cdaa9bac343ac6f0a89fc7ee67a3dbe941ca861b73b7fdb13fe35e8e67afc6b4

Resubmissions

20/06/2026, 22:39

260620-2k2aash17n8

20/06/2026, 22:34

260620-2hch6aaz5t8

Analysis

user interaction
yes
max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mv.2.3.ssr.fixed.vsync.zip
Size 342KB
Sample260620-2k2aash17n
SHA256 cdaa9bac343ac6f0a89fc7ee67a3dbe941ca861b73b7fdb13fe35e8e67afc6b4
MD5 0b4599a8a66fca2d6715e468c53375e2
SHA1 b0daa92d9f261c9a16d0aa718512e717931f746b
SHA512 3d3f719af2a1abc984caaf4c1a11bb7d568a6f547f4e962e5b8befad4fcd6640a68ed3ebf6209269e51a31547ac8ccb73480a4c8a27bfb5ae80662cacf46ca48
SSDEEP 6144:CFrg6xkXob+9YcEMJnMxh8KyQjK9IXRSjfH59L9WcKdgiAOOJ+5GLCiAkGocE+t:CFrlkYb+nEMJMP8VQjwIsr5F1K1ANJ+p
TLSH
T10774236E87562578BD7231BC62CBB3770C7D541DCF79E727126E2B69F8060AF10A4282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
86	3132	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
71	camo.githubusercontent.com
76	camo.githubusercontent.com
24	camo.githubusercontent.com
72	camo.githubusercontent.com
73	camo.githubusercontent.com
74	camo.githubusercontent.com
75	camo.githubusercontent.com
50	raw.githubusercontent.com
50	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3132	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264687852593200"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
252	chrome.exe
252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2404	2928	chrome.exe	90
PID 2928 wrote to memory of 4240	2928	chrome.exe	91
PID 2928 wrote to memory of 4240	2928	chrome.exe	91
PID 2928 wrote to memory of 3132	2928	chrome.exe	92
PID 2928 wrote to memory of 4696	2928	chrome.exe	94
PID 2928 wrote to memory of 4696	2928	chrome.exe	94
PID 2928 wrote to memory of 2632	2928	chrome.exe	95
PID 2928 wrote to memory of 2632	2928	chrome.exe	95
PID 2928 wrote to memory of 3856	2928	chrome.exe	96
PID 2928 wrote to memory of 3856	2928	chrome.exe	96
PID 2928 wrote to memory of 2520	2928	chrome.exe	97
PID 2928 wrote to memory of 2520	2928	chrome.exe	97
PID 2928 wrote to memory of 4544	2928	chrome.exe	98
PID 2928 wrote to memory of 4544	2928	chrome.exe	98
PID 2928 wrote to memory of 296	2928	chrome.exe	99
PID 2928 wrote to memory of 296	2928	chrome.exe	99
PID 2928 wrote to memory of 2776	2928	chrome.exe	100
PID 2928 wrote to memory of 2776	2928	chrome.exe	100
PID 2928 wrote to memory of 2980	2928	chrome.exe	101
PID 2928 wrote to memory of 2980	2928	chrome.exe	101
PID 2928 wrote to memory of 3600	2928	chrome.exe	102
PID 2928 wrote to memory of 5260	2928	chrome.exe	103
PID 2928 wrote to memory of 5260	2928	chrome.exe	103
PID 2928 wrote to memory of 2648	2928	chrome.exe	104
PID 2928 wrote to memory of 2648	2928	chrome.exe	104
PID 2928 wrote to memory of 2896	2928	chrome.exe	105
PID 2928 wrote to memory of 2896	2928	chrome.exe	105
PID 2928 wrote to memory of 2484	2928	chrome.exe	109
PID 2928 wrote to memory of 2484	2928	chrome.exe	109
PID 2928 wrote to memory of 5052	2928	chrome.exe	110
PID 2928 wrote to memory of 5052	2928	chrome.exe	110
PID 2928 wrote to memory of 4496	2928	chrome.exe	111
PID 2928 wrote to memory of 4496	2928	chrome.exe	111
PID 2928 wrote to memory of 4864	2928	chrome.exe	113
PID 2928 wrote to memory of 6140	2928	chrome.exe	112
PID 2928 wrote to memory of 4864	2928	chrome.exe	113
PID 2928 wrote to memory of 6140	2928	chrome.exe	112
PID 2928 wrote to memory of 5976	2928	chrome.exe	114
PID 2928 wrote to memory of 5976	2928	chrome.exe	114
PID 2928 wrote to memory of 2792	2928	chrome.exe	115
PID 2928 wrote to memory of 3876	2928	chrome.exe	116
PID 2928 wrote to memory of 2792	2928	chrome.exe	115
PID 2928 wrote to memory of 3876	2928	chrome.exe	116
PID 2928 wrote to memory of 5260	2928	chrome.exe	117
