afcdf863c9ac636cd7801e288e3fd3598c52078cdf9bd8aeb70fc5ffe4e80c65

Analysis

user interaction
yes
max time kernel
126s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Action_Loader.exe
Size 127KB
Sample260924-a536vaaa93
SHA256 afcdf863c9ac636cd7801e288e3fd3598c52078cdf9bd8aeb70fc5ffe4e80c65
MD5 f18a63e79c3a07fe51ae982fa705b264
SHA1 4c25483848667606d17c0be10e09568a34ece303
SHA512 841a594e160a80bc1351af81c43d6d1c4ce924c6fe341c0e9bc5f9d2df389e3fd318d8add48e4a8ff840a524b5234d78aa306f321d4d6af1df538b714c8199ca
SSDEEP 3072:gs77w1OlWUt1uFYQMMMMMMMMMMMM/OYteFjdPWon:5mOPMMMMMMMMMMMMMBteFjtWon
TLSH
T11BD3F500E768C4A3CA5359BF59AD7A3229E8BC7614F86A3E27617F5FA9333008D35315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Action_Loader.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1936	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346845913933390"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe
Token: SeShutdownPrivilege	264	chrome.exe
Token: SeCreatePagefilePrivilege	264	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe
264	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 1252	264	chrome.exe	91
PID 264 wrote to memory of 1936	264	chrome.exe	92
PID 264 wrote to memory of 5556	264	chrome.exe	93
PID 264 wrote to memory of 5556	264	chrome.exe	93
PID 264 wrote to memory of 3484	264	chrome.exe	95
PID 264 wrote to memory of 3484	264	chrome.exe	95
PID 264 wrote to memory of 708	264	chrome.exe	96
PID 264 wrote to memory of 4556	264	chrome.exe	97
PID 264 wrote to memory of 708	264	chrome.exe	96
PID 264 wrote to memory of 4556	264	chrome.exe	97
PID 264 wrote to memory of 4264	264	chrome.exe	98
PID 264 wrote to memory of 4264	264	chrome.exe	98
PID 264 wrote to memory of 1200	264	chrome.exe	99
PID 264 wrote to memory of 1200	264	chrome.exe	99
PID 264 wrote to memory of 2984	264	chrome.exe	101
PID 264 wrote to memory of 1256	264	chrome.exe	102
PID 264 wrote to memory of 1256	264	chrome.exe	102
PID 264 wrote to memory of 3004	264	chrome.exe	103
PID 264 wrote to memory of 3004	264	chrome.exe	103
PID 264 wrote to memory of 2448	264	chrome.exe	104
PID 264 wrote to memory of 2448	264	chrome.exe	104
PID 264 wrote to memory of 4520	264	chrome.exe	106
PID 264 wrote to memory of 4520	264	chrome.exe	106
PID 264 wrote to memory of 3832	264	chrome.exe	107
PID 264 wrote to memory of 3832	264	chrome.exe	107
PID 264 wrote to memory of 4376	264	chrome.exe	110
PID 264 wrote to memory of 4412	264	chrome.exe	111
PID 264 wrote to memory of 4376	264	chrome.exe	110
PID 264 wrote to memory of 1932	264	chrome.exe	112
PID 264 wrote to memory of 4412	264	chrome.exe	111
PID 264 wrote to memory of 1932	264	chrome.exe	112
PID 264 wrote to memory of 6024	264	chrome.exe	113
PID 264 wrote to memory of 6024	264	chrome.exe	113
PID 264 wrote to memory of 1640	264	chrome.exe	114
PID 264 wrote to memory of 1640	264	chrome.exe	114
PID 264 wrote to memory of 5420	264	chrome.exe	115
PID 264 wrote to memory of 5420	264	chrome.exe	115
PID 264 wrote to memory of 5840	264	chrome.exe	116
PID 264 wrote to memory of 1808	264	chrome.exe	117
PID 264 wrote to memory of 5840	264	chrome.exe	116
PID 264 wrote to memory of 1808	264	chrome.exe	117
PID 264 wrote to memory of 5520	264	chrome.exe	118
PID 264 wrote to memory of 5520	264	chrome.exe	118
PID 264 wrote to memory of 1456	264	chrome.exe	119
