757d413009999be5d
SSDEEP 192:DVSsMqaMt4LMJt269d0o2EPk/I2Xb11UjHxTVp3WqENWfW4Wfs/7IVuH:DVSsMqaMt4LMJt269d0o2EPk/I2Xb11o
TLSH
T1C322A9E6D7D4822DD8615AF4DB283D1BDD6D0E2483283C26D9D6BF4B63E6071E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 62271f0393e6ae1c279a89ac47a6754b03b763b2cadf5a6680f67600cd575f01
MD5 072d0dc1060104a228db436b3e170ccc
SHA1 b315530a094b5cb40a47d220dca4b83baa2b8a3b
SHA512 e3793166f8b2d4a23d54cac2fe595d6e9a2e01e6636201cfd03cd88ccfb3eb080c79e0f99f50cfe75ac880f6e186f5c808b189c3ea11b89dfa4ba75952e9a667
SSDEEP 768:fa+29Ag8M9DWhgsAocneKg2ZgyhTpditX8iS:7g8wDE2L
TLSH
T140F29AF783E5C62E89115AF89B14AE1BCF180625432C3C2589D5BE47E3E2472E16A74F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 48f9ad6d0772ac65831713196928a7ceb6b4a76cf8c3f899359875cabb2f1990
MD5 d9e12ed70bc039e4734b3c1a3b625c04
SHA1 7a089f5d98d806d7e713106083a6ec54aea0d96a
SHA512 beda0e1786bf0474626acb5a581f1aa6f24f268aa88f31fa1018e2d6f48a1631e51131218907d5b2fd7b3c7536f92a1e014e7fa5954cf9789854694e69fcba9e
SSDEEP 96:RAUwUhUeU1UWieU7USUIUuURUnU2UaUTU0PUqUWUgU10UeXKU7UrjUKUu6UBUbJn:RAUwUhUeU1UiU7USUIUuURUnU2UaUTUU
TLSH
T1CAB1AEB7E2BF791B20E948AB1E44F906197AE8334551A8F4FF53E12DB0864F71B06097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 e34269822e86cc005fc8b2427488fe12e5dff4c2be0ee3b66597178c51217bb8
MD5 7187b61e80b462739c2b3d85516af792
SHA1 e63e8a10df416f360a1de69c0eae0b596c2f8914
SHA512 194597a3140ea63047e745e7abc82e9a23face24b9368008d9692229af4ee753468c5793a6800f85fb71b5151dc44aa652847a042a6779d2224546e06752d8a9
SSDEEP 96:RAU3U1UWieU7USUpURUnU2UaUeURUgU10UeXKU7UrjUKUu6ULUZJiU7SUIUyQUh4:RAU3U1UiU7USUpURUnU2UaUeURUgU10L
TLSH
T1E591D2B7E2BF791720E948AB1E44F906197AE833465168F8FE57E12DB0864F70B06097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 aa41252febb5b9c2bbf52331516c6007a14e5d8e2e0bc94d4f618ec3744b6a8f
MD5 b6f6ba6df2773251bc4726c11f4a4bc5
SHA1 9fd0af4d8afbdf038bbe371198e6b7c2a380a5d0
SHA512 a51464893fb3deeba279fefd6804ba4878d35e78bc5a373eb3d19acd919a44d9dc77674b171ce5994dcd89745dda47fe3554be0ca596d7c4790994390a5772ba
SSDEEP 192:2RMcBzxo0iav7EzCPRpAnUAxbk3EAzLk9UHsb+WNl8xoKx1+zBH4UTAE8qEkwTRb:2RMmzxQ2IAXuGwuu+vE2zNarv6
TLSH
T11A72B75BA950397B9DE7C239F911B72BE3B5102161D41E84BBFC8D2C20E76DC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 82a2aad20b49a21a73d9fdea244b2b8aefc3ddff70d06b7c5e2e7902d02455cf
MD5 a033a3fb7bd394554aa34c40d639fc8f
SHA1 5495f020905e81360b7d8b801d9d975bd288b1db
SHA512 2fc93e305c7dcf5ef44c4544c664f8a448bfd862c5e875107d318d9255f7bd6ca2e68d77ea02c893db580ee8154ad9c71bfd4c59fd88fc5356419ac596807a09
SSDEEP 192:cR0do0JKv7EHCPRpAkMOgk9UHsb+WNn3wiTAEsqEkwTRraX/VyIsnAUgvf:cR0d7GIkXFGwA9EmzNapvf
TLSH
T1C352B66AA910397BADD7C339F912BB57E7F5102125D02E84E7FC992C24E76DC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69d9e728c0e6796f21bbd5cbdd196c7dbf5a5b11023294e1cc22a10c2b160993
MD5 dfb54b25efa066e9b47292ccd981a7ec
SHA1 c26dae49269b603d17406fe5589acedbd3d13e5e
SHA512 2f40f2d9ad6584d94f1da3f4d5b7b86a01054bf2caab62911d1ed4d5bf87a5cbdfa6765b3d4ede455e87fb4868fa4fcb170f2125bb4cbba801fe9357bb48b251
SSDEEP 192:cR0do0JSv7uHAPRp2jNgU9UHsb+WNn3wiSX2PqEkwTRral/VyIsnAUge:cR0d7+KCXOGwAL2nzNaPe
TLSH
