darksiderat | b735789f160eb34c2ea510df1195b023d5cbbc9700e1a3282cfd5bfc31caa783

Resubmissions

30/09/2026, 00:51

260930-a7h9fsvbna10

30/09/2026, 00:41

260930-a1t3dayshs10

Analysis

user interaction
yes
max time kernel
327s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM.exe
Size 1.7MB
Sample260930-a7h9fsvbna
SHA256 b735789f160eb34c2ea510df1195b023d5cbbc9700e1a3282cfd5bfc31caa783
MD5 a3c0297953cf1bca04cd7a9e5bcb823d
SHA1 f16f3441f40ade7099a4298eb9e09a5e5cbeb09d
SHA512 5823d48a2350eeb288434a7343180d5514aca7b51bebfdded7ebf4228a81ebad55763ff388a72c7f03807e4d5ef04efa248cb093c047cc1d5bed39dab27b7534
SSDEEP 49152:yjCqs+0XAnfaLFzw84PbXgz2sRtQ8RLQntta:uln0EaLtR4P7ytQ82ntA
TLSH
T154853358E5BC6F08D12640F66E350FEE162ABF2E45467E838C582EBDB5C37002ED9C65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat privilege_escalation ransomware trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001e6d7-28.dat	family_darksiderat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 12 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4232 created 3252	4232	Loader (1).exe	88
PID 4596 created 3260	4596	Loader (1).exe	56
PID 4596 created 3260	4596	Loader (1).exe	56

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	FiveM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Loader (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Loader (1).exe

Executes dropped EXE 8 IoCs

pid	Process
4232	Loader (1).exe
3056	OculusSetup.exe
2840	Loader.exe
4596	Loader (1).exe
3768	Loader (1).exe
4188	Loader (1).exe
4944	Loader.exe
812	Loader.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
234	camo.githubusercontent.com
235	camo.githubusercontent.com
236	camo.githubusercontent.com
237	camo.githubusercontent.com
238	camo.githubusercontent.com
239	raw.githubusercontent.com
81	camo.githubusercontent.com
233	camo.githubusercontent.com

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/6004-1799-0x00007FF642B70000-0x00007FF6439C0000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 3768	4596	Loader (1).exe	117
PID 4596 set thread context of 4188	4596	Loader (1).exe	118