PID 264 wrote to memory of 5788	264	chrome.exe	120
PID 264 wrote to memory of 2024	264	chrome.exe	121
PID 264 wrote to memory of 4608	264	chrome.exe	122
PID 264 wrote to memory of 4608	264	chrome.exe	122
PID 264 wrote to memory of 4760	264	chrome.exe	123
PID 264 wrote to memory of 4760	264	chrome.exe	123
PID 264 wrote to memory of 2776	264	chrome.exe	124
PID 264 wrote to memory of 2776	264	chrome.exe	124
PID 264 wrote to memory of 4800	264	chrome.exe	125
PID 264 wrote to memory of 4800	264	chrome.exe	125
PID 264 wrote to memory of 3564	264	chrome.exe	126
PID 264 wrote to memory of 3564	264	chrome.exe	126
PID 264 wrote to memory of 3924	264	chrome.exe	127
PID 264 wrote to memory of 3924	264	chrome.exe	127
PID 264 wrote to memory of 3424	264	chrome.exe	128
PID 264 wrote to memory of 3424	264	chrome.exe	128
PID 264 wrote to memory of 4672	264	chrome.exe	129
PID 264 wrote to memory of 4672	264	chrome.exe	129
PID 264 wrote to memory of 4364	264	chrome.exe	130
PID 264 wrote to memory of 4364	264	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Action_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Action_Loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ffd646bc728,0x7ffd646bc734,0x7ffd646bc740
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,4073052025798978693,8648061945880851261,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,9744468646816113368,16306743206324583368,262144 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,3913630812560327671,6686387520898809787,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,18222805052185563825,6515221853737583229,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,2861275559169349331,9841303824664127866,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4752,i,12771993778960508328,16854940556413329325,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,15939225452024031837,13117978349255064290,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,8799350058839612977,7194275480554928845,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,8506553583397154841,18252145502906169199,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,14477673058544347197,4660495269970285145,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5452,i,8605443606090729455,12870881148237473057,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5976,i,10972061127895979471,13488188447892208209,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5596,i,8935594214424107175,12948575955141723973,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6252,i,2531518417435451149,1363870263833151582,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6244,i,15350836070553578601,9475527810033089830,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6404,i,18267720943208315879,15582654079206162332,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5772,i,15727542230582960018,6665973684884815189,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,12370593185772469540,11366228806328671413,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,16648068843447188392,10782670578250853739,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4752,i,9458284893091673180,12836748541950719306,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5412,i,1744084649455975259,16416276699918649660,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:9
