48596facaf7f58207c7c29194c06aa777b875d99355bcfb707bd974bbe9bd7ed

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Natcha.exe
Size 2.1MB
Sample260620-cbfvkacx9l
SHA256 48596facaf7f58207c7c29194c06aa777b875d99355bcfb707bd974bbe9bd7ed
MD5 eca76d50300bb8ac0eb1c6b86680182c
SHA1 d49af30d4b3872644bc2b1d43b08cefaa8f29906
SHA512 05acaf44f7ea9c7515bc0ef65c72cc12ac71b5656e8a889e9900db42a815ff5113dad1de5f936f4774577a4ecebfd7df92d5e3161991cce3271995012800f984
SSDEEP 24576:ne7Xs6w0BQRArfOS99ioXxPWe0nbeDs88PmTp02YsbtgnQ4rf5tCKoPaxZpB27:e7lw/ArfOS9SnbY8PmTp02Ys2nN5th
TLSH
T169A5270B67550DD4D0269178C6ABDB17EB633C340B2152CB2EE26B5BDE73AC09D7E260
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
74	1580	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
74	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1580	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263940965661733"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4928	Natcha.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe
Token: SeShutdownPrivilege	5720	chrome.exe
Token: SeCreatePagefilePrivilege	5720	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 5652	5720	chrome.exe	91
PID 5720 wrote to memory of 3440	5720	chrome.exe	92
PID 5720 wrote to memory of 3440	5720	chrome.exe	92
PID 5720 wrote to memory of 1580	5720	chrome.exe	93
PID 5720 wrote to memory of 4780	5720	chrome.exe	95
PID 5720 wrote to memory of 4780	5720	chrome.exe	95
PID 5720 wrote to memory of 2816	5720	chrome.exe	96
PID 5720 wrote to memory of 2816	5720	chrome.exe	96
PID 5720 wrote to memory of 2852	5720	chrome.exe	97
PID 5720 wrote to memory of 2852	5720	chrome.exe	97
PID 5720 wrote to memory of 2496	5720	chrome.exe	98
PID 5720 wrote to memory of 2496	5720	chrome.exe	98
PID 5720 wrote to memory of 5212	5720	chrome.exe	99
PID 5720 wrote to memory of 5212	5720	chrome.exe	99
PID 5720 wrote to memory of 1280	5720	chrome.exe	100
PID 5720 wrote to memory of 1280	5720	chrome.exe	100
PID 5720 wrote to memory of 4084	5720	chrome.exe	101
PID 5720 wrote to memory of 4084	5720	chrome.exe	101
PID 5720 wrote to memory of 4788	5720	chrome.exe	102
PID 5720 wrote to memory of 1344	5720	chrome.exe	103
PID 5720 wrote to memory of 4588	5720	chrome.exe	104
PID 5720 wrote to memory of 1344	5720	chrome.exe	103
PID 5720 wrote to memory of 4588	5720	chrome.exe	104
PID 5720 wrote to memory of 2596	5720	chrome.exe	108
PID 5720 wrote to memory of 5956	5720	chrome.exe	109
PID 5720 wrote to memory of 2596	5720	chrome.exe	108
PID 5720 wrote to memory of 5956	5720	chrome.exe	109
PID 5720 wrote to memory of 4144	5720	chrome.exe	110
PID 5720 wrote to memory of 4144	5720	chrome.exe	110
PID 5720 wrote to memory of 3412	5720	chrome.exe	112
PID 5720 wrote to memory of 3412	5720	chrome.exe	112
PID 5720 wrote to memory of 4416	5720	chrome.exe	111
PID 5720 wrote to memory of 4416	5720	chrome.exe	111
PID 5720 wrote to memory of 1372	5720	chrome.exe	113
PID 5720 wrote to memory of 2400	5720	chrome.exe	114
PID 5720 wrote to memory of 2212	5720	chrome.exe	115
PID 5720 wrote to memory of 1372	5720	chrome.exe	113
PID 5720 wrote to memory of 2400	5720	chrome.exe	114
PID 5720 wrote to memory of 2212	5720	chrome.exe	115
PID 5720 wrote to memory of 2740	5720	chrome.exe	116
PID 5720 wrote to memory of 2740	5720	chrome.exe	116
PID 5720 wrote to memory of 4124	5720	chrome.exe	117
PID 5720 wrote to memory of 2936	5720	chrome.exe	118
PID 5720 wrote to memory of 4124	5720	chrome.exe	117