PID 2928 wrote to memory of 5260	2928	chrome.exe	117
PID 2928 wrote to memory of 4472	2928	chrome.exe	118
PID 2928 wrote to memory of 4472	2928	chrome.exe	118
PID 2928 wrote to memory of 2976	2928	chrome.exe	119
PID 2928 wrote to memory of 2976	2928	chrome.exe	119
PID 2928 wrote to memory of 2436	2928	chrome.exe	120
PID 2928 wrote to memory of 2436	2928	chrome.exe	120
PID 2928 wrote to memory of 820	2928	chrome.exe	121
PID 2928 wrote to memory of 464	2928	chrome.exe	123
PID 2928 wrote to memory of 4208	2928	chrome.exe	124
PID 2928 wrote to memory of 4348	2928	chrome.exe	125
PID 2928 wrote to memory of 3876	2928	chrome.exe	126
PID 2928 wrote to memory of 3876	2928	chrome.exe	126
PID 2928 wrote to memory of 2948	2928	chrome.exe	127
PID 2928 wrote to memory of 2948	2928	chrome.exe	127
PID 2928 wrote to memory of 5828	2928	chrome.exe	128
PID 2928 wrote to memory of 5828	2928	chrome.exe	128
PID 2928 wrote to memory of 252	2928	chrome.exe	129
PID 2928 wrote to memory of 4756	2928	chrome.exe	130
PID 2928 wrote to memory of 4756	2928	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\mv.2.3.ssr.fixed.vsync.zip
1⤵
PID:5628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd0a0dc728,0x7ffd0a0dc734,0x7ffd0a0dc740
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,15180243489875591262,4907072476311695243,262144 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,6268936397839127894,13709601870632385542,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,1720524580858000856,10545530436137349875,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,2553574571425266140,2381013522440490326,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,13520791313320644491,8510049825788134978,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,7392820051553340247,14564007321885867077,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4844,i,9789254832445579182,4711177871410645098,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,6644468078495476207,3835502565877322497,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,15526198922017912992,355569813712840387,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5248,i,4499969186510834012,17238411985357284932,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,12976068606389543700,7347273349850755897,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3652,i,1874457797658001345,3994146107533668018,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5520,i,13603247033904901223,13676368403905682977,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3600,i,14576992547190999451,2872732179006298562,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5728,i,6963361354074273515,16952621860557555865,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,18141347921286205993,2165512413239254172,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5996,i,3196368603282836638,423448250013123356,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5804,i,7258080030866801110,1699305812469166277,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,5741928821157642838,1304383124911353361,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5816,i,18028106606275671785,16779403940423138919,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4452,i,7648365466837226046,10674739204346300996,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,8308622315558106527,13915288549458506223,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4756,i,12431406675933727499,4428410355763872892,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3604,i,10360231718928958649,5376094940629824685,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5744,i,2996695419