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5652	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6004	die.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4232	Loader (1).exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
468	chrome.exe
468	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6004	die.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	Loader (1).exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
6004	die.exe
6004	die.exe
6004	die.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
6004	die.exe
6004	die.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6004	die.exe
6004	die.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4232	3252	FiveM.exe	91
PID 3252 wrote to memory of 3056	3252	FiveM.exe	92
PID 4232 wrote to memory of 2840	4232	Loader (1).exe	94
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 3768	4596	Loader (1).exe	117
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4188	4596	Loader (1).exe	118
PID 4596 wrote to memory of 4944	4596	Loader (1).exe	121
PID 4344 wrote to memory of 3756	4344	chrome.exe	128
PID 4344 wrote to memory of 4540	4344	chrome.exe	129
PID 4344 wrote to memory of 4540	4344	chrome.exe	129
PID 4344 wrote to memory of 2068	4344	chrome.exe	130
PID 4344 wrote to memory of 4976	4344	chrome.exe	131
PID 4344 wrote to memory of 4976	4344	chrome.exe	131
PID 4344 wrote to memory of 3468	4344	chrome.exe	132
PID 4344 wrote to memory of 3468	4344	chrome.exe	132
PID 4344 wrote to memory of 3080	4344	chrome.exe	133
PID 4344 wrote to memory of 3080	4344	chrome.exe	133
PID 4344 wrote to memory of 4140	4344	chrome.exe	134
PID 4344 wrote to memory of 4140	4344	chrome.exe	134
PID 4344 wrote to memory of 4188	4344	chrome.exe	136
PID 4344 wrote to memory of 4188	4344	chrome.exe	136
PID 4344 wrote to memory of 3928	4344	chrome.exe	137
PID 4344 wrote to memory of 3928	4344	chrome.exe	137
PID 4344 wrote to memory of 1660	4344	chrome.exe	138
PID 4344 wrote to memory of 4824	4344	chrome.exe	139
PID 4344 wrote to memory of 4824	4344	chrome.exe	139
PID 4344 wrote to memory of 2436	4344	chrome.exe	140
PID 4344 wrote to memory of 2436	4344	chrome.exe	140
PID 4344 wrote to memory of 876	4344	chrome.exe	142
PID 4344 wrote to memory of 876	4344	chrome.exe	142
PID 4344 wrote to memory of 3804	4344	chrome.exe	143
PID 4344 wrote to memory of 3804	4344	chrome.exe	143
PID 4344 wrote to memory of 1080	4344	chrome.exe	144
PID 4344 wrote to memory of 1080	4344	chrome.exe	144
PID 4344 wrote to memory of 3184	4344	chrome.exe	145
PID 4344 wrote to memory of 3184	4344	chrome.exe	145
PID 4344 wrote to memory of 6044	4344	chrome.exe	148
PID 4344 wrote to memory of 6052	4344	chrome.exe	149
PID 4344 wrote to memory of 6060	4344	chrome.exe	150
PID 4344 wrote to memory of 5116	4344	chrome.exe	153
PID 4344 wrote to memory of 5116	4344	chrome.exe	153
PID 4344 wrote to memory of 5328	4344	chrome.exe	154
PID 4344 wrote to memory of 5328	4344	chrome.exe	154
PID 4344 wrote to memory of 5804	4344	chrome.exe	156
PID 4344 wrote to memory of 5804	4344	chrome.exe	156
PID 4344 wrote to memory of 5872	4344	chrome.exe	157
PID 4344 wrote to memory of 5872	4344	chrome.exe	157
PID 4344 wrote to memory of 1180	4344	chrome.exe	158
PID 4344 wrote to memory of 1180	4344	chrome.exe	158
PID 4344 wrote to memory of 5740	4344	chrome.exe	159
PID 4344 wrote to memory of 5740	4344	chrome.exe	159
PID 4344 wrote to memory of 5020	4344	chrome.exe	160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3260
- C:\Users\Admin\AppData\Local\Temp\FiveM.exe
  "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Loader (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      4⤵
      Executes dropped EXE
      PID:2840
- - C:\Users\Admin\AppData\Local\Temp\OculusSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OculusSetup.exe"
    3⤵
    - Executes dropped EXE
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\Loader (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    3⤵
    - Executes dropped EXE
    PID:4944
- C:\Users\Admin\AppData\Local\Temp\Loader (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Users\Admin\AppData\Local\Temp\Loader (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa7c20c728,0x7ffa7c20c734,0x7ffa7c20c740
    3⤵
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,6908632205303239958,18096010247240050865,262144 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:4540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,7640768341922444986,168030322949907652,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,3281131069473499664,12224580538168108490,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,6547699568140042417,6492672135687039665,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,17473949975398392126,10743442457828310956,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,8093258021435790145,4892602289361043443,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4264 /prefetch:2
    3⤵
    PID:4140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4616,i,18307609548457261327,2300966813297711848,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,5535383948005356821,11444545147559122963,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,1735004400807074249,2421909034874735377,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:1660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1741276009109966823,13196740542921475894,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5660 /prefetch:8
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5680,i,13649881456987191292,9062801483573840283,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:2436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,12148562115579270039,18088439904835244036,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:8
    3⤵
    PID:876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,10548783061950444604,6595522181882385122,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3544 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3948,i,16095351167474939829,852666354885826782,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5936 /prefetch:2
    3⤵
    PID:1080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3224,i,6684658862087688900,15091305314582099082,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3952 /prefetch:1
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,16068560602422717843,9470542500325490640,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,12843235143241993475,1887873465144956691,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:6052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,10613963908961403588,10402564178525519951,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6204 /prefetch:8
    3⤵