T1F342B62AAE10797BADDBC229F912B757E3F5102631D42E84E7FC892C20E75DC6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 312aa12bf102d1654b5460d0c8b867ed7b3be32a53f5b193b55d4e27d1a1efd0
MD5 08a50c5dab519fb0f4caa729f577ec48
SHA1 29edf378bf56872f44ff9cb38055eef7da22894e
SHA512 8a0806fe66968afd3903e61a4027b5901e722252ee5542dc5949b8461204f446fc0ecc746650f9c4a37af0ba7eef3683c2fe63e877217cf340472082442195fe
SSDEEP 192:2RMcBzxo0i3v7EzCPRpAnUAxbk3EAzLk9UHsb+WNl8xoKx1+zBgHAtTAEpqEkwTN:2RMmzxQfIAXuGwuuUA6EJzNarv6
TLSH
T1AD72B75BA950397B9DE7C239F911B72BE3B5102161D41E84BBFC8D2C20E76DC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cbe44c2340025d73869ecfa37e363fa012ff902fda38df88d348ce0977fe0eaf
MD5 b5523cac2d6e9740dd220a77afd04530
SHA1 dec46023f44072d7ba8935cf7569c60be10619a1
SHA512 d5d79870b1d42f263fe86671cffa37e624f70045c80734e5c89250d34f29076a871564e53d1301f2f51dd45dbf053f3c730ac139966460effb3692208aeefafd
SSDEEP 192:cRsdo0JKv7EHCPRpAnUAx33EVLk9UHsb+WNl43wiTAEsqEkwTRraX/VyIsnAUgvF:cRsd7GIkXWGwX9EmzNapvF
TLSH
T1EC62A45BA950297BADD7C339F912BB6BE3B5102521D42E84EBFC8D2C20E76DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 02ad81f17885c72d08428847f21bd6196cd8313f6e9fb7b8f5be21dbcf910201
MD5 859b420814666d5e43f8d89007791d33
SHA1 cd19caaec6757aa87ca87bfbcaab6142c96566bc
SHA512 3bdb14fb4cb8d1709b6adcf4be7c936484b542e2d9b70cff44747280fcc28334b101fe7b98aa5119307db57de14f97ec58f4644cc8d39c15eb50e2db016cca84
SSDEEP 192:cR0do0J2v7EHAPRp2kMOgk9UHsb+WNn3wiHQEsqEkwTRraL/VyIsnAUgvf:cR0d7CICXrGwATEmzNaNvf
TLSH
T1B752B56AA950397BADD7C229F912BB5BE7F5102535D02E84E7FC8D2C20E76DC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 1757f091fe6d04929773ed1ee5237e565ff6b59ee8b7f9d19ad83090934c7a82
MD5 391fca5167ff989a606cb003aab92377
SHA1 e172ff37b7ec4d5ceb9294285285c633e191052c
SHA512 c891cd6ae5c48dd7ef2fe2831e3560bb0a77d9ec5002725e0785fdfa91d1e1ef46144ab4e0936dc491d59fca6e1c688ea3f53f7d9c10fdc6aa2796c5f75bd26d
SSDEEP 192:cRsxo0JKv7EHCPRpAnUAx33EVLk9UHsb+WNl8xoKx13wiTAEIqEkwTRraXYPyIsi:cRsx7GIkXWGwua9EyzNayvF
TLSH
T1EB62A55BA9602A7BADD7C339F911BB2BE3B5102561D01E84EBFC9D2C20E76DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c656fb338326b2cb354be5fa18afae80aef66f17aff9991e7bd859a9be5d23db
MD5 4479287461826af28202cc9b553263a5
SHA1 7fa6c64eadd0e0e0c78979891bc9ff99f0120648
SHA512 d2dfa762659bd876c4af8c392f99769da322bbf737792e698443bb08714481c1e48470691fec7e2e362d595b5bebc4f70f1a9450b10b6bd793c34cd5608decc0
SSDEEP 192:cR0do0JSv7EHAPRp2kMOgk9UHsb+WNn3wiSX2PqEkwTRral/VyIsnAUg5f:cR0d7+ICXrGwAL2nzNaP5f
TLSH
T1AF42B56AAD10397BADDBC229F912B76BE3F5102531D42E84E7FC892C24E75DC6217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 a5dabec9bd3055b602d7f7d94a2a5a26bee08e7bd27dcbebc8428f2735f83fc7
MD5 185fed49107f3ac971773ccd00b40b3c
SHA1 d9a364646d5d8235b2ac00d0ca2ede252ff62ad6
SHA512 2d12cdd736f56a246c7e289a8d011be7e42b4a8d07e5f8c61da18b49ec02b6411fd27dec20904c1337747cf27096f799eb017e09d6647722658c5d139a19b916
SSDEEP 192:2RMcBzIo0i3v7EzCPRpAnURSxbk3E8JzLk9UHsb+WNlqsVxoKx1+z+z8+4JyTAEX:2RMmzIQfIAXgGwjunrNE1zNa3v6
TLSH
T1C772975BA960297B9DE7C239F911B72BE3B5202165D45E84BBFC9D2C30E76DC6207403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 6d4a7114878c192b7306be36dca423aba475ae62e825bbb6f68274147558695b
