c9e5bcc2616f9c5b0679a97cd6b8b4c86366ac851382b1ec2287b090428ea426

Resubmissions

27/06/2026, 03:50

260627-ed6vwagw616

27/06/2026, 02:49

260627-da734ahs4l6

Analysis

user interaction
yes
max time kernel
630s
max time network
628s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
keylogge1r.exe
Size 263KB
Sample260627-da734ahs4l
SHA256 c9e5bcc2616f9c5b0679a97cd6b8b4c86366ac851382b1ec2287b090428ea426
MD5 d7fd27887ff26965a3fe8268c63ae017
SHA1 67381a1b93fe25be1bbe60c47fe74e87b0c8a212
SHA512 a86d2e1fd0c9bedef6f78ccdf484224e7c6ba5aeace8ce707259e0144d7c1210a6db579194236ac5513a6ad761987b76164f870e4c6438b7631c57b64f703070
SSDEEP 3072:/zdxjrKbM3srXGMqLSbdUZLMLojGUD6X6YcJOjWR3S0418PWZ8m1Xc4QdyumtExc:/Jxj2M8j1st6X6Ych3UGeVG85
TLSH
T138446CC5FBC69CEADA054639899B83793738F6D016839F17093873311E27AD0BD8761A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Local\\Temp\\keylogge1r.exe"	keylogge1r.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com
65	discord.com
67	discord.com
16	discord.com
49	discord.com
50	discord.com
60	discord.com
69	discord.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270023030324199"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5240	NOTEPAD.EXE
4988	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
3956	chrome.exe
3956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe
Token: SeShutdownPrivilege	716	chrome.exe
Token: SeCreatePagefilePrivilege	716	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe
716	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3196	keylogge1r.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2656	716	chrome.exe	93
PID 716 wrote to memory of 3068	716	chrome.exe	94
PID 716 wrote to memory of 2984	716	chrome.exe	95
PID 716 wrote to memory of 2984	716	chrome.exe	95
PID 716 wrote to memory of 6036	716	chrome.exe	97
PID 716 wrote to memory of 6036	716	chrome.exe	97
PID 716 wrote to memory of 6116	716	chrome.exe	98
PID 716 wrote to memory of 6116	716	chrome.exe	98
PID 716 wrote to memory of 3420	716	chrome.exe	99
PID 716 wrote to memory of 3420	716	chrome.exe	99
PID 716 wrote to memory of 3876	716	chrome.exe	100
PID 716 wrote to memory of 3876	716	chrome.exe	100
PID 716 wrote to memory of 4648	716	chrome.exe	101
PID 716 wrote to memory of 4648	716	chrome.exe	101
PID 716 wrote to memory of 4208	716	chrome.exe	102
PID 716 wrote to memory of 4208	716	chrome.exe	102
PID 716 wrote to memory of 1504	716	chrome.exe	103
PID 716 wrote to memory of 1504	716	chrome.exe	103
PID 716 wrote to memory of 6040	716	chrome.exe	104
PID 716 wrote to memory of 5640	716	chrome.exe	105
PID 716 wrote to memory of 5624	716	chrome.exe	106
PID 716 wrote to memory of 5640	716	chrome.exe	105
PID 716 wrote to memory of 5624	716	chrome.exe	106
PID 716 wrote to memory of 5584	716	chrome.exe	110
PID 716 wrote to memory of 5616	716	chrome.exe	111
PID 716 wrote to memory of 5584	716	chrome.exe	110
PID 716 wrote to memory of 5616	716	chrome.exe	111
PID 716 wrote to memory of 2520	716	chrome.exe	112
PID 716 wrote to memory of 2520	716	chrome.exe	112
PID 716 wrote to memory of 4692	716	chrome.exe	113
PID 716 wrote to memory of 4692	716	chrome.exe	113
PID 716 wrote to memory of 1624	716	chrome.exe	114
PID 716 wrote to memory of 1624	716	chrome.exe	114
PID 716 wrote to memory of 3904	716	chrome.exe	115
PID 716 wrote to memory of 3904	716	chrome.exe	115
PID 716 wrote to memory of 880	716	chrome.exe	116
PID 716 wrote to memory of 880	716	chrome.exe	116
PID 716 wrote to memory of 5948	716	chrome.exe	118
PID 716 wrote to memory of 5948	716	chrome.exe	118
PID 716 wrote to memory of 5588	716	chrome.exe	117
PID 716 wrote to memory of 5588	716	chrome.exe	117
PID 716 wrote to memory of 4468	716	chrome.exe	119
PID 716 wrote to memory of 4468	716	chrome.exe	119
PID 716 wrote to memory of 5804	716	chrome.exe	120
PID 716 wrote to memory of 5804	716	chrome.exe	120
PID 716 wrote to memory of 1312	716	chrome.exe	121
PID 716 wrote to memory of 2236	716	chrome.exe	122
PID 716 wrote to memory of 5796	716	chrome.exe	123
PID 716 wrote to memory of 3956	716	chrome.exe	124
PID 716 wrote to memory of 2320	716	chrome.exe	125
PID 716 wrote to memory of 2320	716	chrome.exe	125

