27841f2335eaf85fc2df7c70c7366174718a35773a209f4805913160be17a760

Analysis

user interaction
yes
max time kernel
101s
max time network
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MelAI-v0.7.2.exe
Size 15.7MB
Sample260623-eflbysav71
SHA256 27841f2335eaf85fc2df7c70c7366174718a35773a209f4805913160be17a760
MD5 62e91cb2a18d68eb25ed239ff73cd2f2
SHA1 46701bbe1859a54caec587892c3a8556442fc89c
SHA512 a5817d909e675387aa9712f9f9d398b8e6de04fe0939713b823f9dda556034b509d49f6a126268ae65379079ff8a61583d6bead321300ad7f035c7ebb990463d
SSDEEP 393216:LFxeWu5aNYAK3vfuPVrHlCKo3ef+FbuXBbHS7SbI3kG3:DsaNBNPtHlCpI+JuXFHS7Sbqko
TLSH
T178F6333BF18BA43AE469153A7976E210593F7A21A9134C069AECF84CCF251701E3E7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	MelAI-v0.7.2.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\MelAI\is-4UB5VLY3H6.tmp	MelAI-v0.7.2.tmp
File created	C:\Program Files\Common Files\VST3\MelAI\is-7NIS7I51YM.tmp	MelAI-v0.7.2.tmp
File created	C:\Program Files\Common Files\VST3\MelAI\MelAI.vst3\Contents\Resources\is-OAZPQBCGQ6.tmp	MelAI-v0.7.2.tmp
File created	C:\Program Files\Common Files\VST3\MelAI\MelAI.vst3\Contents\x86_64-win\is-J0VCDIH652.tmp	MelAI-v0.7.2.tmp
File opened for modification	C:\Program Files\Common Files\VST3\MelAI\unins000.dat	MelAI-v0.7.2.tmp
File created	C:\Program Files\Common Files\VST3\MelAI\unins000.dat	MelAI-v0.7.2.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MelAI-v0.7.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MelAI-v0.7.2.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1796	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/6116-0-0x0000000000360000-0x0000000000449000-memory.dmp	innosetup
behavioral2/memory/6116-8-0x0000000000360000-0x0000000000449000-memory.dmp	innosetup
behavioral2/memory/6116-46-0x0000000000360000-0x0000000000449000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266604234258671"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe
Token: SeShutdownPrivilege	2012	chrome.exe
Token: SeCreatePagefilePrivilege	2012	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2872	MelAI-v0.7.2.tmp
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 2872	6116	MelAI-v0.7.2.exe	88
PID 2012 wrote to memory of 1644	2012	chrome.exe	90
PID 2012 wrote to memory of 4764	2012	chrome.exe	91
PID 2012 wrote to memory of 4764	2012	chrome.exe	91
PID 2012 wrote to memory of 1796	2012	chrome.exe	92
PID 2012 wrote to memory of 2292	2012	chrome.exe	93
PID 2012 wrote to memory of 2292	2012	chrome.exe	93
PID 2012 wrote to memory of 5372	2012	chrome.exe	95
PID 2012 wrote to memory of 5372	2012	chrome.exe	95
PID 2012 wrote to memory of 5692	2012	chrome.exe	96
PID 2012 wrote to memory of 5692	2012	chrome.exe	96
PID 2012 wrote to memory of 3664	2012	chrome.exe	97
PID 2012 wrote to memory of 3664	2012	chrome.exe	97
PID 2012 wrote to memory of 3768	2012	chrome.exe	98
PID 2012 wrote to memory of 3768	2012	chrome.exe	98
PID 2012 wrote to memory of 2072	2012	chrome.exe	99
PID 2012 wrote to memory of 2072	2012	chrome.exe	99
PID 2012 wrote to memory of 4524	2012	chrome.exe	100
PID 2012 wrote to memory of 4524	2012	chrome.exe	100
PID 2012 wrote to memory of 2420	2012	chrome.exe	101
PID 2012 wrote to memory of 5400	2012	chrome.exe	102
PID 2012 wrote to memory of 5400	2012	chrome.exe	102
PID 2012 wrote to memory of 4980	2012	chrome.exe	103
PID 2012 wrote to memory of 4980	2012	chrome.exe	103
PID 2012 wrote to memory of 4976	2012	chrome.exe	107
PID 2012 wrote to memory of 4732	2012	chrome.exe	108
PID 2012 wrote to memory of 4976	2012	chrome.exe	107
PID 2012 wrote to memory of 4732	2012	chrome.exe	108
PID 2012 wrote to memory of 5840	2012	chrome.exe	109
PID 2012 wrote to memory of 5840	2012	chrome.exe	109
PID 2012 wrote to memory of 1636	2012	chrome.exe	111
PID 2012 wrote to memory of 5356	2012	chrome.exe	110
PID 2012 wrote to memory of 1636	2012	chrome.exe	111
PID 2012 wrote to memory of 5356	2012	chrome.exe	110
PID 2012 wrote to memory of 1272	2012	chrome.exe	112
PID 2012 wrote to memory of 1272	2012	chrome.exe	112
PID 2012 wrote to memory of 2480	2012	chrome.exe	114
PID 2012 wrote to memory of 2480	2012	chrome.exe	114
PID 2012 wrote to memory of 3720	2012	chrome.exe	113