MD5 13cf3d670abc4c273b8e847e7508450a
SHA1 a746f5a2a7f8ab4febf948280d1a9f0662f606f1
SHA512 20dc81d8792b1ac8f8d9d160d97c9d309e6253c59e4ecbd8942575989425943efea523072131b00d526546b48ab380a00ae75acb7836d0c47f61bb08d860d45e
SSDEEP 192:2RMcBzxo0i2v7EzCPRpAnUAxbk3EAzLk9UHsb+WNl8xoKx1+zB7ksTAEUqEkwTRb:2RMmzxQCIAXuGwuuWHEOzNarv6
TLSH
T1D372B85BA9503A7B9DE7C239F911B72BE3B5102161D41E84BBFC9D2C20E76DC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 588ec4e23de328a0c90da9ec423b68de80e4a87d866f1a14ca269571878ea2f1
MD5 ea1304721ee733a9770c0eec59acea52
SHA1 51e195da9aa84c80d909bbe46695f1c5a82ea6c5
SHA512 19245540c7c34b6802186d9c8569eab3778c690082f0faae51a080785dfb5e27b5cd7c692bee4495afc264ade315e8bee128beee43dd6f5c8b905932bc2df970
SSDEEP 384:oKj8P7KxkXqKf/pUZNCgVLH2HfgslxbXOD8T+ErU3s0H1PEbi:oa8P7KxkXqKf/pUZNCgVLH2HfgsfDOwq
TLSH
T197521B67688D9A3B0FD8D64CD8177F4FACB1015776B8482496FA9C0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a00c86a3-ba89-464b-955d-6c55b1c28d74\index-dir\the-real-index
Size 2KB
SHA256 20ba68bedbc6f2df8fd2fc32d1d8fb83becb0157c8a08d6dabb15d6e6d97a54d
MD5 6827ad2aa6dac1942c110dc99c5bf872
SHA1 2c173e81822888f378f8483894d2382eacba6488
SHA512 9b9f1dc1124f044b6c12ddc93cea76af16dc8c3d2f50f7518631087e23e14a703808ab3558ae643847e99a14698fbb48770413d9dfd4e5e24625af21bbea42d5
TLSH
T1F951844CC880A79DEC7161F9189414B257752D28FC68C39281A4F1B634536681B4BDFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a00c86a3-ba89-464b-955d-6c55b1c28d74\index-dir\the-real-index
Size 2KB
SHA256 02db1855285cc99bed8b180a2f9cf09e3ad2166d971301ebe3a9db469550d115
MD5 f592b5fccf8cfb62510f73c97debb105
SHA1 74ad441472f1ee4bc2b664975067b5a61629be3c
SHA512 e580a9240f2805462c89c1887690d66bfeaa28095fd6294d4f2e2228cc78428bdb6793831018d9501c5bbe5aabd2942552d808802515b4af73b2ea870fbc0ffe
TLSH
T14F41864CC880ABADECB451FE2D9405F657B52D38FC58C2624594B2B23403AB81B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e04a1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a00c86a3-ba89-464b-955d-6c55b1c28d74\index-dir\the-real-index~RFe5e04a1.TMP
Size 48B
SHA256 1a698ef41b53cd2c83377ad5ecaa326dadb2c54eb1f30807a3830aa7e5dc25d2
MD5 562d16b8ca677d117d33ce03a504f366
SHA1 1cf0707afeecee7b57c1e639a6612be60d751642
SHA512 bf3f1a48982040f41613b1ec783816c9afea40c0155622f207a773b2f495b354aa50c0187026d8829667a5f740b4223b57964318ca03ca5bb6873cc501030cd7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\aad080d8-0c43-4506-9a56-1825bb50069b\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 8bfc29cb21cf40091a6738cb4ae4842033b697b7c0ef4401f4cc2e118ebaddb7
MD5 8e320e5543e25afe78aed63f43e7b296
SHA1 17c2a9c26c250ee96522bcb1f1ec7da83b0acd17
SHA512 0f217437e583b6f1202e2ae59a0e8c8867c9c7e2e800769ce3b762af78d975878ed3fa149235b0b3cc6cb2ada0c409dd496a3622e11534d7dd6bdf3de45dec3f
TLSH
T1AAD023C655308D961F30EFC61234411DCC559D0DD885EC946A08B0C7647D303C01177D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 1d7af7c62c069aa31fb5d13f9bf87f07ef23444d6b33f3039e446f1ed4102879
MD5 875a22fd9cccccb9c42d901dc4d9be4e
SHA1 ddd87447798bc709fde289593fbfef7db816bb15
SHA512 59179f2b82768ceb45060cc3ef4a5b1060d210f383659f6d0b8f8e36eef04118c334e0dd5aa303d7b6d56ac711a647632b57f4344910fc34a9627cf0ba0336eb