    PID:6060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4320,i,13074111381545969786,8411853913334325941,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6096,i,17719802177031659918,687966686293904021,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=868,i,2579722987101368477,4094868596299707975,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6412,i,11007333835418732574,17157355212016688252,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5880,i,14542269184347336042,6565409658531068464,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3260,i,11480165180073373822,254788355506371814,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5564,i,4906600038322889917,6587164484218335945,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6312,i,12467359464422083955,6231660548712789799,262144 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=864 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6312,i,1629256850561199902,13599783376421913864,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6496 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6272,i,7645721938072682762,16421529640401812011,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6136 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6404,i,8209451731989071318,11430453344616979731,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6452,i,7596995797823985778,9929573437422593138,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,18194265535631319694,3491460431347482627,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3496,i,11283122844355701967,16881225020756297666,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6348,i,6749608482186725748,9580314889702656157,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6676 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6292,i,11159954520291451647,252531977570378882,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3704,i,6940052719546440856,15534859195799315747,2097152 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6344 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6932,i,15442561833228059288,7493649096201243521,524288 --field-trial-handle=1976,i,6068204439059919367,12596886277228030877,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6928 /prefetch:8
    3⤵
    PID:4972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jusched.log
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5652
- C:\Users\Admin\Desktop\die\die.exe
  "C:\Users\Admin\Desktop\die\die.exe"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 dec1a58ae4b8e1314708893311c958938125498777b1b6b0e1fd2e7b26fc34b6
MD5 3c02caa5ecadf90e3be5b56e7c14be27
SHA1 0fc9e4443ff7b876883d0f682b944a6e4d51f3f6
SHA512 0294544ebf89d5bf7b47bc9828ebef4a06ec832efdcddda70d876933a9cc2af022b7de0b6b638e83e5b673ffee62dd4ff45590ebb1ff9386fcbba6d74c6cfe15
TLSH
T158F02DB5D861EC7B18FC076D6065474AF75113573B82585B3B3D811C4F74637458685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 73KB
SHA256 f3da3acb05ffefdc9ae669d4d171476ad2d7f4aefefa8fa9e0245a7a3b5ac2dd
MD5 9a896a1d99d04ee0f3fd1b7983fdf1b7
SHA1 a8e793d6fcdf858eceb9f42a9f75665d6a92abc0
SHA512 227c7027b7c944a7472f41c28056bad40b0d3116a3ea88fd350cd9f3c1a44f36d475ae8fee82b558619be48bf78982da14e87617a7a4e7a2241b94ab8272ef8a
SSDEEP 1536:O77BHwf0DFsAQtr1cHixbkJJqPrfkqrFDMllDv4nhz7y4vj:O779wTAwr1wGYJJkfDMXAnhny4b
TLSH
T1887302F82C92C0851875371B2FCEEC37990BBCE11295CE64368DF065D6B7A1B8E16D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 348KB
SHA256 f8a1b823a87944a3c4f17d3af703dc750d386a94ca4a6c6a5f8ba1b59791417e
MD5 e15a9442a6ee1704db873e81143552a6
SHA1 4e8cc552eb02f71fb3bf652376da6b2380898ccf
SHA512 e7e1ed61d90c6e32ce05a06b83a6d3175c178232a99fa7d297e17a67952c9f9b8d4d483ca4026d43ee0ce0662ab3bf5f662e0b905601e9a7c3b2bdf57ca176d2
SSDEEP 6144:jgxSiMzLJ2EDV18L01IvoqGiG4mCvRB3h9JUrwxWD2O9aGaclP:Y02EvY01x7cmCvRBR78Rn9X
TLSH
T1557423084B6DC4874E04C9AD07ABA1EC760335C60ED2DBAD406FB5ACF17266DA4635F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 51KB
SHA256 964bb1868131099abc65cbbd69109362c45dddb9650b2c99c12742893b8007c7
MD5 aa73615548a5cf89cfefb0f33faab563
SHA1 8b4c48634d4f9492b3b14bc8028e5bcabfa56d1d
SHA512 da907ad68d6ef4ba90e07275945019d1e1df2bb505341346de6bdb0dff515000f18bb68bc0626574f07698bfb79a8ac6a64241e393041447eeee323af2fbf5a1
SSDEEP 1536:Yu9httgF3+zFv8VbEJGZkCbYQqU8ycwpOPK5d36Mm:rA366Eg1bYBzse
TLSH
T16A33128250D5D9ACB2D96C1ED9C87DA8E6987B1337F192234EE38D9843C2F5A391F50C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Size 27KB
SHA256 378085b2b8c0ac4bb3b9b0c7ee1cc0ea856a158875be4d3e0d2a234114599043
MD5 ef2e1bb8ed2bd995b1801e1f3d3d2f6b
SHA1 e92408f3a6093e73ddd7ae80bbec218c9d6f7c70
SHA512 9449d0b4c963e36219897d5ee629e2809b45d207e8bcd0182339fb816b5211f99f10589450732e39c13ce15d9e6f0001c6f7a541179cf093a6fa834f1edbf49f
SSDEEP 768:gTBE8PQqZELS1R3fOuFYKNZPXSBfj5moBT+6CjID:gW0QwLR3GuFYKNdXS19LdYQ
TLSH
T121C2E1B3542B8118EE44C3D39D9BCDB0F2D099A1040764686D8DEA3ADBD398FE7476E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e
Size 388KB
SHA256 b37eaf995c0b8e115c9b02936529c505267ddb7516b04f9e2d92bede3c3a870d
MD5 10b31ea3db88e7fc960527605a03ded7
SHA1 1ed8595e11063944be47395bec3b43f705edfa65
SHA512 26c5e84b829de4cc437d4f9ee8b418d5a835dcbb40c036fcb698d218e52c4034583f986cfb060b043963d0806b02a4d08d0a78aebe8b9d25ec0df8a8a26358df
SSDEEP 12288:ALcI1mJA3Ip0m7MFPRKav0xOdIPbfxMFz:acCmOYpaFZK9OdIPDmFz
TLSH
T1FD842342AD70B676B4D286493AA1F435AC1B361C258CE2F344A81576C376DF043FF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 efdf5a0952a993821d26f2b4fd0dc01cfc703e6f0560672554e3c88f7b44f1de
MD5 4b341acd31a7b125eb5a8355fcecb70c
SHA1 73201affe53833fed9bad7f1d7d7bfd9ce04eda3
SHA512 f3834c950bba36e0300370719976a28b854013006ee700ad711640ab3cc7299e1a9911c66ec01cb05b2e184e7289f149b83d2dbae7463677a049ee3ca3e7462b
TLSH
T12D41FC5488D07222CF7D32FE58E758C421727626280F1EA60C549C713CF2BE47193ABB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 55d8b095c20276060a1356f343c28e2dabd8a16e23d2ca4a4916031a024902e1
MD5 8fdb94df0490cacacd301fe547296bc4
SHA1 f54f16fa2fa4157f2791aaeef443609788210986
SHA512 8f20095e81b1f0cab079d31ceda7c66dafd4527a8e99d00de64cfca36d6080bcfaeed94f1212a0c74c28c1ea5ba44bd0388a72f24f81597716166a3a0fa39081
TLSH
T1C1C0222003A0AA22EFA23CF032CB2C0822382C30000A28F2C2800088BCB2B0C0080000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 4e390ebcc9ffddfa24c2cec15e4aa27d876d0adb1637649e942d84eae386eb22
MD5 a73908cd5660f7770398434a0aaf0577
SHA1 3acaa3acd7ec8fcf947d9cd4eff98136845a785f
SHA512 556b5d207fb415a405f18240520b0d71dbe18581e5c730c363940a28a2d8847cf9baa812fb8eabf389b4677c0022ddb2a058cd6260d45970144196595571826d
SSDEEP 192:ox+2fQXhvizdNAgRvEV94tYeRfJjpTNb65cVZZa27V2OOFz2UqrkBTHEA:ox+a6izjAg+V94CORtNbK6varOSz2Uq8
TLSH
T15022403885A3208ECB76AEBE5AD1F4CB75B66256150BCEFF05049C383CB5FA86443172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