PID 5720 wrote to memory of 2936	5720	chrome.exe	118
PID 5720 wrote to memory of 1264	5720	chrome.exe	119
PID 5720 wrote to memory of 1264	5720	chrome.exe	119
PID 5720 wrote to memory of 1916	5720	chrome.exe	120
PID 5720 wrote to memory of 1916	5720	chrome.exe	120
PID 5720 wrote to memory of 2832	5720	chrome.exe	122
PID 5720 wrote to memory of 2832	5720	chrome.exe	122
PID 5720 wrote to memory of 5632	5720	chrome.exe	123
PID 5720 wrote to memory of 5008	5720	chrome.exe	124
PID 5720 wrote to memory of 2080	5720	chrome.exe	125
PID 5720 wrote to memory of 1300	5720	chrome.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Natcha.exe
"C:\Users\Admin\AppData\Local\Temp\Natcha.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xac,0x134,0x7ff84040c728,0x7ff84040c734,0x7ff84040c740
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,7804426299894929223,2389582929506950278,262144 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1360,i,7987719788276326604,7000899685852872832,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,11404973859921969226,1673733793536705057,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,16728562281657463833,134922830576292259,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,15499206218452417551,7900855689993380836,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,8913047349402912828,6111221624546396437,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,16158023050329699590,2793647445010011853,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,5178320470350304779,11223932072778848668,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,1206430489907049054,1304209821537527908,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,6763429669022374764,11352470131926719374,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5536,i,9901728735874106769,2626060900427723339,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5540,i,11708013852336778855,17038297067809890363,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5528,i,3762184496537876809,12690483393498431632,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,15654783549218614309,14650203024271751155,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5320,i,13891581055471684447,7254279105133713652,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5984,i,16370144660379753166,1615561015589838159,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6260,i,16032452237512627503,1958933042437634010,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,9787467418937430031,8186217632666822134,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5996,i,6480727245523483484,571983825273689606,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5736,i,11508059896050296772,10149889812384024843,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,5265494402039998902,1268338497613703706,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5604,i,159876065606181483,4293019727693963165,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4692,i,246021954237132743,7315700059179339430,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:9