TLSH
T1D8C09BD355508ED74F349FC52335561DD54BC54D94C4CDF4760490412579513D4127AA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 283B
SHA256 fc3692992df07290f200d6cbfc633a0b3de9c0657e8cfd667fe69f8b06ae57c3
MD5 978d4d829ec08a8455e068281b706b23
SHA1 777f408527364987b79e42f58f20f9062ab1a2bb
SHA512 ce86a585e07ffb0563c78b20293768b940ee21afd325ba21f70538afe1152a0361c81844ff3d6994c601397a18832565272e50c7ab58bdc5a545af0bf6e68648
TLSH
T18FD02BC2E6A00A95CE33CED675326D6FD96EA8045484DCE46A89700936B9607F052A1B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 52c30e1d96be3986f7ded5e08931c9143a38113422e19b246a3acd6375129698
MD5 b50482bb64c6cb36072b4818c9491a12
SHA1 5c000042b52448217b43a2a062886f81e98b73eb
SHA512 885a8443b3ab2986edc0e582579a794a8d4979e2fcfcd64ecf5928386e7442420134204112b7da1c0cbbb8a791740bd4c4c6dae72438b2d4204a4a048dc612f5
TLSH
T112C09BD355504FD74F309FC93235661DD54BC54D94C4DDF47E4490422379913D41166E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 666141cf7af6601a8fe4df8e2320f62115156c9b1bdf8b2188aa762afdcdf737
MD5 bb58ac5cd3ba545d8813800a1ece6796
SHA1 b4335ff255ba0a9568cdefb252ec2d4eaed64e10
SHA512 65279f0fb8fcbe73ea1199330bbe5413e0120b26854e4a96a58741ad0a57e42a9fe4df0ea53d89b4e07da9b9adeb6f7638e3619e5c8f665b21ab78af9986d4e0
TLSH
T165D0A7DA96315EC2C7309FC52235544DC45BCD0998859CE95D44B04321B8723D01156A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 2fef0e885d829dbea9820629734aba8e8dbdc2bea73efd427280b71d033566e6
MD5 146377777dce3fc101571b790a49e223
SHA1 f2dd58268d7d94f60e8ac7bdb805856d7bdcb15d
SHA512 c4a99efb4f7cb77db53bb1fd4504cc5deb3fa326d7ab383b703751ba50b282063f6e7220e91a6a7d212b1eaef478ba84d551b703855e7ba2fcdc4a1b0394ade9
TLSH
T1A0D02BC2E6604B95DE77CFD67932AD3FDA9A50045484DCE4A58860093479606F052A2B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5de784.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5de784.TMP
Size 137B
SHA256 387cda309c503294ebd812cac93a4832db893aaff6f2c6539b017f9260d82b31
MD5 e3c43c797fda1b7e7394f1fdd0f0962a
SHA1 9ef900ca0260246c96ab7a822248b82a9ea5f993
SHA512 0a0a16ece08e4fdcbf2e3fca12161cee2ff518cd02af68bc7915411dea4bb57c2bbc646185cdb4cd624b02d9115a26dbb5a199b6cad0d95bd24ae946cd71179f
TLSH
T13AC09BD355604ED74F315EC52235564DD95BCC4D98C0CDF4F605B0427539513D41166A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 cff902034b9376ed8a50db0af9f9ad8b053daacb85b69d87f58ec9179de9303a
MD5 04295a9533ab742311d80f3cefe2292c
SHA1 f546b89b3b79e2a0b5c5007e8baea056f6b4b183
SHA512 96ddfa71e0bfd244c2d37675a904dcd5967ca8bbbea5fbb2cb42fc68b410a10db113b35233d52430dabc962b8a1b0afffc3bfe18c916091966848611137b273e
TLSH
T1FEB01206C0898D52CC4041F2550000CC20105E388201A262A2E40581AA430F01125064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e0960d30012e4a358fd8e2b890192cfbb4e3c9599507cb73c81b83968b84e998
MD5 3ce3f20a463ea4423c22f6dfe99c133d
SHA1 55bc26775ddf618cee1fa01c4595e7aa913c9ba3
SHA512 4a784de33b9b5f67141f721b5d4e76e55928089cce9a9b77b0d56068803a19573046b9cd284fcc54f57f84dcea696198f094b10661ba305c6202191a36e2c372
TLSH
T196B02203C2030280C0C2C2B0200200CCB002AF38C8238A03E3F00A83C8820F80B38E80
MD5 SHA1 SHA512 TLSH