67bd780d-7df6-4d6b-9f1c-844d1a6f67a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\67bd780d-7df6-4d6b-9f1c-844d1a6f67a1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 8e0301ede02cbe14890fb4593fc83f4e2277595228210fcab650fb912919ad93
MD5 2ed8fbdfa4c31cc5a3c81dacf68e03ca
SHA1 adccefedb0c9c5e83f969be84412d15371e83a0a
SHA512 c28e27e322372a53b286f4435312ed4021bd135957fad4adc6f3c3955c77a5c81ae6a8a39127fae8797fa9aea0e8929ee5115b36cb1066a26f02124b2cabc2ea
SSDEEP 192:DzfPuHjI37ATbCe9234mYNy8htnjh1R3WfAftkfcNPOKzuehVHZUfi5Aa1wb0t:DzfPuHjI37ATbCe9234mYNy8htnPR3uc
TLSH
T14B32B1F7C7E8C63DC81166F49B257E1BCE2D092852283D67C8D8EE4B93E6472D25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 8ef80900ac332fb2b9cb81c7e5991054daad62d55db4bb40643061f4d9328ea6
MD5 5a1db4f2631eaa3d15c32f330f7b0cb4
SHA1 cbffabd6b15ab23cb5677515bb305e933eaf330e
SHA512 0c8492ff68cc48d2fa4939059930fda2630d3c770634b7106f6fd5e5f75220f72cf726ff0d2176e87969d9d135cd64ba11641d7f56b96fbd348cc903097d0ef0
SSDEEP 384:DzfPuHjI37ATbCe92vRZmY4mY2JDzuehVHoi5Ay/agbZ/DvezllHoiLHIRI7IkIp:5S0fkrFry
TLSH
T11D62A1F7C3E8C62DC81166F49B257E1FCE2D092852283D67C8D8EE5B93E2472D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 baad9c80e03fc6ea58a9f336672cc8bf2b032ef3a39a9497f065176f55745f10
MD5 35031a19a0a195233b318f64cb2d9f84
SHA1 60e293f146fa75ce9301558e7b76e14908f4f4df
SHA512 51c05ebcdfac6f2f4a05d630a2aa2c16b1fc0da0ae91371cec02e9b789cafeb52eeb1439bf4a56f8c2ec79e8696ab1d3616dc1d134be57789730cb5a751f5cf5
SSDEEP 192:DzfPuHjI37ATbCe92vRx4mYQpjh1R3WfAftkfcNPtzuehVHUfi5Aa1/mH5+UTZe2:DzfPuHjI37ATbCe92vRx4mYQpPR3uMtE
TLSH
T10A42A1F7C3E8C62DC81166F49B257E1BCE2D093852283D67C8D8EE4B93E6472D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 024850c393fa0b14f2647dfa6134606c44b596f2091733f526383eb0f04427e5
MD5 68badd5a30464d7c9484e8e28c6b030e
SHA1 45830b4d3510c2fed491cc5e288872a6ce3a230f
SHA512 bb0177476347f08460c0e87d83688165ad85483ca51edd829509da7060b5a1d68657c409d0afb1a90f7207312f6bc2d5c1fd37ca0f7cff450459056aed6a59ca
SSDEEP 384:DzfPuHjI37ATbCe92vRZmoWmJbDJpmXmp4mY2JDzuehVHoi5Ay/a6Z/DvezllHo+:Vh6WXQ0fchgUhJxX4ZJe
TLSH
T1C072A1F7C3E8C62DC91156F49B257E1FCE2D092853283D66C8D8EE4B93E2472D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 f0ed5d82b83f4a30fdad1ca7bc0ef49b7f8c1540d8327ae2004bb63f389113ae
MD5 86216e4395204fbf1c72468518bc918c
SHA1 477ae552594ad5ef1be45666096f53b5b7d68ab8
SHA512 462e65376be95a12e6d9e36ccbd2c1ed5cd0db3c6feca297cfeefd10cb7b69065eeb3017f45415510dcb9ca08f3b6da8499ea21bdb2690ceebb07fa6539b2923
TLSH
T1904157A797BEB467603A4DBB0D047D092EFEA8351241A4F5DE67C26CB0C55F31B0A436
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fad8057d29c594da74a3e09b4c3482841709e316810db9c2e060b47c8820a7d5
MD5 041aa4fb1f713c63fd8889d32243857a
SHA1 df7c81bdd822686f772ce0b74cda4ea2e4cf28a4
SHA512 9fd9186e629995dbd187fbbe4084852831993cf5e0de8c88ce83e182157887263348496e59f0c3f82c542fc8f1ab66f64293ebd1e4540b73b22c708a69b13f95
SSDEEP 192:0RycBzgY5Al0kmv7VNDh2PRpcaWFaW49QHsb+WNzLWsdD4gusqY2o1T2wMeOyBXu:0RymzgAzkSZxiXnWwRu22k2se
TLSH
T19B52D62AB96075BB5CD7D22AF955FB5BD3F2102160902E88EAFD893C10E76CC3217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 193ac6d051584cfe7048304d686258c14e97c90189c301a4da48ad413ff6ec87
MD5 e3f658cb022ea03694801318c17adc91
SHA1 494c3f5c77c3528e916b1803de55856c02b05da1
SHA512 319db070280cb5f3bd95f08ec32a94334f29489c5b41b07e42cad2b40b449e36b391c7e68743de80194459a11538e5f1d6722e3ef61c3a5b5eb62e3f96b40a67
SSDEEP 192:0RscBzgY5Al0kmv7VNDhAPRp2hFS9QHsb+WNndD4guee1T2wMeOyBX7VyIsnAUge:0RsmzgAzkSZx8XTWwluei2oe
TLSH
T18552D62EBD20B57F5CCBD22AF966B757D3F6112120842E84EAF9893C10E79CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a02fb95de6be52f9b09d465ffcb0117094c2ba3acbe0daf195db67b04693d19d
MD5 22cad27ff329b1d17b9818e7dc50b7c5
SHA1 991ff3d18073c2120cacefd42d251847cd81d90b
SHA512 c26a18326169788fa2210e518f412dc3e99b001c2a1fd696d1e99ff9e05bfef22684c25e0ba2fc443bc8d2b93094aede2056d18424b0bf0189f8ce973805d2c2
SSDEEP 192:0R1cBzgY5Al0kmv7VNDhAPRp2aWFaW49QHsb+WNzLWsdD4guee1T2wMeOyBX7Vyr:0R1mzgAzkSZx8XJWwRuei2oe
TLSH
T1BC52D62EB960B5BF5CD7D22AF965B757D3F6112160C42E84EAF8893C10E7ACC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7c5882a66644518c02d80d1f3d9fdad42a6f206e7d4a6f7997d25c74b4227026