477955801,14186972763292150970,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5672,i,10928882994233508805,1202149881651574338,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,16233612028821688423,6959503912801405014,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,2179856732930550166,389215255937445115,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,16827069983503522110,14239311630962952223,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,9330682438331583762,3438272297758538345,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=904,i,8399769302047538679,7301590848149869130,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5592,i,13916074750272419815,13012622479241112465,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6228,i,11774185432737637498,1598241609722046117,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3520,i,5934601764671908140,10377143780401646459,262144 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6124,i,8317906406580652599,12154621122490628749,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=4840,i,18391319733673267544,17508046149731187053,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=4708,i,10676939340969648452,6076402876589626099,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,12019014992050468346,13218034299690532976,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6696,i,7933101610122683909,11157697148404182462,2097152 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,7992727577780288309,17815062390110650649,524288 --field-trial-handle=1900,i,3714101770761001175,15497100896208674198,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  PID:3100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 760419d4d339cf8b093c9a480ef90148ab41a3ffacad1b768af0272ef1c76a42
MD5 d6ae1b4733177247b72b7742741a0f55
SHA1 5ca2ed74547ccecdf8cb5e515957f2a9375721c4
SHA512 fcaed0040cea18941001de9a73ef91eca3908cda9b84fa5ccba77fd7deef44e6c944e04d8e7450e66a290cd01e32f7483072bd6cb4e4ff746831b34dd4d0d864
TLSH
T1FD613E446EC12212DFB88A7248EAF8D57BB15AAE42D74E1E1D8707F2705E3E89043C1B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 a978f5dcd54125f88b361948f443390688aa737ac3578e55e83b1e7716c6997b
MD5 8f6f4bd4b1a49797c7951d2391cda9bb
SHA1 411d8000dd67af6b5f51f88b9c3453002a174558
SHA512 7f8e0c0bee8cb860332da1b6672a5fc52130d46149844100c2ed9fec85167f288354f15fccb1b03313fae510ffa929489a330d180315084266e87f2a318530fa
SSDEEP 192:D8Q/gbg8+JlJm3mx/mzGmVWD+XyaPuLIaIyfIHcvCfPENPANm9mRmgmDmt0mzmCK:D8Q/gbg8+JlJm3mx/mqmVWD+XyamLIa5
TLSH
T15202ACF7C7D8C92D891156F5AB15AE1ECE290A18432C3D26C8E4BF4BD3E2871E25134E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 061cfd908dc04bd7e811f800d9089e38e915a568670ad7191cfbc7c95590fd25
MD5 ea520c300f468224bc7ffaed7222f3fe
SHA1 103e8dd8483315a02d6bbaaa74d559e4cd102928
SHA512 a70869d18c15a684e4943a0f4174cb6a72199922790e2cedcedf005a7a5fd915ba3d832e5635eb852b2e0214b4b2c762c0c5fab29fae4a91ff6814a95e50a201
SSDEEP 384:yRPmzRKIErsfEcuDazvdUwIXhOw2za2m9lE:gmzRKCcOwamM
TLSH
T11742986FB920697B9DDBE129FE257756E2F1102176D01E40E6FC8B1C11E7ACC2217827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 abccf5d01b7ca00bf1114977172e45852817746dbcd3f03235bf375bba69e802
MD5 8ed834d542a0008475166eb40cc1d033
SHA1 d043cbeeeb942b05cd0773b9c626c6adc650b4d6
SHA512 5becfcdbd0aab86a61aa5898fdfe42352be3ddf327401bca242a8454712590832f67c1b3f25af07fb63ad3af823fe15be9ce325bea74b49d61684be49ae3649e
SSDEEP 192:yRPcBztK80ErsfEcuDazvdU0v7ZAPRp2bEh94Hsb+WNnLr4Wm2cPeF9DVyIsnAUp:yRPmztKjErsfEcuDazvdUwIX9Ow3I2l2
TLSH
T15932986FBD10653B5DDBE229FE257757E2F5102171942E80E6FC8A2C10EBACC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0665aeb5cf7559b322979726e402fa03d9541e7f40f45663337dfefcc612dffd