Submit Download

2397f3c28e14347a_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\2397f3c28e14347a_0
Size 63KB
SHA256 2fbce1848c6d15fe5b93158d6e990e1def67c47192113be90047d4ff62866d7a
MD5 65fa8b2cc0f8e2b0dac10c3db535c811
SHA1 0f05b4dd66f54bcdb7d6d433e21a597b35e45e90
SHA512 e2067495e1ed9606500511e0b4c243132d90a0f0442f14b921e0675d1f9198fa2a45f5d63f1c4a11c05c9a6d15e09565754bd7563c014e4ef1c3d0252345d11a
SSDEEP 1536:Hmy3ZRaibi73bzuQ8iP3JCQvyqx0xE4swq4onGGVBw3i:Hmy3uibi73+nifvB4szB
TLSH
T159535BAA337178B3827B61F1905F1307713EE1A7B40484F8A298EDF15A54AA94277F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 3b177e2c2c7e8f53d06dad373a657512e51f12db2e87241503b8d0cc508d7408
MD5 7a497aae5567b42758243b73f16a9164
SHA1 cc2f7692a931b27dc958a79a07515198cc30a073
SHA512 138dab404c5b09c2e51a4fb8ab1b4ce952a781044b9bb3570717dcdc3b3b03a6ce9b443c85d6239f739db86e2f5a6df7920e4fed6f0fb00df37ea806a9606820
TLSH
T1A6B01128A8E82882CC022BB082CB8080232C28800288C20BE880000EFE2E2830220A08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f2b82e5220618eecbfdda3ecb8a19f428beadeebf11fa7c522eb2f7372b6d453
MD5 654ed8a8770172a5d544c9fbd5d81d92
SHA1 c0a130bef479f526cfffb761001e5d1efd425650
SHA512 3f3d84b7b7d58d0ab7e40b7180945dbe2e13c436e8dde69b873e90a34286010c3a97c4ba8af684d53d28d99b8578c53eb574f233bf601223c8eb923651a8ab27
TLSH
T1C3A00210E5C80C6DC4721273928381801318AC901158420265D4194B89945808601100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7761b91132c85a0eb6139163cfa43f683a1825297c1e699265bfcc8220f1100e
MD5 e17999a842c780341c960f4476c443b4
SHA1 ae177306137580a53a89ddf4457aaa288f6992db
SHA512 578ae02a74ce4e6d582678f9c3f34e03caac817fcb6051f5f2db084ea5d2d965648561f0d7451c19028005c7e0c6791b5c04380e82fe2acfe17958de5b176e1b
TLSH
T142A0029052E00496DF604771A06147C162724D5419A5C34769E20595AD9F1CC4B19951
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5f033bfab40bb00a736822bc32160d7c6eaba10db42a9642197ed6c2a9a0fa21
MD5 d2be8f7b0243dc2704f7e3bbf0d1e76f
SHA1 da2419ae47d7c351f5a7af64a09808e979cdfaa8
SHA512 aeb7e530fafc442bb216243b5aaffbdebd79e7fbe09df2ec9af315596148e3afe7673d5166854dbcdc9a9ad71b948e679d7243aa576c34adbaca4627b78239c1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5e5206.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5e5206.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1908_1012659459\Shortcuts Menu Icons\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1908_1012659459\Shortcuts Menu Icons\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1908_1012659459\Shortcuts Menu Icons\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 355dc9d631830e9223bbfe141375dc50e341338e328b34565f62af9fb4ebf410
MD5 d3b723ee151fc4bc98ebeec8a4afb01e
SHA1 e3a0ca0f8736777ba29a2003d6c5da0d86be410c
SHA512 66aea4bc01b574ba6f9055ce40880b230bf5336f503f4737d7eb9b6ec1f308ef5ae311a9a3ae55c8f9f392565ffd2c00b4552ef13ab7e395679b060f5bc8a7f7
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5hs3D7B6AGyvODqLA/bjv4a:gC0AJr7fbyVlFDUDgFkFqLA/bH
TLSH
T11DA11972F4665C3B9DB7D548B5123E03CFA4A2ABB862AB64D9ED1F0C10EB0E80741527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 159KB
SHA256 11daa9bff386b33193051e55cf7df1b4ba2b48f4347df09945c905a5b5ce5e25
MD5 6358f0cd6378b9da3ffaa614e9843b92
SHA1 0debc8ee3ad1fd9db5b9a583f5a2aa0f5ddc1eda
SHA512 5fbf271669de99f823692f72a188d336bacb83560109d8a8338e89c3e629a3583a3318071730dd68059a91998f3243d5aa46f5bf0a580c2f8e4fc086b0c5e81f
SSDEEP 3072:+kHgQ8u6Dleb4HQ8Evdz+4sZxgNydZhHZILGc1Nid/PXpBogR9FsnqTGXpGFa1Nr:pIleb4HEz+4svbPhHZILGYix/pBVRTPY
TLSH
T1C4F312F1FEFB8E3F9B76F331D74B2507497291214421CCE460D96EAA6088AFB1607945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 414b74b86a4b747ded66cc61a084c4cde6b35b205df086f2561e374be337c48e
MD5 ddc9259fb695245d880b0a887e9cf1aa
SHA1 b58767726733676eff4a28822b326f54016c6ef3
SHA512 80deeaef238c22ef7a8399689cb569e58140f4d82c679423242f190da7a57a2b6273e8b5e55991a869622237faf3d413b2a34acfbe687e449ee4e1aad86d3ffc