MD5 39a6dd67340be80ff61c560942c75778
SHA1 de5411458d87450b731790dbe833b1be5245a13a
SHA512 74a41e0fc2ad201ab660c08878d944f15ba3be0702efba431b4977d4ec954ae2aa4a69d87bfd99d15f068b93f72a61bbd88963c528011485b0341549fc1c0c16
SSDEEP 192:nRycBzgY5AlyVmv7VNDh2PRpcaW1jaYaW49QHjptb+WNzLWsf9KjZXbegusT7sl6:nRymzgA1VSZxiX/WVRkU0s/2se
TLSH
T1A862B62AE860B9BB5CDBC22AF965F757D3F2112161802D88E6FD893C10E76CC7217857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 5c8b0e0462ee5c4ddc48977cb4b19395c7d4d235593d0d870449b453b0ff26c1
MD5 efc241b8328678ce1a7a1219cd5f038d
SHA1 e4ea2f0bbdc3d2d5ecc90af5eaece06bfd509c2a
SHA512 e10fcf631c7d0d61e9785383196c9702381f60518a1074c09b5aaa3b26808a7ff6a603a186d9318fe775d88522dfe4d2d79e524d01166786d71122108a3e91ce
SSDEEP 192:nRycBhgY5AlnVmv7VNDh2PRpcaW4jakQ+W49QHjptb+WNQ/rf9KjZXbe/f+T7sp6:nRymhgAcVSZxiXRWVwkiKsL2se
TLSH
T1C162A52AE86069BF5CDBC22AF965F757D3F6112161802D88EAFD893C10E76CC7217847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3a900581d30ce0a3893807b839d784ce1e9274badb7575ae098685d6acf7b724
MD5 952a35ee92d0dd1eef3d47524e365bd2
SHA1 fb2e9907311a1bae0292441ffe8164457779bd4d
SHA512 ab9a54d4acdd3e17273e28e66ea5e5d58ba75d728877470386bce47740d3b34de90a2a523cfa3474d96abe33203467568de29c42de6b038a6270beb63f74d9e2
SSDEEP 192:HRycBzgY5Aly7mv7VNDh2PRpcaWiYaW49QHytb+WNzLWshHBgus6Q8M1T2wMeOyA:HRymzgAZ7SZxiX7WqpDu8A2se
TLSH
T1B262B52AA96075BF9CD7D22AF955F757D3F6212160C02D88EAFC893C10E7ACC6217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a4d5242ce52bf071d5c3161ba23d90d8e183c5ea3b0da8e9092258fe8336cdf5
MD5 27ec6a75a6b66c29794874b4146ae8b4
SHA1 dbc3d428df422d358d6f422fa3356eaf3b90206a
SHA512 a722239c2738e3533f1a589dc623dfe919bfba01da332ac5c5899c838a49e4d1b3f7b3afa039e78c73dcded470384e5e3e8506e7cdfd486d93c24d37eab6ddfe
SSDEEP 192:HRycBzgY5Alstmv7VNDh2PRpcaWiYaW49QHytb+WNzLWshHBgussyor1T2wMeOyA:HRymzgALtSZxiX7WqpDWoF2se
TLSH
T1A862B52AA96065BF9CD7C22AF955F717D3F2112160C42D88EAFC893C10E7ACC7217847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1b54490be410dc4a258146900f9d879c4a8dedd5f5dcb27e704373bd7b651a88
MD5 eb9519ee95b961b37b44b7c7c58bba86
SHA1 f09dc9af8038b26a4a906ef000f22226214e84b9
SHA512 a5f99fa30fdeefc973ac85a7fb7d181351aa52d653ce7656a5d3176cb772dbaef478d650206aa5fe2a323ba37abe891e8c5c836f57bf579d4e52d6509bc74730
SSDEEP 192:nRycBzgY5Al7Vmv7VNDh2PRpcaW1jaYaW49QHjptb+WNzLWsf9KjZXbegusDxWJQ:nRymzgAQVSZxiX/WVRkU2Wx2se
TLSH
T1D662B62AE96079BB5CDBC226F955F757E3F2112160802E88E6FD893C10E76CC7217857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c19dc82b584f34f718712cd7b1915aa04c68173ff7effb55a2d04564d8173f9a
MD5 db23f798bf426f713e2cac6bb25afb20
SHA1 ed1ddf4217890dc25646acb10bb5a8d1c457c2b6
SHA512 9ac43db7b332603875255fc04d0836b7170fb835ebb7ec63d213071b360aff648e36dd0af1eb4bfe83342d44fa6b80ee8ec671f70e4667d22b28ad7ed2675640
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3UKHGEtb2wg:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pI
TLSH
T12E720967BC4C8A370FD4CA8DDC167B4FEDB5025A65EA886442FB982503D4ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 168KB
SHA256 c4445a478bfd814e0749d14e41ed72550861a7e05a34cb70e145806d64cff2b7
MD5 12dc47d84c6540bd55ed69733276999a
SHA1 f7c510fbf79100c1d13c6a633b0469e6068fb32a
SHA512 33c0c6fce3aa85898a23ec9a8f70754cfc596fea75412ca0f2fff2fa87a64e07a2d717af8fcf8037ac37e4f5f2e0cf8018f5be189e5e4b3ada8a7b379c8c63a8
SSDEEP 3072:V2egbeWM9sRxPCa11iqDAjuXp1KUfC1G2KTw:VcbeWhiljuXWdg28w
TLSH
T120F33353D1F899636F6B4443E8857E82B32C3057E619DAA1F987BFF0101E62A70F5836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1
Size 221KB
SHA256 2e5113eafdde03279cd4dea57ee5544e56865cfe66c57aa5da764061eab9e69b
MD5 2d33d79cffc6957a9b2ecba8da8aad3d
SHA1 6555a58f828c573b3845392712474a815e6206b1
SHA512 254dff8d1661b3b5491262851fc4290ae48fc8556474bd83b32e611c00853bf70e3e1676958e73ef56b58a4e2f8a5a8453ca342298d6111ddc5748d27fdcbaf3
SSDEEP 3072:wnS4M9eaGk/GcZRejpJycqlL9QCZdKGKrfdZjMaJ9:wkJ4eRebKF7KG2fY8
TLSH
T1C524F78ABB2117FBDF3A6BB94013BE5457220141EAE3C4C6114E67D8152C193BABFB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 2e74608664f65b563c2479a32b011c6fb23985ee01607a7c47f852fd4a6a9664