PID 2012 wrote to memory of 3720	2012	chrome.exe	113
PID 2012 wrote to memory of 2304	2012	chrome.exe	115
PID 2012 wrote to memory of 2304	2012	chrome.exe	115
PID 2012 wrote to memory of 1656	2012	chrome.exe	116
PID 2012 wrote to memory of 1656	2012	chrome.exe	116
PID 2012 wrote to memory of 2196	2012	chrome.exe	117
PID 2012 wrote to memory of 2196	2012	chrome.exe	117
PID 2012 wrote to memory of 464	2012	chrome.exe	118
PID 2012 wrote to memory of 464	2012	chrome.exe	118
PID 2012 wrote to memory of 3344	2012	chrome.exe	119
PID 2012 wrote to memory of 3344	2012	chrome.exe	119
PID 2012 wrote to memory of 5300	2012	chrome.exe	120
PID 2012 wrote to memory of 5300	2012	chrome.exe	120
PID 2012 wrote to memory of 1060	2012	chrome.exe	121
PID 2012 wrote to memory of 692	2012	chrome.exe	122
PID 2012 wrote to memory of 1072	2012	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\MelAI-v0.7.2.exe
"C:\Users\Admin\AppData\Local\Temp\MelAI-v0.7.2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Users\Admin\AppData\Local\Temp\is-5SABZE1JBR.tmp\MelAI-v0.7.2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5SABZE1JBR.tmp\MelAI-v0.7.2.tmp" /SL5="$60076,15285813,893952,C:\Users\Admin\AppData\Local\Temp\MelAI-v0.7.2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffae8e9c728,0x7ffae8e9c734,0x7ffae8e9c740
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,5492191391008931827,13869348851306041951,262144 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,11941975921701547250,8190823978768878967,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,6522524370677327026,8556612007932396570,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,4321126968812329952,8911256915922136593,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,2668362303298070755,17306249064813020794,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,12709066064639994153,8239651689881977049,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3956,i,14080981029999043881,3480755533725628402,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,6850898626240566724,9430463218954100462,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,2694368833832959217,9878684591095490893,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,11545212055853252660,3351270567371425096,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5496,i,12228964671280231532,1268647194785966158,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5540,i,16217591623277865035,10946938122418467612,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,12500555850814521082,15411905034978085683,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5696,i,258005966290396739,8304406682081281139,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,13179248679738509410,14406334027179242215,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5948,i,8887977553606574340,1819292721780365043,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6260,i,3902598556134738817,2269062924495028616,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,17196582098940850850,12774655045274844922,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6100,i,9002576415024609840,8768977721653331750,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,6009442592948569594,2018906037455754295,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6244,i,2062616668714744971,1791480853074764683,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4764,i,7259316617753983721,7573742844904950628,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6004,i,6302666573079933452,6551589566212147307,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:9
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6492,i,17354660242954544005,17464923067019953727,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3524,i,10884487905370843352,14619367825018866683,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5752,i,17481648763898590608,15832946547262558668,2097152 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,13776366351553114615,11308603718079182298,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,5001101316552256581,12003136244331710079,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,10963538497673559114,2811754647020438933,524288 --field-trial-handle=1812,i,10032922206053920235,17410620934716692740,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:1072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 1024KB