SSDEEP 3072:8eHAHQ8Evdz+4sZxgNydZhHZILGc1Nid/PXpBogR9FsnqTGXpGFa1NK:8FHEz+4svbPhHZILGYix/pBVRTPFaTK
TLSH
T16ED312F1FDEB8E3F5AF6A635E30B25074A7293228422DCD0B08C6D9D914D9FB1907942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 dd2776439bba183b49183e35ab4a804dbf03a47f64773bf3abf95227f06c3eea
MD5 214c01c3596b9d86b9025c8e4a839cf7
SHA1 24e6961bfc8ddce65c2423f3a188910526aaf16a
SHA512 82e9cc4348a4887fe40c6485d2bb11219f3e45cffecbdb9780c666e17e6c147a89f47ed2c504dd2b0f2c29501f2560645573366070f5298c060bb68404b26f1d
SSDEEP 3072:iEpHQ8Evdz+4sZxgNydZhHZILGc1Nid/PXpBogR9FsnqTGXpGFa1NK:ikHEz+4svbPhHZILGYix/pBVRTPFaTK
TLSH
T1F7D312F1FEFB9E3F59F6E231E30F150B523291218522CCE160895EA9518C9FB1617A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 eac412ab5d601f17e88ce6055a32235c7b0ed759b7f097c5e41f1f35ce1620fb
MD5 d286c96ddb5257022ae89b5e82d9541a
SHA1 3ea4311b13a3790f0c1e9efd31b4420160d2d04a
SHA512 0962556a87993c11101233ce6ecd7231eb76b0c85c519f6384f4309e8d8ac7d497ecbdfd4eaaef00849897733a19424968cb7249e8900bdc10ce8c5c62b3c354
SSDEEP 3072:bEpHQ8Evdz+4sZxgNydZhHZILGc1Nid/PXpBogR9FsnqTGXpGFa1NK:bkHEz+4svbPhHZILGYix/pBVRTPFaTK
TLSH
T1D5D312F1FEFB9E3F59F6E231E30F150B923291218522CCE160895EAD514C9FB1617A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 267KB
SHA256 09c9f29e87c04d1e2cfd0450205204d19b734776972c0862d19d8cce44bda3de
MD5 05a96bc3587363efe4a0cfc70d05d4b2
SHA1 670f86e39733b130b89ab3e79ba856969949c549
SHA512 b9192b8414e0b428a952a9c4cb174e4d79ad7e308a363059e96e05a1b52d501adc927df6d5cee21b6cc43e4473272bd377292b8957cc5dd8d315a6e68ab30069
SSDEEP 6144:nIlebYoqEXQJs1JwOi6/QVE91jWHEz+4svbPhHZILGYix/pBVRTPFaTr:Iljo+M7J42LWDIyYY/nFaH
TLSH
T1844423F2ED7B2EAA4F75B37897063F076D71E1A64518C89831C62AA552CEAFF0103416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 b5243e98729f2d07df6fd3d916f3f4ac5d05df79dca4719c261e89a66df10de4
MD5 ebc673cf6514b0654030e00adfe4deb2
SHA1 006fe21d50ffd057e7a66beb2ecfb003a6b4dff9
SHA512 6c6dfad9333871d1e4cff433b37b2465bb356e12e3cbece8719bde5fc3673f3172e44f9e5da4ada729e0c1439f319375bd70ca7553f596c680b078bb6c62fa1c
SSDEEP 3072:ze4HQ8Evdz+4sZxgNydZhHZILGc1Nid/PXpBogR9FsnqTGXpGFa1NK:z1HEz+4svbPhHZILGYix/pBVRTPFaTK
TLSH
T166D312F1FDEB8E3F59F6A635E30B25074AB293228422DCD4B08C6D9D914D9FB1907942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 cb5319925d163866ece169427820e6a274b4c9f440afe4e300d21ce477f3e577
MD5 ef6def7548e4cd7575b6107ac81048d8
SHA1 b394b0de97a6193341c37ec44891bb9b1e3f3bcf
SHA512 1848714733148fd911dd24713c92388006ef99dff7a18e3dcbf71ac245934ed44706dd3712041e56a8624584cee8471be9c62cb4f23a29794833e9ea339dbbd5
SSDEEP 3072:TeHAHQ8Evdz+4sZxgNydZhHZILGc1Nid/PXpBogR9FsnqTGXpGFa1NK:TFHEz+4svbPhHZILGYix/pBVRTPFaTK
TLSH
T113D312F1FDEB8E3F59F6A635E30B25074A7293228422DCD0B08C6D9D914D9FB1907942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
Size 14KB
SHA256 41bef37a2f17716d0ee8c6a05924b67031a41302bb0377085bc312d7e4061dbd
MD5 2818b8d442003cfad82384c77d57400b
SHA1 b96bf33c5b9dd1c4e7091fcaa63d3bffd935c374
SHA512 1fee05d9b8f1a837cbee905b477013ab4163751da9bf9b7421dc977898169caed6f99881b7034ad8379f16dad98c0439f2adb0622bc0121e81d9f2e404de7fd8
SSDEEP 384:ariol3FwaVp8lzrZZrzDqT5fERZW7j5U/qdc741ybaS:oiol3FwaVp8lzrZlCT5fERZW7j5UaS
TLSH
T1A5627A29A465DE2C87A01ED03C3F294F5E963310BFE696F4E1FF4E0076818AD2326765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zed-i18n-windows-aarch64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-X9IJQR6AZN.tmp\Zed-i18n-windows-aarch64.tmp
Size 4.3MB
SHA256 cff87f38d06f7e49870d6b6d6a5b17ec9596d94557f96670f428c63115fe736d
MD5 03d729669a71af4e842928748cbb0d24
SHA1 a241cccee2a106469e0614a080bd0c0b1832afc7
SHA512 baa3a1155afa88afa8d3389e063a4678ffce2596fe7e85304cbc470e9618ab55533d837c1ea701650af464382045e7497daa75a8adb662a2ce824f2659e1a4f5
SSDEEP 98304:lYU5hnuOajWwMPdCpepI3GrwrA+JU333+:XxuHjWfZIzP
TLSH
T18D268E03B388753EE4671A3A583FE284943F7E213A26CD4B6BF4095C8F396416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1908_1317983518\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