MD5 adfd7a3911745136e75da976f64179a8
SHA1 061d35ffd5de1e33bc4a02af91501a0a7799e0b9
SHA512 ca28644195d00beed955a84957ab23dc9887c32022e3aca25e2227ba84fe78d422cbe72ab682a58a962496340f52c6d7ff6ba62ee0feb43217bf41f1d3a6b786
TLSH
T1D8C01241C142B141C99A03FC28678CDC3698BF74DE47138C43F09DA2F835231912F295
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e52037f9ba428f064abfec58b07cb52e805392cb8255a7e9695bc6d8af8d73d4
MD5 ecef810d5df72d437c926455077aaf95
SHA1 a94e87b3c29d0c1595d702a22da2de9a0fcd6649
SHA512 91e5686317eb874ce0fff66907cedb98bedbe464c8abdf4f5d0951fcbe84956d6d94d8d69d278a8e9e00657cd7c1af737289ad32029434d9b64d0a732d5647df
TLSH
T189B01245C0826B41C00202F41193259C7564DF11F609234152F03D019C35290801F098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b0f7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b0f7.TMP
Size 96B
SHA256 e5f5e3431532e77d3a435478d372f8af62d818db51dfbb19cad17178f1ee1053
MD5 50a14bfed4ded2d91d629afa2477f52b
SHA1 b4b95a05800d7f6ca77f52c7fe9d2371dbcaa5e0
SHA512 786b07189381a2187de7f1e26fc976e6dfeec353b00ee0278ae25870719e18fe631dcc8a6852c2b15cd90b8c7b25312963a25c620c9b974d64982c38478de967
TLSH
T1F9B02200C0022302C00A03F038CBC0C8B0A8FF20C203232282E02A22FC2CF3080382A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2bf1f1f0a6e101ca5291d482dbdfd9806ce140bc13c19e7b85d3f15e8a5a7f24
MD5 ef7e48dc8410c7f87b85923e82496006
SHA1 cd86971968b4ff4f876cb694d1f7ef780264f7a7
SHA512 cf3c1c8ee23839c1eabcb57d638c9436314377ff4b048c476e1d2c2a08ef24e97b0bbdbfa2cbd8c23b5482f4f3f3b48d5da4b05d22f923467b6e57e9df5db6a4
TLSH
T1E5B022EC22C22C82FC8C03F020C20880333CEE20B30BC2CB82F20028FC802C08B00300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 418ff77d7ab6da5b6fbb3781b9f0113f7978af47840a3a28cec4c2a3a5775f22
MD5 8471d2382f02ae580b55d5924db13f82
SHA1 17ac7d881aeb6bd0b3dcdd0a652c7669a494d804
SHA512 60d1c05f634ff8bb7db12975c4d8ba61fdbfba5527f947eda5c5674ecbbb267a77dbea95c32613420d77ddb98c3ec1a333f0648681d80ed70aaa0a33b034e1da
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 98f22697c6f43d919f46b57f421a2e0ec6ab6c187c0edd12f1c1be55f82780f3
MD5 9c47a734e8774bbf50fb42064c3c3f1f
SHA1 92d3d8b8231f1f1ec9b094416a19693a56cb62bf
SHA512 d42f6f797cd6140f76111cba6c7bc30ff32d201cfa6440bf647cf7197e0dbb775d52a820a75c1670690e2a9cf29f60f1ff9145a358b9608c50de9f80d6e13014
TLSH
T1BDA0021055E45815CE2462F974F3094537615C24A6925B035F924848BCBB1C59146200
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5cee6f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5cee6f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fa70f891-aee4-4412-b9fc-2207fb1d64a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fa70f891-aee4-4412-b9fc-2207fb1d64a7.tmp
Size 12KB
SHA256 a938e4861990888da663ab0620f321d1ffa33bf51dd810c8b7fdc183054214d8
MD5 45f6767b042097b2c4f4d2b38fe1cf6e
SHA1 cb39f39f628ce23ff6cfb8e11768d0d2153ca3d2
SHA512 dded8bd93e117ccc213cf7030416ef4dc89b4c6089f37dc45252522a7627e37f48a9e4522db708df8b464d73c7f00ed9453931f318571db7ec8755cb194dd656
SSDEEP 192:0RMg15Al0kmv7VNDhAPRp2hur9QHsb+WNndD4J32h1T2wMeOyBXIVyIsnAUgtaJ:0RMgvzkSZx8XfWwl62T2t8
TLSH
T13A42B42EBE20B57F5CD7D22AF965B757D3F6102160942E84EAF9893C10E79CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 6a791f326e5c31d9ab89339cbce1d3be35f9814a06ea7cd20a050b531f3ec81e
MD5 df8376074d334b1eab044340cc6ca5ff
SHA1 acd1294403a99693c7605efb2796b761c954c5d6
SHA512 cb7c37c0efca72e02f2820ce5ef63f38291ce923c8e920af0006f06b125c91bee9554fb37b555df4c16d70a0c364d4d3f11f08c2845b6afe0df6a1343d915360
SSDEEP 6144:p8HGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:pvop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1224423312A67CCF3C9FA2A4150138718CD65C5EF8AE96B5E84D59F4A405EDEC03E6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 78f0ac35ae2cc280470bd39b1f0286418716191135bb78c1704aa4fb5a196e59
MD5 614cd23f55dd96f19a7463683dbf67ba
SHA1 947cd3071e2afa6a733ec236fb2761b80230c657
SHA512 788dbf98200653e8c64f149c19f542134e954f3c54080f106a18fc3d0a0ea564279550078352f98e90e2dcc862052845a12f207b166772450a4e9758c7121715