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5712,i,12241116188791290053,14857992983573316683,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,1866812436806313130,9271623290652075536,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,17976242136646431389,11124090267591473080,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,10343630162712852898,9609896352548776543,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5420,i,11598538210303855746,17233138936423715981,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5736,i,12728173892868470155,6231445684932261845,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6148,i,11733051707978152718,12282552010793712029,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5032,i,3035906654017117442,3391660211329551690,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6820,i,8906514036689476793,5184787653956299092,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6772,i,8016564172701716677,12952712778371425393,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6216,i,6321981940730096461,9458649442619634459,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5712,i,6752628053499259066,9118127750116875160,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5532,i,14829784929531141119,890180810338120474,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6716,i,11399933941192816608,17809319933186133391,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7048,i,3388037620496504014,12907439777874238786,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5664,i,2526231245328522132,17629194751791577642,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4776,i,6270384164233767259,11178619235545183705,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5892,i,11772828886080454387,14931940646447422468,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7456,i,9067627316914837148,10021149692321198506,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7376,i,15834560289421327434,6930127903144248572,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6700,i,6112128478789710836,12815842936128622298,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7872,i,2539346230920151085,4719446997383618958,524288 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7016,i,2977653459943594451,3695160519243150855,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5844,i,8515903695986722782,15094622439067925966,2097152 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8084,i,8731617520120703564,16842185794199954824,262144 --field-trial-handle=1908,i,14878542314961092135,9023779689937841867,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:10
  2⤵
  PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000085
Size 62KB
SHA256 29e3c6c1aec37ac2af49f0a0318d6a4c0653e8e26ef8b3ee91b923073dd3c197
MD5 23793defc1323ea3f3e0b105e70803b2
SHA1 6239daff26359661097ec66f68636b5f3035dea2
SHA512 d699386dfee45ca8c6dfcecd8aec0dfecaa8822afad038e26f56c933712ae7ff9e55db567fcf275d8f2a29d98cd1734d93a9cbc1461d1dda39d1a7fa097cc63e
SSDEEP 1536:mXPI7rkkzxzCH6NGIvaSNXkkFRPvk9VkPf8z:swPzCa9kelvkfYUz
TLSH
T1215302F1179EBEEE6619A648DFCB720A4CFC5F17123531AE5D08991DF1B07672293810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000089