SHA256 90686752b43b778580e8c1f86e3a7ea064c9ea317fc4fa92ed99c37db2adcd8e
MD5 f955937ce458a741869d90ffda194029
SHA1 e93f01e23f8a18c9895385777bd52b6a338f7a8d
SHA512 9f4537769b3d32013e8f1b810d8673c69e5aea103b33986753c1ee07cfabea865851f71c71aaf6f9b56d9c7718634eeb8d0f1bd0c0129b37f2bc265b6bb682f7
SSDEEP 24576:K1gWYCGpUO6MIjPyeoBiT+uScyVYWjbAbYhdlorDgPeuRjXQh3EeYUC:RWYlvIjrOJffYWbhIAPeeM5EeQ
TLSH
T1592523D49BF40A06EE76A338DAAC6B36B1172779E34A07F30DE8156B3CC63923C64515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4f61e8ea792465971970d59d0afde2a3d9be5d003ae9b56b11ab1e8fbf7688a3
MD5 a61cd1f4b016f212a1d86548eede016f
SHA1 a84b6aeacb05bfa41a324ba41d2e81cf6ff88109
SHA512 1cdc4e2d594e5ce1858369f4045be2ff0ea10b668e195e643858784b25f36c8408636af6c092221db24e25a6c55fdc0e4d94677ee1eb45a801e1bf0339fe345b
TLSH
T1222155D32DF6DE04CFA00F7628D3495DE764BA520B960B0BE0B5DCA86CD33B5069C654
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 47c74201b79c024b21df2916cb57c135362e65c5b2be4013f5e5caa3350e573e
MD5 e2f655c4775bb5635ccc019432b027fc
SHA1 c26f79a28c2b1742441ff516569b32b9b069a998
SHA512 a3fe2240170e233d82ca8842b15c9411d1ec7d2c35226d712d65edd013f0f34bc681cb16b80d491f19e7f92b271be7b886ab9c52bd74b9897d06008e72d4ede4
SSDEEP 384:D2LRAitS6JBJBgiHs4ciZC9CIrKx1lD5ySHcQM0aaLQgfKNaPcFYA6C8vtMKAmoa:i3oCW7C
TLSH
T14352ABB7C7D8862DC99516F0A7247E1BCE190A24832C3C66C9E4BF4B93E2471E35175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 dd2a5c3539d43de0eeeae8c6ba0f8ad0127bc60d73f606448f53369170343546
MD5 da15791988c5921b885a621c3a5f9468
SHA1 8d955100abaaec4f7dadb79afd614de4bccc1397
SHA512 a74716ed109105280ff6ea23c2be3729d96d3577e73ff4573a14428c241be5dfa8025d8def483a95ca6ed404c3f792d539ee1d18513063c61c6bbafd662ad285
SSDEEP 192:3RqGeoJbv7gAPRp2A9NHsb+WNnO6d2aeJRVyIsnAUge:3Rq7IjVXfrwPdW3e
TLSH
T19F32B71EA950A57B5CDFD22EFA217B57D3F5202275D42E84EAFC8A2C21E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5efca660a2afd356df0722082d066232a0614abd089df94458010038be4d7989
MD5 c412cb31511c984ba48e911b67a3578d
SHA1 5547ca457cdfbde913d34a8cc7773652426a33af
SHA512 0b79961847f7967686ffc7237ea2eb4d46802721bae51d0cac85021e801d388d739142e5405945e0bff7355f28def291b25d6d3c42fd53ec102ccfaa9458f34e
SSDEEP 192:3RqcBzGeoJbv7gAPRp2lNO29NHsb+WN+sLO67HD2haeJRVyIsnAUge:3Rqmz7IjVX8rwZrv2f3e
TLSH
T1A142A51FA920A57B5CDED22AFA217B57D2F5202275D42E84EAFC8A2C21D7DCC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ea87c7b00aa4b1857d900ca40c62ddf3afe6c39e28d18ff5dc36970a59ef2dcd
MD5 5e7c6b0e07d5e7673850f6d7563d68b2
SHA1 0b8b6246e78f0c5c5e0a6ba7daf52a105798f38a
SHA512 861cb9f730aebb800537a4efa70a0d1ce26e9583d86cd1b406ac594f3f8034aa256083de983948080bda535f7c5c72374d963a4acbc15010057200b899b8935b
SSDEEP 192:3RqcBzGeoJUAv7gAPRp2fuNO29NHsb+WN+sLO67HD58s28ae8RVyIsnAUgE:3Rqmz7IXVXLrwZrvx2t3E
TLSH
T14642A71BA960A57B5DDED22AFA217B17D2F5202275D41E84EAFC8A2C21D7ECC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fcfa95d248cb0b386a7dc87295a44a912737e85c70bad5e01124cec541c5e2ee
MD5 74c99c22fbd980c5aface0b0e8f3e52f
SHA1 be904912f2a5e7e2fb620782a8f5129d8fac2cbe
SHA512 ab93de4fb6a6255ee4999d196858d990f627a1376e0bc08e7fa28c5ef1caa1a3b41907d1703f144f6bb163eb63076c82251f8705c8278495bec874223ea98cda
SSDEEP 192:3RqcBzGeoJFv7gAPRp2fuNO29NHsb+WN+sLO67HD59929ae8RVyIsnAUgE:3Rqmz7I1VXLrwZrv12G3E
TLSH
T1E842A61BA910A57B5DDFD22AFA217B17D2F5202275D41E84EAFC8A2C21E7ECC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 99513059df0aac994b05f757a9de530a6ca60c823a1ff40e14c39bae40e33338
MD5 ed911d44a4beba7ec15d10fb4c231014
SHA1 54c5d99ea89cd8dac7debf86eec6aa33dc36abb9
SHA512 29a644d766a479ec1bb698ef102b7e73b7ed850dcddb98ef9a0a0b86523df008fe74d12e02d2ba626ca33316cacbe308dedb0054822d47b4d64cca4ff70efca3
SSDEEP 192:3RqcBzGeoJwv7gDPRpHfuNO29NHsb+WN+sLO67HD58s2MaeORVyIsnAUgE:3Rqmz7IsgX6rwZrvx2R3E
TLSH
T18542B81BA910A57B5DDFD22AFA217B17D2F5202275D41E84EAFC8A2C21D7ECD3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a0104f035593e186c15af5fa22ea88411281fb78a2c5b1b0f80d82da660f7861