MD5 779e2d2135b796a8c2566dcc1d4ac569
SHA1 39148e2597827fb90205b2557af5758b5590c5d3
SHA512 a5720c02616f3d5583731291f31aaa9124e6200e0703fcd1180ed82deba63169b814753f59a43f32fc73238e8d6aae2b00a81c7252392c4d8ef4e24f8edd9766
SSDEEP 384:5RPmzRKaErsfEcuDazvdUc1XLOwzKASa2Q9lE:bmzRKgPOwLSQM
TLSH
T1EC52865BA920297B9DDBD629F925775AE2F1102176D02E44E6FC8F1C11E7BCD2203827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6e89b42a6bea007c2abc2a5bd44dcbd49abb028cd1a0ff29c4d20a62f596a84a
MD5 1e9c9faf18dba9e162936a06ec0f169e
SHA1 27ed7d85661910a895276c9368eed6f81602d9a9
SHA512 b6306e4a7b83e0532d7b7f1dcf98c29f1f1749bf6f53f5083094f06989a8c9d67d82268833b5ca69ea52431f12d64983d7c288f2ff98815b4f229a41815606ff
SSDEEP 384:yRPmzRKJErsfEcuDazvdUVZXGOw2za279lE:gmzRKhTOwa7M
TLSH
T18452A86FB910297B9DDBE629FE257756E2F1102176D02E44E6FC8B1C10E7ACC2217827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 06a104478ce9edb54e11e3dc6b3550e6b158f6d05e489f180b18d135a721546b
MD5 81dc6164559eb4365a8266ad513a7743
SHA1 e5111df5c46bae0ffe28f731a75307aa56075684
SHA512 51c3d2a0d4b962da87d49256f11a29d8b8c28e3e04b4350c6be382ef4d6982de7da1d59c843504e02c3defce57782563b48da04118d44fbfbf9f0d9bf193b08a
SSDEEP 384:yRPmzRKsErsfEcuDazvdUcZXGOw2za279lE:gmzRK2iOwa7M
TLSH
T13B52A85FB910297B9DDBE529FE257756E2F1102172D02E44E6FC8B1C10E7ACD2217827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7459bef9c05ce45e72bfab6d4d0870ba2b4262f3d79dd44e8073d8e10e2c9872
MD5 f19fbdad24945a436f457fe3d70e268d
SHA1 ab4a99ba2e3bfde8a6d7f244e86bc2d832b357a7
SHA512 aa7677ca522d0e41db57f157d9526aa0f557e061aae4b55f1fb6c2870f0d92194be0c602a49f4b2e5ceb4e9242b2b8c1659f54786c21b327e7fd9625df505518
SSDEEP 384:yRPmzRKjErsfEcuDazvdUwIXhOw2I2l9le:gmzRKPcOw0l2
TLSH
T15842996FB910297B5DDBE629FE657756E2F1102172D02E44E6FC8B1C11E7ACC2213827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c6bf438e2d85c58fcb7ae438501043307aafcbdf7288b48ec8e78e20c1d2f57f
MD5 d24524965ccbf0c2a8c92cdab9250bbc
SHA1 dc4c55390e5a083fbec0935949983b5fd0846aa2
SHA512 130bec642896543dc4cdc0415120eeae6e9a8a533264e11a8c797d21478d5c9e1943baa042ca32e8184903eb31642dcd45cb9066f1a584525dd86d73b6718c93
SSDEEP 384:5RPmzRKaErsfEcuDazvdUcZXLOwZKASa2Q9lE:bmzRKgnOwNSQM
TLSH
T17852966FA920297B9DDBD529F925775AE2F1102176D02E44E6FC8F1C10E7ACD2213827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b3e228b5fc59a92ac60f8b9bfb5a1594bf2cdaa0dbda90e805d5e9db9cac0c8
MD5 6460dc4026c21b22cd19546d7b16b91e
SHA1 e7a1037dba8b6dbf6c4ec7edda22d112ab26f930
SHA512 b1b537dc58b54b792f99faa9c0e0511078e9ee8122132d31c58451fa6453c393fce6e5640855cfd37c8898c8557f4e08cba0b1c4f1e7b75ae1daf4f38791be60
SSDEEP 384:yRPmzRKMErsfEcuDazvdUwIXhOw2za2m9lE:gmzRKWcOwamM
TLSH
T1A442986FB920697B9DDBE129FE257756E2F1102176D01E40E6FC8B1C11E7ACC2217827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b226acca4a2ab52d271516cabdd6f1037e8f703e8a47b0bd4d83a8884bd0116c
MD5 18aae12f607fcf1c8cdadb6905bc2937
SHA1 cc6df02632b05db66a0ab387f0867bcf45c7fd69
SHA512 26f0abb5766e12ae988cd471691676723ae7ebc41bff60f3d2d5fc200592d2ed5e6145de92ce0f49def774d0a32dad36370e13a1999e1d43f2f6ef08ead316f6
SSDEEP 384:yRPmzRK8ErsfEcuDazvdUcZXMOwq39a2f9lE:gmzRKG4Ow8fM
TLSH
T15052965FB920297B9DDAE629F925775AE2F1102176D01E44E6FC8F1C10E7BCD2203827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 e0798f98b7815fe772985f778f875453a85b4c7fea4edda17dfe3112552dc842
MD5 0dbad0aac5dcae4d57d5f2696a01af5e
SHA1 2f7d7367dfb4acd638418a27a7a490ece3f06808
SHA512 8e44a0c6cc94a87ea4a8c7cd8ce77debe0c9f7ea76afe7fb0b0401d381e34679dc560b12372b9d1fa7065a681aeb55e52b06e6a837d5fffc2d6771a408f9b65c
SSDEEP 384:rpjAj7KxkXqKf/pUZNCgVLH2HfgslCIXODfG+ErU3GVHGthnH:rZAj7KxkXqKf/pUZNCgVLH2HfgskyOz5