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6436,i,18352697544820950554,2304221652141381664,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4852,i,9079808599831340013,6152764844911017373,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3720,i,17350518261667387172,5529155047172764976,2097152 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,8336470436131500467,5749433203745297762,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,7019725265021718048,3753542667021475320,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,14585566077386671114,8578665607601496456,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,5647453650782585327,4817353675050154514,524288 --field-trial-handle=1884,i,17243078073174948965,2434014692591723823,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:1300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8926b5efcdc68d0f548e08ce23f39a4674d9aadb42e2a7f333bdd70c7ae38827
MD5 782924e5e8b871eb155bdc93c6ffd8e2
SHA1 252b7312ef371b61c15ec1017e41f95c2cc3ad2d
SHA512 5d848650bcdd8d18bffcf5845e0f1bd7f83d111dbdb367315264d2f29b56512f67fa7700c2239847d0c2e68d7536d92d7e7fc635152181b2d371d50fdcd150e6
TLSH
T1AB71B65DE241F1A2DBAE097258EB54493F3E6B0E12970E36ED8CDDB3A6CE3A4505D810
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d4717b7689ccea7b044004126d803c2bbe0dea008f2775614c9d81dbf202054e
MD5 99c6f73b799b161d1722ebd460c37192
SHA1 85ada02cdcbd2ff75ab751358114f38109f49010
SHA512 5de893ba5946c2742a8c38c8f38ea6ca5b975010848f3504eb2357c02f29c66b88ba59958f8c0202c1848d3b6cd0ba3f9e9f63495408c38d88d4cf650398ed28
SSDEEP 192:DNcnbjdzqMJlJmymyepeB0u6mJvjIbaPm0v3fPRNPfxmmkmEcmmmgmtmDme:DNcnbjdzqMJlJmymyepeB0u6mJvjIbaH
TLSH
T178027BF7C3D9C62DC91256F4AB15AE1ECE290A14432C3C2A89D4AF4B93E2871D25175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c93048cd6cd9f6af7222b8b4f2d132a20b64ff723b67f9e9cd12b6b9f70a9cde
MD5 54dad83bdd097d9441189899905dd0ef
SHA1 785a27e53825a5f7d3f729f1b75b2a30911ea43a
SHA512 b476ce24e37facdea72d376553416bca86785a64f0d5184fdd44bb94cb2f2a92aafdb5fce587a336d1b322c8eef5a2df137b3a471ee82c39ffe58a75e768f22d
SSDEEP 192:/RAcBzGwYTzWv7FSAPRp2Q6IYmR97Hsb+WNtEcyvkq+om27pehVyIsnAUgE:/RAmzlsiZXprBw0R42aE
TLSH
T1AE42B61AA920253B9DDBD299F921B76BE7F1112271D01E84FAFC8A2C11E7ACD6203417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 69182cd360eaf5eaaf4ccc1656a05fe9237a73379ce5f000a085b0ef9d72881e
MD5 7b7bdedeb62c28a8c3ac80a5962a3db3
SHA1 4278d4eb9a54c815edc23bade6c1abb932de2198
SHA512 f9c49c61c5be7a06fb6e711b879ebc14ef08f61bf06a153b562ab4a4e5763bce454af93f2ccc23dbe80272b125226163776b05869ed18a94f2082fc4083bec6c
SSDEEP 192:/RAcBzGwYTzJv7FSAPRp2QmkR97Hsb+WNncy4om2pGpeCVyIsnAUge:/RAmzlsJZXptBwhq2pOe
TLSH
T1E032C81EA920253B9DDFD259FD217767E7F1012271941E84FAFC8A2C11E7ACD6213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1ea9de33be5cc31dbb604447e360c51dbf780a329565fd9ed82007ce3e1672b0
MD5 18887a16b43718862dbcb3f1853eb7d1
SHA1 4c33954dda7a43b631e534701588e4312be10524
SHA512 f095ba4d44336d2177a8c7d2ed8572208f9d616189d9fe8a782216a41afb2147f1a8b12ccde9940c6d8e33537dfcb5ae14b72338a2f664a15156ae33321fa2a8
SSDEEP 192:/RAcBzWwYTznv7FSwPRpuQ6IYmR97Hsb+WNtEcyvkq+om29hpeTVyIsnAUgE:/RAmz1svRXhrBw0R42mE
TLSH
T13052C71BA920253B9DDBD699F921B76BE7F1112271D01E84FAFC8A2C11E7ACD6303417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5804613c7908793e756aaa94490b958a600e463d7a4c07410a051d39b207a873
MD5 b80eb8929df2b8c993873b57b278b47e
SHA1 0c75ebf07da53b46ceb7c1c24e18b05c5d62b436
SHA512 14124aae39ef3ba385015541e2714307fd63eef5f3c56cd62e7cc2bc4c5bcc6ed624ecc09d02b1a30f14933b16017960a7166768f0410be5c46e8f0fcb9b83f7
SSDEEP 192:/RAcBzWwYTzHv7FSAPRp2Q6IYmR97Hsb+WNtEcyvkq+om27pehVyIsnAUgE:/RAmz1sPZXprBw0R42aE
TLSH
T10042B61BA920253B9DDBD699FD21B76BE7F1112271D01E84FAFC8A2C11E7ACD6203417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 89ca882c44899be24f4143bc47112dff62056a6d82a4bc2f928c923868c8cdbf