Size 60KB
SHA256 02f1dcc0c722e24cba9be4b720831a79489e766d5edf8b77f582e0869312d86e
MD5 ede84d96808c486e3de74cbd8f2a2c80
SHA1 bae3ce34f928be471ee489bbfe5b7425aee8298e
SHA512 996d7258dd45f8676916f05138e7f3141abd7c0207ae43ca820a10211bd237c6bdac0209967b45c4a1d27c08dbaad2f933d16d0400b0710981804e651d4b804b
SSDEEP 1536:k6Fj5vgPSsqNzcvwFQsQK+CKxd+Vs6lj9BsA:zl5vAqEVXKexB6tPsA
TLSH
T11A530299F9870437E49641B30E7FA4C64DFE3BD4AC7E4CA88259593852E263BB1401EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000094
Size 60KB
SHA256 61c412fbdbbf1417355373a80125c8cf7e5cbaab4218bae0316fe6ef917bf798
MD5 1033a47731e45f7bd46a1962359e96b4
SHA1 ac6abef8d1819a685db48a9515f77a24a153e2a0
SHA512 84ca95f89e0a16efd962b44bd3f7ffe09b328f33c068acd8a1fefd08101d824929e8b9eeccb0786483aa2fd2c60bd0b76fc2242479268d69faab72c48902e34b
SSDEEP 1536:D0bcbU0BkgaaHDF868T5Io63Udr9xCHGD1AMYN4+:gbcbUq5a4x8VV63ErD1g
TLSH
T1DC5302F28B610140E55B9B74EB449D3CB59806124AF275CEA30BEABEEA1DCD0F0D5D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000095
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 28cc1bcf21c96dc62590b6254fd4ac58a8f71f0fade8f72526ca369591c6a013
MD5 28c1622ec7406a1e46b89577b5e0ae5c
SHA1 099cd1aa96bf0e086efafa24e922b66d8f4ee4a6
SHA512 cb9e9e3402113348e401d7223176279fc14de171490308c28e8811a03bab59f95c1231b9b487f12eace10f3247061c10d3f7c7c07cce10e625a67ad9954074a2
SSDEEP 192:DgRKJ1nyZMJ1Jtpj8w4jf5fnW/cdaPpvMfPINPkINIII9uPiPbNXdgq/xLBWhmq4:DgRKJ1nyZMJ1Jtpj8w4D5fnW/cdahUf9
TLSH
T10C329EF7C3D8C52D891156F49B257F1ACE2A0928523C3C27C8D9EE5FA3E2471E25168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6d9662ef3964fc49137d85cd93249a9f88845561bb811cb459e9b0e9eb220ecb
MD5 46826fd15c3452082a5e40a133859815
SHA1 35992476e1fae3e9215f435c5ff158914264efba
SHA512 dff8b356941360dc1178c976c68cc109eae425783f14872a7e72e3032c6f5fd38002bb85ba81094d2c578d5fdd2a79738ed933a1953a45b7594b9e03fce5c09d
SSDEEP 192:BhR4iidJv70APRp2WmXsb+WNnTh0iz2LeUWvIjoiyIsnAUge:BhR4iidJBXYXw90I2Km5e
TLSH
T1ED32842DAF11793F5DDBC21AED667B97E2F5002535942E80EAF8893C25E75DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 69260c91df0481ad72c6efb79669b2f47ae020e2d70d9fc1b64be5ee332cfd3f
MD5 1c219ab80c6d3e0686ae3fd68a93f9ee
SHA1 5de02abacac3a91ce8935bebe012d8ee3525d655
SHA512 fdae94da9c88e8242e3c93d20d7c3487a0c9b8d7b676fd6d50aac28af75a5e36f8cb722f802c8da4cd4111b9883fc148f966a17bdcd5e268c15d1bb910c44a48
SSDEEP 192:BhRgcBziiAJv70TPRpBWzLP6XpJu8hytXsb+WNxwq3UqnG8+TR2Dz2LeUWvcjoio:BhRgmziiAJUX1yXw9hw2X2KK5E
TLSH
T14652965EBE20697B5DEBC61AF961BB56F2F5102535D01E80FAFC892D20E7ADC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8f08f36ca65931a05f5f16bd89036a153fe8b6e615fb04c3e090d04d0f5b0612
MD5 96c5073fdf58879fec725179c7a4fc14
SHA1 2491cc8558e41b05da58f55e9aa9341c5284594f
SHA512 203e67463a156158bf2adc4ce893d441e363a77fd7faa11bbc2ebee874fd87232a40aa8cd2a81ccfbffd1ff815cb31c5755b4374b9b9f5c10618d46c610d58bb
SSDEEP 192:BhRgcBzSiAvv70TPRpBWz2cXP6XpJu8hytXsb+WNxwq3UqnG8+TR2Dz2LeUWvcjm:BhRgmzSiAnUX/yXw9hw2X2KK5E
TLSH
T11152975EBE20697B5DE7C61AF961BB56F2F5102535D01E80FAFC892D20E7ADC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9fcfdc20483377df53f4b563cdfc640c8a32a4a2e919bda47c328ebc8d7ce076
MD5 e4d745b622d19bc54ffcccf8a56e4713
SHA1 fe6b1f7ed6522a4d3fb9c2f08f01c096c8c08eab