BackupUndo.gif

Path C:\Users\Admin\Desktop\BackupUndo.gif
Size 412KB
SHA256 26d65ace1e36ddb951976e2409fcf176f5466281b67f6d4d4eba6ce6e8e68513
MD5 a644b93581ac415ca5be7110694f4221
SHA1 fd0401144bf0cb5ed734c53891f49d660dfdc080
SHA512 dab4baae399569fdd85308c2fba4d2f8bb58cd551036d50114d75e19b091d4fc9045c2f31bf06644ae230b3b60eb4e0a49aaf41daccdda228e144d25c2653e9c
SSDEEP 12288:qAgedxmuLz2RaR+EKyT8hRip7hiCma1iRdQRJBrf7VKafJ:qDedMuLzWaR+Ev83ipQ7R2x79fJ
TLSH
T1CF942326C4F5262CB6F102D05581F8816CB1D6FBB5E812B05F956468FC3EEBC52C9C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointBlock.odt

Path C:\Users\Admin\Desktop\CheckpointBlock.odt
Size 334KB
SHA256 524a4496c566f42911edcfcabaa1d473b65eef13c8d305b951ecfafe782dbebf
MD5 1493b108e1bdb17efe596d8147085f53
SHA1 ef430e7029c374767f849c3538b8f24ce936cc8a
SHA512 40678aca3c8ee269878a976f15e89d2e572b0250256b6bc32682742f609fa0fb97fc4d3ce73711672923bb050107e33223fa7b3e658bc573fa7b76a1a3d74b25
SSDEEP 6144:DhVaUyrcmGBYUxoz0xdPzHjTj3y6GTN6qW/KwNyNEJGKeZKrFpFC:DhlyrcmGxPzDTjC6GTNxysKeCFpFC
TLSH
T1177423C0236FFF1C2A8F9D9A9301E805413B6CE9036D94DC03D9229739AD3178D59ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyExpand.jtx

Path C:\Users\Admin\Desktop\CopyExpand.jtx
Size 566KB
SHA256 90be5a0dcf2e911ca6b3a56999f173925b92eb847c705e6b869414b6cb4c3efe
MD5 30825e78a19932ac52c9c71458798345
SHA1 7f3edf48583372e9bb3f68a8a77e1f76e3bf4165
SHA512 475374d12f66d9d9f64baa1a3a585b8a1c48026f3e006f3a99f39ed6e2e4a664cb07e1a0b903f91e29ef57331db8ea753910692dbad544ed4d665307e7fbe98d
SSDEEP 12288:FLJ15ag5kxUzy1LnCtdp8k3wUc9V6EI3wmab1DKnsi8S91I8Cx6030SZKC:P15a2kxGy1L2K8wUOV6VzmDKwSzI8CvN
TLSH
T116C423D5693EF91EB2A09E3FE3C89543EED578108B0B33A1584C44DC56DF4B269A123A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetDisconnect.ppsm

Path C:\Users\Admin\Desktop\GetDisconnect.ppsm
Size 386KB
SHA256 e3ff22412d371baccedf5f88ce495ecfbaf4bdfec12269a10ae12b3fdf1278bf
MD5 d6c8c9c21489a4471e3349b3015413de
SHA1 c979d3d2bbfab595d32884d3a28fbc622103e79b
SHA512 3b740ebc5e91611254a47e550adf15a8ab21d20e33d8fd9fd6c0e53478186b23ad74da8c8f2634eda8e0f0409fd524b64a547c09bb03367dbafd75aa11e2ef2c
SSDEEP 6144:ggIO78r0pGj+tpGQPfwACnUVEUQj+AnZb29+M/7ElEdk4L8zA2yXTf0e:gPA+0pGjOpG/ACnUVZAc9/7E2csX
TLSH
T14884236587F3D6DE6AB5A3731DDD2A44BBF9F11B500913A4338AD14D2D840B179BB20C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewAssert.wmv

Path C:\Users\Admin\Desktop\NewAssert.wmv
Size 540KB
SHA256 85973fcf81fcd33c5935d76a6c7c123144cca022b42c9b004792c888734751ef
MD5 ea8388b7637d047b05a76dcb14252dba
SHA1 992856320bc970c56db4311e69b53063824bcd36
SHA512 905238dd6b7a5ec49c4bb43a93617c49e6d47bc4f1acc61ec898db8f2fe4ce65a839d60f35a22d7528698177d67b228107b0be2680e0067171dca094ba79f5da
SSDEEP 12288:YLDpfgxxiJZqiInrRgtg+1wvYFKo4MdctNWWoq2vzv8V5FfgMP9v3YzU:wU6s7atgNPvehq2vOFfgMPJ3EU
TLSH
T15EC4237ABAFE3B4073744B7DADF68EC40A60875674ACB080C165AA42251F31FB75CD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeRequest.sql

Path C:\Users\Admin\Desktop\OptimizeRequest.sql
Size 515KB
SHA256 b4e4c2c7f1c7d43edef8aa5b3df92c3178fd556be33c6b59637ffbba210ed803
MD5 6cc6456ff23a85759b32480716fd29cf
SHA1 888c18c395dc02261f72b16f8578ab82e8c730c3
SHA512 a2fd38e430285ac01717e5f41128fc66be1ba310d0520016f7701aff5124e16a02511d20c089848312c02cd54a0cf678117cfcdb2b78f93979a7a1ab4bcb655b
SSDEEP 12288:xcz2xgKhzfHZl/CkDb1A9PVaKgjbnXvGuc4j3eP7w:xcCxgKhb5lFfab9g3nXvtRj3eP7w
TLSH
T1FEB423BDAD08D9336AEC3533FC8FB3A45DD525A8D1E04E30CD26E3A23756602B598865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveCheckpoint.mpg

Path C:\Users\Admin\Desktop\ReceiveCheckpoint.mpg
Size 437KB
SHA256 366069f82723028ed1c418326bd35b74d410b78dc01cef75bac2a74bce9f25eb
MD5 4e8263358f72aca96474c21dd41fea90
SHA1 a26cf9cca9e15383308dce26b377968ecffdcac7
SHA512 9a99c0696f73e1afb08c66e627fa5c6b20c341a28942de891e5c00a3ba0874cf71fea0c3a9a8a1aa3cf3cd61d3196a83d6d4389528af642a5a281fa75c5669d8
SSDEEP 12288:9K8c1ulDgc2lqXIBeBzDlEcIpuRqTd8ssEUKI8ECc:9K8cY1gpq19DCjpjamc0c
TLSH
T119942337E9ECE0D78F4850DD89B816FF260554BB6163D31E9A09ECF1D410BE03EAAA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipStop.vsw