TLSH
T15F52F727644D963B0FD8DA88DC227B4F6CB5025676780D2896FA9C1803D97CE114B2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 372fb4e7f13633375bf835439e4312ebae16adc79a9478d71c18bdf8253e5591
MD5 1736b6f93236392924135a0e0ee4e459
SHA1 9d90ab8afecfc3986b7dbe2679e9f3caa8a94d63
SHA512 7825cde4b46c6c34d1f1d1baafac0ef2de2ef5ba9c155fc9d8569be623b28dd1add745c6e2dcfeec315100817e5f05e2eb8f7a600ca3935d84385d06d6dff6d5
TLSH
T131A0022046C21922CD515671716655817351582419D6572B6DD10844995F5C1B105200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f928863a73758bbc45db2ea671b37915a80d26f7bc302b7274375fb9d93d3326
MD5 7be609ad34332d3ba964db4a75b15505
SHA1 686afe046be41560981d941a9a24ad4a23939b08
SHA512 019111e0438f7ae9fba2cc25901efc2c37fcfcd65bb83e443fee5c6ca610b3e75c50c957b624b361f3589f769ab1fb21da4931ad9f5c1004d269ab5cbb940586
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 62a7e77ede8657a0830bbc9baa2bc293beee78f28991d658ceb1d98bac2be85d
MD5 628ad27824e18a1e9c368936067a3127
SHA1 b15741eb800b030eb50a35d82a3508f4037e2a35
SHA512 3a6dc7e33313cbbf45781e3480d89c638089302b8201d4300675e68d30852d0ea695d5d3634933af734fa36a00c21d353654f63c7749aafbeccd3a2fa8d6e7e9
SSDEEP 1536:PPaxmysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0p:HawtoSKa6qMwgCh3hodf8U8+RhpNu
TLSH
T11FC3123C2C865C6E0DF3E444704BFAF28E5DC662E04D945861AD3E8EA056CD9C593E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 1c3262ec1f1045377ffc57e69ad27f7fe6af8b67eb3c994e1cd1134a6a5c41be
MD5 64d6c1b7a0eaa0462175dd46db4ce961
SHA1 1c222060a4662111a397ba3668c5af72012f38f1
SHA512 d53fcde915521fd0c4a90ba9c91d7773b2c1f3e0dfe7790309c9c94ded357f90ae91e705fd0a089cdd67f454f938eb02c7b303ac2f1aa3c6cba521ff1c8d7d58
SSDEEP 1536:PPWymysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0p:HWRtoSKa6qMwgCh3hodf8U8+RhpNu
TLSH
T173C3123C2C869C6F5DF2E040B44BFAE2DE1DC4A1E04D946542BD7E8F6091CD99293E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 175a8fc058b24dcd57e92c175d173c26f1590ee0b79604d0dff5a655d5f96633
MD5 553254e5c73d81ff83b1a841a0c14766
SHA1 4a627a5d9f3ded059dd4e526a20baac4e3fceb13
SHA512 5cec4a63894ef0b3fbae661ac13eaeb3cc2ed9753a568798ef87189e26358b8feac11df624689bb4cf9de02d64b72bd7a1f6e0d8c5a7d29142325954448e6eee
SSDEEP 96:7C6Fd+uxNdc8TX+fqHyR39jaRDotok5+DDpRB6OGyvXnQgERfFnb3nJv4a:7CgBxNdc8b9oaDUDuBSiQ9Rf5b3nl
TLSH
T158A1F87279798877A57AD989B5427B43CEB86067A610AF98E8DC1B0C01FB4DC1382627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 077d6117b872b0bf256506ee701518820c476f6d6bf943b774d25f7b9aafc4ad
MD5 52f1a2e2f369884f0b1cb04bbf65fa54
SHA1 f5c1f5008da5d9571449ef8dd73eb4504c30d74e
SHA512 2f54f4a65aecff2b0569a6e98aeb7e841f4fc315f376b18cf48d4da27509cd5c8dbe159981e90924cf0acc165ff77a95a86c04b89bde7cfe9a47df924bd94882
SSDEEP 1536:PPaxmysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0p:HawtoSKa6qMwgCh3hodf8U8+RhpNu
TLSH
T142C3123C2C865C6E0DF3E444704BFAF28E5DCA62E04D945861AD3E8EA056CD98593E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2928_546733386\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 796091.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 796091.crdownload
Size 12.0MB
SHA256 4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0
MD5 3240bc150c493952fc0c727f47b96f5b
SHA1 bf3d5f6baca61e27b61d7365bc58df4e8f2f967c
SHA512 61c378817dc3bcdcc5f4c95414f91ec4621e4ec7841de7f6cbaae13b1d653b3fb69b503773c3cd703e886bfd20f4f1369cf9ecef0d405e3894ec513784d147a2
SSDEEP 98304:UYJOvTscod5DkasbMZszos0D3FuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl:UYJQscgsbMZfs/ObAbN0
TLSH
T11AC67C9533FC2A35E3B74B35A970721A05767C2EA901D78F5B85BA1D2972280CDE0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download