SHA512 02c85c10d11aeafa8a0de95caef37dcfe8ad03a1a8073f897b46c5bc9ae9e44709f4dca4b5a99a0b2bded12435f39450baead8328ea72942aa8a4b6ad02be1ba
SSDEEP 192:BhR4iiuJv70APRp2W3C1Xsb+WNnUqrTR2Kz2LeUWvIjoiyIsnAUge:BhR4iiuJBXAXwR52g2Km5e
TLSH
T18832852DAE11793B5DDBD21AFD627B57E2F6002536942E80EAFC893C20E79DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bbddbf29633f9fae41e1bdd32fb567e64d9eaae7c36d3b2e18185d18256fd39e
MD5 19d1b2dd2ef0f2c43dfeaafd1bee8b0d
SHA1 f263102f55d829304165459ca6786ea0749a2ebb
SHA512 4ce88bc21291a306e84b715b75f00ed418781b0ae85be8e560bac09f700a7d64b1c521f2d20d9cc64d9786cbc032bd29c0a7c8f5fe701ca830fb6f35cf9c1e93
SSDEEP 192:BhRQcBziiuJv70TPRpBW36XpLbXsb+WNa3UqrTR2+z2LeUWvcjoiyIsnAUgE:BhRQmziiuJUX93Xwu52c2KK5E
TLSH
T1D242842DAE11693B5DEBC61AFD62BB57F2F5102535901E84EAFC893C20E7ADC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5888aaf1a9bad3dd1b80eee0f86a7b50a72b6b846ee7a5cbceeb0a5dd2dce838
MD5 8a125276daea023bc4d8720f79523819
SHA1 b28926557b350fc853103c061a23e23a36ff231b
SHA512 ece3941d46d19f18a5ed7a46e9f608960b58565d73d83320493d7f75014142b5102d2ef715b4083539acca84d56a2c1fa8ae99749c3aa15ddda78e58df4b3a7d
SSDEEP 192:BhRQcBziiuJv70APRp2W3/bXsb+WNnUqrTR23z2LeUWv4joiyIsnAUgE:BhRQmziiuJBXJXwR52j2KW5E
TLSH
T18A42952DAE11793B5DDBD21AFD62BB57E2F6002635941E80EAFC893C21E79DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 52b2aebe879b53a4e9a32b8fbf7b82dd83b36a707ce0b18f95fa25c9357958dd
MD5 5ad1a6eed2165638e5a24e7deb2806b7
SHA1 34da6614ab0e69281db6e74c07c94dd21ae3ef5a
SHA512 a4ab1ea5f0ac306ef595cfb58d6133c5e54e5355c24c4af12fa494c75b410aef16b9dbc923a6c991b820713d64721a6adf6ac834e67a9ef656b5229e3ef30a93
SSDEEP 384:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnXODMH+ErU3RwHGPr4UflPjh/U:geMr7KxkXqKf/pUZNCgVLH2Hfgs/XOot
TLSH
T1E6520927688D9A3F4FD8D98CDC22BF4FACF1015676A4092896FB5C1803957CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 6c5100612f6fd57b262f83aa485f9625d9deb30e63f5347d4491f7f9ef765507
MD5 d5bedaf61ec0669717f446f9c025c1cd
SHA1 c359edefb09f997abf73166091fd5f7bbfb892e3
SHA512 155d4eedcba5c1811d5a0cb81f5b0a13477e964733ce3306d6e697074319d40aa7f1aa446f231289ce31db0e1d012a7cbb1e020b34e9ddd685af49a665ac4db4
TLSH
T10EB012D264800F01D4930770A3D544833F0485078301070342D08E00881B9C25855A40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 eb81c3cdad14f80e93fe1913c994d1000ac9aec1db41d4013fa0a9266e7b62cf
MD5 2d37e59348e3e681046a51e43bbf3553
SHA1 ee36a2d574ba5f2730068aff9da53f184f6784d9
SHA512 bb9ac624e574c59ef66ab1ec258cb8b16937ef5b00bb0e8c99550b93b20c06c0e03815588ac004e87480cc5ebaaa445bab44715ecec6474f77f809f68b503988
TLSH
T1BFB011A080000A0BE2828B3023E808823B220E0E0303820282A08800A823A020202B22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c3aa39a503cb68e25ba982e2a55620368594883a1f3e052e05031d36a78328f3
MD5 1efd938ffcc482edb589a83dc79eed19
SHA1 d15666ff60db4eaf19c3b7d01f269b2fa428d671
SHA512 a7a2921fecf968638009c5dc80a8707d9aebf0986652bc84e1bc51f6d4cf996a676e69d6d21ed4f853e18a23f4f3727c0bd23f79387a870d9823319a81a07770
TLSH
T134A0021045D10463CD009F78B3A119456259581C5A655337B5E68494A95F2C27102900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 77f559e94ba060cbffa571eeeca34f0916fe199f8eef803d4adf399aa3ca6fb5
MD5 85668ced2bb8febff748b255ecb1e98d
SHA1 d414f7f9baa4966e5b00f394507014a6b55079d1