SSDEEP 6144:K9fGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:Kwop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1624423312A62CCF3C9FA1A4150038718CD65D5EF8AE97B5E84D58F4A405EDEC03A6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 d41c8d13e7c2bd9d3fffae5786636bffffdd67a30c041cd343c97e24c43c35eb
MD5 6f95f952ebed2803f746b51ea2758ab0
SHA1 280db21a7be5d3d812dc1924c8b32a5cac0ff78c
SHA512 04469a38680d917fcaa81db1019ada8da6c1eee4c4257426b7a7b137a6031a1543c32691715878cec78449bbd21f6af8c94940a8cd301dfead4f2e113d9a2e7b
SSDEEP 6144:FDGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:FSop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1B24423312A67CDB3C9FA16506013C718CD61C5EE45EE6B9A81D58F4E809ADEC03F6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 3daab9f532dd4b5f7433ea90e75df9152bc45ff4367da36bdc81b6d5343aac19
MD5 c0257256211159bdbb393ed570134482
SHA1 82256232db445fe1ddd6076247a83691a414747e
SHA512 12a0495055ae699d4c100762df0409e26352302b6893c62bd34fb6b3ac25fd537b9bc0ce02d4a8f2291a55c70be6daa9e7c05833d2aaf50492c3ee00c5079ac5
SSDEEP 6144:cDGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:cSop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1924423312A67CDB3C9FA16506013C718DD61C5EE45EE6B9A81D58F4E809ADEC03F6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 c73b42287d3ca148e4049b361a26e91fd66562eb3aedd0efd4d53c4b54d5da35
MD5 8b30dbd0dfd534c8b93a74e64374972c
SHA1 b740d0bb94922dd5ad80d9958faa345767121190
SHA512 3498392b3e8cef6e5fbe36d53e766eeed317ecfa61c51a14607fcd0bee87f71cfa9b9985b5fca3939fc10bbf080e91e81084ce43eecdcd46c003839f8c0349a3
SSDEEP 6144:cffGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:c2op8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1B24423312A66CCF3C9FA1A4150038718CD65D5EF8AE97B5E84D58F4E405EDEC03A6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 9d3212fda7e1dbaa51b2ccd6a56d2e42e5d05f80c61f2788468aa1048d694f8a
MD5 ba9741b698b6c56f48979575f0a80b38
SHA1 c42e045057c8b29416bd71c621d8bd762943af81
SHA512 a6333cf537d6839eb78d2ac1e54157d6c0405858b9d139bf44a43c8d1284774e913377742463c339afce2853430db5751d559547a50cb9840db06cff7a9bc04b
SSDEEP 6144:B9fGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:Bwop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1C24423312A66CCF3C9FA1A4150138718CD65D5EF8AE97B9E84D58F4E405EDEC03A6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 409b841acd61bb64fe6b0f322544a9a0ee78065427829d88e3c2171c3636f637
MD5 f0aafc562ecdd4506930d48102b497a7
SHA1 688817b47e21f2d15f459724123f5e0f23c278b9
SHA512 dd683e860601d81046e3ae288f2c04a24e0df06dd318e07bc4f18aadac8ad46e8512af07db2e224339b64c207357ee8ed639ace66d40f0c186967005a360f1ba
SSDEEP 6144:P9fGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:Pwop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1D24423312A62CCF3C9FA1A4150038718CD65D5EF8AE97B5E84D58F4E805EDEC03A6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 029925d453106c1b4c32ebd4f5339826639649042ed291dfab075ab8b5aadc60
MD5 fa09cabbb786adeabaec96401f2dd284
SHA1 476cb9baabe5cd0200e07c1daa01f0dc926aa4fc
SHA512 3d959eff3f9b8409f871d2d54ae852030ebb64424feef9c8877793a41fbc4bf42cdcb383c516abb98cbce9da1aea54a0420f461a536edf09cff51c94f26873e3
SSDEEP 6144:19fGvRYzTsG8JhE+eKS8Iyr0MZQ+hFD+7t56OD9ZfSApprL:1wop8JW+eKlPBKyFSXD9ZfS4t
TLSH
T1124423312A62CCF3C9FA1A4150038718CD65D5EF8AE97B9E84D58F4A405EDEC03A6A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 69940c4b47f1652fbe16126cbdbbda6a339c9d1119e54086cb122ca34e149ee1
MD5 7c499559f8631a07f6f54df2f02c7e18
SHA1 645004b706adfbecbbce64839f6df5d32545146a
SHA512 c0f3d61dfef9f935adc31d1437c93861f2841b3f466ecb6feaa76d0e12d9326e0e84ce827b155515f7bb40660948388b0e02ec9ae07909fab45f3d8a20f05e0b
SSDEEP 3072:m++lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:m++hFD+7t56OD9ZfSApprr
TLSH
T10ED31232AA95D8BBC9FC6541B157A304DD76A8ED41DE3A0944465F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader (1).exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader (1).exe.log
Size 859B
SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
MD5 e204f3d12abd1691ce1f149399441188
SHA1 798042095539abfe857e456fca4e1035f67d29bf
SHA512 804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f
TLSH
T1E7116B70227AA1D889162F952C1E2BC403BF4336B650DE0C7998729EED364175F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