MD5 e1aea29de3fd9b0351024d3fe71e37fb
SHA1 f23190ace41d17cb94a8c2766ff9cec1acc0b4b2
SHA512 45510d4ddaf06777833ac8839da121c9e63a7278efd5190ead5b00d7b0672984b3d3838f4dca723463a21df598af6e0a4ceebce717578dc6f711d2fcceadfa3c
SSDEEP 384:35jRg7KxkXqKf/pUZNCgVLH2HfgslRYXODj2+ErU3ttHGI4bK+n/P:3JRg7KxkXqKf/pUZNCgVLH2HfgsDiOPc
TLSH
T19552FA67688D9A7B0FC8D94CDC166F4FADB5018B76680D2457FA5C0803A5BCB124E1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 94dccdde306616e245753f3e9b7e7125ea2799c125089c7681e8cbb808ce8d17
MD5 8773fce18c5b63ea724bb5e357655722
SHA1 3018f80e2ad2acc722941fa007a9c22db0fe9ba1
SHA512 7a3e9ac1a0cdc95d2f1f25ba41e9da80ffbedd0cb96b81e53052df94c114dc0189bff600c9330a8a88cba9335ada9fc8008cf03cde5bbe3b2060ad512b710d1b
TLSH
T164B01280908B2520C80442B0211410CD230A4E33C1001286C6D05A85DC430E44219551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2e7e8d47e2f4640f8d64d98ba75c10e30f351cde6e64b067c378b22412962117
MD5 ba765cc425d14486766cac38b95d6c04
SHA1 2bd9d970d807f86baf1009e128aff5d7abd28ee4
SHA512 d22e797d9e9f2b5b5493b44c63a47fe11d2e39c957cc3d9b9168e86c2803c2fdf1f39fe62096f1a2cf8eb15fae17c5d2eb47e285003bb18fe7fbba661eea806e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1e452642f03705f527e0fddd9c8b0abcd55f194417741d5ec7fcd84b86de3d58
MD5 e75a1d91bfaeff6d71534781ef735703
SHA1 06cea843d001433b4d848da2feba5d31d22d0356
SHA512 1a1daba3ba1d7b970995b1bcb57270f857945da5d263d42242cb75769745a16caf74c9189353c011a67b466809a108d472b4bbab9d92080d039de6ab5e4559a8
TLSH
T162A0025145F28412EE804AB0646F09826F6298145A514313949118848CAF5C5871A105
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 0cd3bc9c2a23a9c8b363313d9aea6781b33585812a864b68170485f8e5ec33fb
MD5 075ee500b9248f04ef69d84464a86b2a
SHA1 ff8d9629efaca332d8792ecc6560bb877873ea65
SHA512 8fa7edb93713a91f2b5180daf59b1b6bb81b02a97bc44f80080d38650da86a8b1b8cd7074a4725af668dfe5e3906db0e0246eedc9c65a29992c9f8c7104cea64
SSDEEP 3072:u0ylzPzaFEFmlf8j9Mvz/EooOMsymfeGfu3olxFKSkLk81Bi:uZbzvK8j24ooO/u4DAk4i
TLSH
T14CC312716C3F8833442FDCBC62BEBD165EA1E972EE5084F0AE403DC9909B5991C57876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 dc156c2edc2021274f5a7b7b16252a21075f1e457f52225566865eb86b171930
MD5 43f1f768020cbd9ed92db84f7e144d40
SHA1 c786a05f4d6e32c2d7db90c93adaf7f93b3bf479
SHA512 2d912dc33693b399897fc396393e52131a7983d5f880d9611eb607c5dd2b1e678f235913e6561261ef8ed3942b28d4c5097274607f99a3a48f40c2ae563a912c
SSDEEP 3072:XylzPzaFEFmlf8j9Mvz/EooOMsymfeGfu3olxFKSkLk81Bi:6bzvK8j24ooO/u4DAk4i
TLSH
T1E0C312616C3FC833502EDDFCB2BEAE1B5E11A871EE6140F05F402DDA90AB5962C57936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 4c60f6b2124cfaf2a9ba0925ca3c10831933b3fcc05c2bc178da587f623541b1
MD5 a071e99d398a9bb30f9f296f266bf90f
SHA1 7f8858a1ea524550590deccddf9b8262fcdb9448
SHA512 c23a43e463ebc55cfb1735d5e011f4cd5d02a2bdf1655e44b91e8d840dc822c77f10fce985718f427dd6370d39fe96016817d5fcd57b5697f542126f2720ac0a
SSDEEP 3072:QylzPzaFEFmlf8j9Mvz/EooOMsymfeGfu3olxFKSkLk81Bi:NbzvK8j24ooO/u4DAk4i
TLSH
T193C312616C3FC833502EDDFCB2BEAE1B5E11A871EE6140F05F402DDA90AB5962C57936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 18010a0bd8f04717ba8b40d293dcd4bc6fcdf5533a150031fb71cdf63e85fd02
MD5 dba1b9f2c1790f7559debae3821e7dea
SHA1 8ac38c5edd870761cd33fd4d09bb77f8a54b2248
SHA512 ebb2dd74e0e7d7a9d2d8ff1cc5cb9c23ce2b3c6802eafd6e8fa87558d52161fffaed3a30ee77a6d0e42380ac81fde6cfbca7351dbcfc8fe62e47e61b5933c591
SSDEEP 96:UC6fd+CW1CHw1yfFtS8OERDotok5CdDyB6lGyvQ7CTsVbEnv4a:UCMRW1YdSUDUDmSh7CT8by
TLSH
T195A11A72A4688DF78476EA89F9072F839E782157A620EFC4E9ED1F0C15E78DD0342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MelAI-v0.7.2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5SABZE1JBR.tmp\MelAI-v0.7.2.tmp
Size 4.2MB
SHA256 7170efd983e96b0404915d4a43871d686fdadcd08cc024e0cb4504cc6280294b
MD5 a642d909fb259a9314f54f9fec1ca936
SHA1 2598808b36515de31d49aba090d078fa322c6e44
SHA512 957c1dd9d0c742a6bb88b4d839ff8d67696061a0ec4bcc32a3b9878ed30b53b09825696c20aa56630f99a04b423046f46d3752cc7833e50d9648debfaf80d241
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Pp:7xuHjWfZIzep
TLSH
T17B268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_2062357102\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