SHA512 9228dee86fb129d7ec816ee6d63ae443cb1658b06187a33e5246d96620d760dab609570685f1a201d9de0d61415a967a54502751f613e7138f005f456ac5ba7e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 314a31e629e19750585fc29c76e8432ab4af1595e81b3622c66954285edf681c
MD5 f7b35494c31477ea088a49b87d365bb3
SHA1 08737ef8ba5b0438a6652713ef1881b525050e4c
SHA512 bdfe2680c27e3ae79d33893318ba641569cf8b8430a3edfcffaee33c67f656ef35d230cd8df63ebe2d7013b2aa98af93a601595916c0fbcc99df09cff4cffc70
SSDEEP 3072:ltA98NoA/EYgGVKbYSOF66odcMTWxx/+wp3uZtCyBcKdVvoV4/eKTU:Qq//E9GyiFtodcMTWP/Bp+W47dtoceB
TLSH
T135D312B0ADB43CC50AB78813600B1F636CE39A979F68B698F1F7AB4551C61BB1747702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 4cd7d82d00b1da6d1e0b2f386b7ece30fe0abde5b26e9f4983c9d61ac7da033c
MD5 2316f288a928808d1089386e9640df43
SHA1 5504ed104d2449a0dc9aa0086f566faa68c0393a
SHA512 8483bdd4e6841b5d3ff5368e2233bd1b79e7413219120a6eb4afd0c8b1537c24dc33c5b94a5b7a6bc106d3fad90ee4091dc8c6b3e0c1e6353def6fce6182990f
SSDEEP 3072:PtA98NoA/EYgGVKbYSOF66odcMTWxx/+wp3uZtCyBcKdVvoV4/eKTU:Cq//E9GyiFtodcMTWP/Bp+W47dtoceB
TLSH
T133D312B0AD703CC50AB7891360071F6768E39A979F68BA98F0F7EB4551C62BB4747702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 9932844361b9974fda8c73d73f4da2fa148cf192fa8ddf26ee1b5a7f71042e6e
MD5 e5ea0001a8d7637fd90320c4e937372f
SHA1 57131c8ee4e142d412dd4fd35568390f1dce93e6
SHA512 523463235b751001141c26f1a1193ab3aa3e32f9652eb049b72c1da8a868ade2e5c96c875e99069136f5b739833b5cbfeca473c1f7d7d450bafbe1f4fd3b4b25
SSDEEP 3072:2ItA98NoA/EYgGVKbYSOF66odcMTWxx/+wp3uZtCyBcKdVvoV4/eKTU:gq//E9GyiFtodcMTWP/Bp+W47dtoceB
TLSH
T17FD31290AEB03DC506BB8913B00B1F6760B35EA79A68B5D8F1F7EB4561C61BB0347302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ebffb5395065d1bd0903eaf9034b088d20a55cf0a17b1e005950aa2a08b254f3
MD5 98feff8e3e6bfeb779d8f9fae7fe0e0c
SHA1 5669d5817cab4d69e31375f629f606e1b2a73e9a
SHA512 3df902de10817037009f98e3f6e8ac76fa167ddc49f6fdd26f424186bfb36abb9587dc7b62a316cec40f868269b0a4eb8c990d266219c61266877c29b4fdecca
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5SbD7B6RGyvLsTFjebQMUpv4a:uC0CvgFrp65DUDCFJVTFjeb3UF
TLSH
T1CFA10931E4A9587B15B6D489B8812E43CF74617BB951AF44D9EE5F1C24F70FC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 896639473e14c76f824b13b56d1a025bb890241f4c13a3db4be31e225846ac32
MD5 cc28bcf3963c775ff0452c9825418fc9
SHA1 526d58b087e32cec73b9f9ed3623627d27a4f5aa
SHA512 363765e7656d55c12ac57d4b1492b0b77061a2b6b151bd8e5f80416ef757fe760085c2c7c22f5b1ed9a5c77327020a9018c06de8d34232a0691629e354613da8
SSDEEP 3072:VtA98NoA/EYgGVKbYSOF66odcMTWxx/+wp3uZtCyBcKdVvoV4/eKTU:Aq//E9GyiFtodcMTWP/Bp+W47dtoceB
TLSH
T173D31270AD703CC50AB7891360071F6768E39A979F68BA98F0F7EB4551C61BB4747702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 cf7f80563db81729130460898a7f60a212fd10a4eb0647e255427c956e28f0ad
MD5 8079e249860abab528dab9070c09057b
SHA1 6c4b29517f2809dcfff4d1ced4eabeca935539d2
SHA512 c9dc6ea67602b69173ef6590df3c5bdf948d364030fba0f9e876b631deb7756e6f2927f22cfc0fb2695ba2aba5ef4d557579fbd18ff18451ea276d1c40838c64
SSDEEP 3072:dItA98NoA/EYgGVKbYSOF66odcMTWxx/+wp3uZtCyBcKdVvoV4/eKTU:Vq//E9GyiFtodcMTWP/Bp+W47dtoceB
TLSH
T146D31290AEB03DC506BB8913B00B1F6760B35EA79A69B5D8F1F7EB4561C61BB0347702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir264_1532404199\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download