Loader (1).exe

Path C:\Users\Admin\AppData\Local\Temp\Loader (1).exe
Size 368KB
SHA256 be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0
MD5 93b152ddba79f433c3a17fa907c01a06
SHA1 8cce14920662a7c2ffc3595bb625ef5e7603735a
SHA512 e85dbb45c4b40bd67b0594ddc6cb96f717ce98dab7c4a2147e42225e89fef1076b56a1303653c80209c42c03535df817e05735a7706096da0ce65c362aab6126
SSDEEP 6144:QwR3cLrvZBKCGfiRm/6nEVAQFXOhEwYRfZuy6MTI1Ng1NdiSKRa58z8SsD:QW3mkSRSFAQ4q14Jr7sdi1Ram
TLSH
T12984231453DF95A3D87578339E6642B44B3FBA9E4D86AB2363CC1DB8AB16784FD90003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Loader.exe
Size 87KB
SHA256 7a2f38df13d43bc270d4a4d7fa532313a2a8353d1e785c8ad686868b11b4265f
MD5 4d14d43605dbe974dea0a0d8afc81d60
SHA1 903b3f0a8b72de3176ff7bcaaa06ca3499df5f0a
SHA512 b78e22ded4d91fd25bf2197f003b0967c38be78dcb628ff4631c9622989a2abf80f57b97aeb920f6025b7324a01912e402fd33bec2b9614e3a1354e088647d36
SSDEEP 768:nv4Dh3rZbHU5OjOar7uL/AGof1J7DtZl++J6dhz8agz88W9CcCyegMxJMcgkzq7v:Uh34z9Y+97kehomTkfrJrjolYu1l/
TLSH
T19C93F535DA9AB16FC2498478ED024C06DF53B89E8661BF672BD24DC54FCAF602F2C590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OculusSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\OculusSetup.exe
Size 1.4MB
SHA256 021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f
MD5 8b923746242130bc39f9566cf8ab60dc
SHA1 430ef7824759dc2295eb6cc5591bf2558c71e350
SHA512 981a338cdb8ee7fa15fcec8e10e2abb21af0eb653f15c0cec041144c9bedb9df4af513605c3533b815e981023b0c76eb804f0adc4d63be846baf22b7f69d6c7b
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizfmQDc06WogeOfQr0W:itMzLAVStcdiT7FoR2A0W
TLSH
T11A65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

422f8ada-a2b0-4057-9ca4-951a68772acd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4344_142705868\422f8ada-a2b0-4057-9ca4-951a68772acd.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4344_142705868\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

die_win64_portable_3.21_x64.zip

Path C:\Users\Admin\Downloads\die_win64_portable_3.21_x64.zip
Size 24.0MB
SHA256 078f2934f267392247f9c7b759a1c2457a48bc2000b25b80c2f129955ee4a3b9
MD5 039c279693597cecb3c2a67786a92149
SHA1 5343f3785f971ef9211b225d4bd5c0fe78a090ab
SHA512 b0ca7cb1f20f6d8ed73b9390d143d7bd098db77580eda95aa53351135461a1dc422ca83cebb2f9cf56edea1be591e008d577a4b6d83da64167d03113544b176a
SSDEEP 393216:XkNWJN+ZDfJt3fTodgqpeLT4rBbEzxrcG14aG8MzuFUEq9Ee7ejH1OtMlLc9lvIn:XcMgJJt3fT5q4Hr8aLIvZSLk0Kyi8f
TLSH
T1B247335AE6192347C0AFDBBF24DB8279EF54806F02B9E327076964552E836C11F3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-1-0x0000000002FF0000-0x00000000031B0000-memory.dmp

Download

memory/3252-0-0x0000000000340000-0x0000000000502000-memory.dmp

Download

memory/3768-38-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3768-35-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4188-37-0x0000000140000000-0x000000014001D000-memory.dmp

Download

memory/4188-41-0x0000000140000000-0x000000014001D000-memory.dmp

Download

memory/4232-18-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4232-23-0x000000001C320000-0x000000001C37E000-memory.dmp

Download

memory/6004-1800-0x00007FFA7B540000-0x00007FFA7BA81000-memory.dmp

Download

memory/6004-1799-0x00007FF642B70000-0x00007FF6439C0000-memory.dmp

Download