is-LZZ6H5DRNP.tmp

Path C:\Users\Admin\AppData\Roaming\MelAI\is-LZZ6H5DRNP.tmp
Size 928KB
SHA256 341df680b1380aba6c14a1ba6d3493f775d00648dd12e34590542354c6d38852
MD5 0fc62e50d1e581ee1d86d6c406c60100
SHA1 b489c56bc4f8382482918dbc0128a7431af3d8e1
SHA512 0f5600586f22d86758c67e8f068721c571c3b04b098830c9b0aa0231660f4d5b817c3f7f84d1a16e6020ad13ef2e2ce49d1c10c6149fefff9ecdc0b308eac6b7
SSDEEP 24576:i+dJnaiwPo4y67sJd8YcWRyC5ssE7ZMjJNtLJl7nV:i+dJnaiwE67Md8bWRynX7wPtnV
TLSH
T1DD15D00644F0D129068E246FF7A8D23FC6D457893ADA471627FCCB4C7709AB9A3B6871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2872-45-0x0000000000BC0000-0x000000000100B000-memory.dmp

Download

memory/2872-10-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/2872-9-0x0000000000BC0000-0x000000000100B000-memory.dmp

Download

memory/2872-6-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/6116-0-0x0000000000360000-0x0000000000449000-memory.dmp

Download

memory/6116-46-0x0000000000360000-0x0000000000449000-memory.dmp

Download

memory/6116-8-0x0000000000360000-0x0000000000449000-memory.dmp

Download