Path C:\Users\Admin\Desktop\SkipStop.vsw
Size 489KB
SHA256 0d1b6511d03fd3991c9082c4847261676e2cc2e9b86f2db431cd1094f0beb2a7
MD5 2d7ea6242d244ad18993e9e652f19aae
SHA1 74448dea0bed9b06f13c19ad808d6449fee980cb
SHA512 0a5407992a8945092628e652f789b7e82861a2ecb381b5870c3040f97e85e296ef84fb6777861880d468f07be607922248813ee523141c46ffcf5efb0394e5b9
SSDEEP 12288:KYegbm+yT+YGTqQsteTPfla3S7s0YwVCJbUelHMHiXGNst1P1jaZgs:KmVG+YGTqiTPfA3S7s0yUEHT9tWKs
TLSH
T187B423CD33D2EEDA9812D30E7FA5F159D2509888ECE18BAAA005B0D7477F1C407B5D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopCompress.vsd

Path C:\Users\Admin\Desktop\StopCompress.vsd
Size 463KB
SHA256 def3b5bae4b22ea03a3a39ffa72891833e1c912c7f793d8821e8aab0b0e5bbbc
MD5 16808022d904c7b4104954a804d774f6
SHA1 83b7007ac667091cc0691038f9937fbe822990cd
SHA512 e437155939c80228587404b737b9ba3dcb604202fc260fa7c8cab1e118f8c2baafd6975de6c26cd00cdb8d5b1d446e3559bc17ab05bf18b4ed569c7e809a2089
SSDEEP 12288:g6FhbT5G4d4xmerc9s8ufSe4xvzOn5po414IIa4PNpZwXq:g6rY+BersufmiiIJccq
TLSH
T10EA423D337647A90261137E5AA0054E8C2E8283549B707A57760FCFAF8578F92CE35ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitStep.exe

Path C:\Users\Admin\Desktop\SubmitStep.exe
Size 360KB
SHA256 96bdaed9eb7c93be68b238ff3909f26fcbcc6869ae4e06e33a37870f83370a9d
MD5 983d697441c774eab08795a912b9a5fd
SHA1 913255bcb37a4d3be2cfa5032ea5224f26cc17b9
SHA512 858bd1268e0a0066ec74a20a04065f58424f3b73b323c9c1d764535f41a9f35a00849d1089357dfca8cff9712f9bacf1112f99bd419be621895925accded08a2
SSDEEP 6144:YMhPn5aMfIY1blhDoznP3x6k4uNFyyWrcIkz08EWUFSX6mL1nESLOsMkQvc4:55Bfh1blNynPx6k3eEImrEzgqmLhESLC
TLSH
T15874238291D2D5EDEE412633A36F91325C676D78B9752DEC738022858FECB1E09F7250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delete system32.bat

Path C:\Users\Admin\Downloads\delete system32.bat
Size 1KB
SHA256 50267c0e00dbae0146ac9729d449de2a36ef58fa043f097bc07c82eacf3e13bf
MD5 6ecefdcc51d6d95715efd169b83156bf
SHA1 781f64b68f10adee074c0e564d81d0169baa400e
SHA512 61cd529c01240c4c2aa1464de6c261ee956f6f97b5fbbce5a9072fa982e5a265a0275304ea3f0badc3f69d96ab21f4262b6e7c8f5df8aad80305a340d12cf723
TLSH
T1C4218C3455D37BAFE2A9B356024F48DF9BDA646F38B583E7C9CE32790C4070D8295096
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 d57e9726f4b5475525eab3aa42a97ab5d52409157a04e3ef745e15315f3bc593
MD5 489ffd8d46e0557ac1f93c9b7f4802db
SHA1 945f4af8999fb1611b3cf9781842373724fb6896
SHA512 e5da82e0e270ecb2accb00c9e31146b203f1f9e015a1d2244e825389e2004c9774fc601f17d456cd99145b87a68e382f994e6c1eacdab9bbb4c5c4e0cf9a1db9
TLSH
T19241760277F90A58F2E38A776A733B324F7BF81295145A1D4085924908B591069DCFB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-0-0x0000000000640000-0x0000000000743000-memory.dmp

Download

memory/1476-66-0x0000000000640000-0x0000000000743000-memory.dmp

Download

memory/1476-8-0x0000000000640000-0x0000000000743000-memory.dmp

Download

memory/2200-1815-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1810-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1816-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1819-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1818-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1814-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1817-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2200-1808-0x0000023C0FF90000-0x0000023C0FF91000-memory.dmp

Download

memory/2832-1806-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/2832-1807-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/4732-1834-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/4732-1804-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/4732-1805-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/4740-22-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-58-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-28-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-65-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-6-0x0000000003700000-0x0000000003701000-memory.dmp

Download

memory/4740-34-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-64-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-62-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-26-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-9-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-60-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-10-0x0000000003700000-0x0000000003701000-memory.dmp

Download

memory/4740-12-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-14-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-24-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-30-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-36-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-38-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-40-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-42-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-44-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-46-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-48-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-50-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-52-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-54-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-56-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-20-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-32-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-18-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4740-16-0x0000000000B00000-0x0000000000F5E000-memory.dmp

Download

memory/4760-1836-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/4760-1835-0x0000000180000000-0x0000000180559000-memory.dmp

Download

memory/4876-1845-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download

memory/4876-1846-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download

memory/4876-1847-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download

memory/4876-1838-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download

memory/4876-1840-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download

memory/4876-1849-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download

memory/4876-1848-0x000001EE01E70000-0x000001EE01E71000-memory.dmp

Download