MD5 9e008f94a05cbedb9a5cdcabfce8d8fa
SHA1 1d5fd1a5d32ed1d1b1223592c10f78f8b097018b
SHA512 3edd11c631acab406c85e54a21f97ca2692879701312a641bddf5d4e537a082d5740e073fc63e8051c331064df58e580a7e77dac04ca58e17013117cf41339c4
SSDEEP 384:F/jzG7KxkXqKf/pUZNCgVLH2Hfgsl+MXODzC+ErU3AhHGXnB3Ar:FLzG7KxkXqKf/pUZNCgVLH2HfgsQeO/K
TLSH
T1EF520867688C9A3B4F98D98CDC167F4F6CB5014772680D2463FB9D1803A5BCB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 33edb6066f7af88ea2aab4c420c3baec2839ef346d2f4d0d2e1315a93cdb217f
MD5 11c86602f15d8e4c1e269ee2c53939a2
SHA1 4472e8467cf7614b9abe48535e993379f81461e8
SHA512 bce68cb942579fd12e2f46fab8255ace56e3efee64d201c8031406829d086ca19eae08fe47350b0294cd15f1c432687a901984fd0d0a10ff3bd8fa88a3078606
TLSH
T1F3A0022941C60421DD448B757461559167D148A419655F4374AD05459C9B2D04542314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d8c2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59d8c2.TMP
Size 48B
SHA256 d99194605ea83fcf924e0b689e95b1cbb502b1d8f0645069c16cf35901dea6a6
MD5 7bab7f0adbc7dfc3b28436a869cfd459
SHA1 d0014111f9933ccc8d332dd2ca142e18108779b6
SHA512 b11462644c82f56d6bfe5f66b79b04841fff084f76ae0ea402365281f264bf0da71ceb319056c3676a4bdf0f02c47b826716ca9ef2a0352f3a3ed64a613fe774
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 58b81b454970bda6a31e4ce7fc6ee2947fd1d0718d182b0fabcd0efcbbc0e863
MD5 c571e15c1567a6a915627103c658b67b
SHA1 e981b8bcf1eae973fa6bb5443e4c6c0ef4adc9cd
SHA512 a201e5a0241c6c8e4d4caf57eebdbbea98b13c9b39d8eeee4017997414fdef9a91a447f141ef63fa57e6d9062183ec4eff2528e72d2cc6aa55a0788c2d53a2e7
SSDEEP 3072:KpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBM:KpsLiqC6IPHXi0X6vK+1O
TLSH
T135C31292B86A8EE712D4D610716F1B0F8CEC4493A0E4D99BE5F33F415247D92811FEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 65fed1004639f785f00e6282f349db9e3d4a6ec5768ca56a9f9041c165ebfc7b
MD5 b0041cba8d7a672843a1ac91911b8104
SHA1 115f87216a396d8d347d2ea0344b4f71e4ee73de
SHA512 8339e4b577bfb906d7d839072623556baf07da3340f9cc2ec66f792f1bfeadfa0660d02d212e5f1a8d5af01e0b4e9ba187a34f463941908e88cd518e8026e971
SSDEEP 96:qC6vd+XzRNf0AXGRDotok539D9B67GyvqUKXxs4bEpHv4a:qC4gzReXDUD1jDOKXxZb4
TLSH
T122A1267264388DBB4A7AD988B4467F07CDA07167A961AFC8E9DC1F0C21F78E91302122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 9a10fd62857f2ee3e34009b04410c8cff5373c94ebe2c94d94832925af234db1
MD5 14a2668a5283af4d23d2a4dcf4311e39
SHA1 3ba5cde4585b2c40d6bb9d5a3fc23446031c44a5
SHA512 c7af7c0b132d45f1986d931631687702cf4c859b7962196252df8ecd93ae82da91299ccce959802464957dc6835c4eab2f4539d483e8317a5e36d459b8702eac
SSDEEP 3072:rpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBM:rpsLiqC6IPHXi0X6vK+1O
TLSH
T135C31292B86A8EE712D4D610716F1B0F8CEC4493A0E4D99BE5F33F411247D92811FEAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 45a587fb3dd77258526baaa091bf3df7c059084dbf8daf1eff29bfd7abe193c0
MD5 fe5c5fc85efdef5b2203ed5d9a911054
SHA1 170d8f7b58400a540eed6ba6d730777b1dcf6922
SHA512 1d5a78278c3b5ec6fc9c909d815b05cb29511ae56a91fc1669f8ae1857f397c0b17d2ba558cd8df51d968747d2e9a3a8c308c4a571717a4b3885380fb0372162
SSDEEP 3072:DZpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBM:DZpsLiqC6IPHXi0X6vK+1O
TLSH
T146C312A6B46A4ED705E09914715E3A0F8CFC8593A0A4E98FF4F63F41524BC95810FD9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5720_670679535\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download