C:\Users\Admin\AppData\Local\Temp\keylogge1r.exe
"C:\Users\Admin\AppData\Local\Temp\keylogge1r.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Users\Admin\AppData\Local\Temp\keylogge1r.exe
C:\Users\Admin\AppData\Local\Temp\keylogge1r.exe
1⤵
PID:1312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffcd376c728,0x7ffcd376c734,0x7ffcd376c740
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,6570482239110224279,7892038899079237542,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,18027874458742239497,5764880528765458799,262144 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,15852467580520591094,12476823572396981498,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,15720413287307622008,558151647752892291,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,1507668530120773179,17275244073205967271,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,4057973703469906318,15273450381673692866,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,9376206156300474871,550172402870933638,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,11339812795946463893,13963124129971076850,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,6697853535363087083,9654302415877693249,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,10583871117253869976,11309836888750414643,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5488,i,9303164840739345168,6768510955870689749,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5516,i,14365764575720520837,2548188495189639258,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5808,i,12482639383482795812,12218981475198318284,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,3043329637038295065,2358379612462274382,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5776,i,1622221481843957518,11269180148915990995,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6244,i,2481564934946619546,2223616378999137810,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6192,i,445083969419679623,15479517083176467087,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,2690463134562150876,11672738233376376849,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6236,i,337070974326901914,2853596564211702394,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,11524883615000104974,729166597441970390,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5540,i,2482432321226371590,9048886542467352643,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6124,i,6651582759757331486,13742995392480652671,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6012,i,15422326935107831932,8333261843921333834,2097152 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:9
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,16400006371111748739,2620587277333050150,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,9490479195684581702,3356180756406689294,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,9860934041613985778,3725179472996122992,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5920,i,14227895694504918709,8434174725672240009,262144 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,12176403382922465940,3267079311160974875,524288 --field-trial-handle=1908,i,5266911118907398719,116151244082789161,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1912

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1336

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3448

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\logs\debug.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5240

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\logs\keylog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5fc599d46f0f5e76621e69afe4f379bccdb985c41bbdd4dab136c2c3dc0caa40
MD5 c5fc01d4783c7d96037c41bd7b92f992
SHA1 351f7ae700c1720c1bdbd987bb085f2a24c6c7ec
SHA512 7ec3624ed09f2ee930b60cc9a4b68abb55a985ce359862e100764cf8f1ebe4977cf157c5267c3d3ae44b30a073e040a0455ee21050525a84478aed0568d07c52
TLSH
T175416AB793E48A6D891196E4EB216E2FDD7D0A14132C3C62C9D4AE4B43E2973D21038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f27f994b18fb169536c16a6682bfddd99aec084015919830d6c607a7fd3b6341
MD5 d33a6dc7577a75dad537e6f618f3eb6c
SHA1 cb5fb5ba6b4548ed2dbcb0cc4b95d2d7c5081648
SHA512 22462aedda85da988b483a0cee4fe1e35df4ffa968b891148e7575d537f381902ebaf387956ca4fe9b3562da886177036845cc5813ececa8125b567b794494e8
TLSH
T19D5168B7D7D88A6DC91156F4AB216E1ECD2E0A14532D3C66C8D8EF4B53F6872D21038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6d85d80d5a4669998fc685d70d8206c822fe8c135b08f005ab81028688af07eb
MD5 6fb40da5eb85fbc5ba44c066a24e621c
SHA1 c26c7404c92a6a0cd79e47e0c1ee3ecaac04605e
SHA512 4e0b28a03db8f4ecb4d36203b4f5366641867fa8a202b27671ef58758a93c701a85e1f924192b1343f924b62d654153926d2812732fb9aecedb12e21369426e1
SSDEEP 192:1R+xTRJv72APRp2a9tHsb+WNnGliu0HFCGkwMGVyIsnAUge:1R+xdJTXlPwGsu0HbXe
TLSH
T11832D72EBD24253F5CEBD22AF9257753D7F5102671942E84E6FC8A2C14E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c49f09d4bb892995d24518ec5646e969a238e0d90b3d3225fd5b99140a5f22f8
MD5 aa2980c98686be389ab8bd793072d1b1
SHA1 5cc9bd73cc7346c917c16e4f190a9f42c52a3656
SHA512 408fefdc705e7e7cbf1d89738abb96c13bf6e064bb50c3d4d4c8b4dd3e0b28d15f441dc9ced31aa171ee10c5b022ab455022ae7b415642e39e1379c0ace53230
SSDEEP 192:1R+xTnRqv72kPRpma9tHsb+WNnIvhfCGkwMeVyIsnAUgE:1R+xjRmfX1PwIhdNE
TLSH
T18D42E62FAD14293B5CEBD629F926BB53D3F5102671941E84E6FC8B2C05E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ec733a69aa03ff6573a82335d4a81fb917c4e9d95dc9d443aacad5ba87f69e7c
MD5 cee04778e41a678d27b724947c20ef11
SHA1 72469db9017f0ba3fb400b2b3814ca246c08d73b
SHA512 11cd7f7394796ef9cf020c2d8b8cf8426608a070abdf30b5583660c82a850efa0e4e419dd3bbf90bec3304779c52f8878c632560559cf2ea0c0e4f6e302f4cc5
SSDEEP 192:1R+xTnRYv72kPRpma9tHsb+WNnIvhfCGkwMeVyIsnAUgE:1R+xjREfX1PwIhdNE
TLSH
T1C842E62FAD14293B5CEBD629F926BB53D3F5102671941E84E6FC8B2C05E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 de3dfc3b188fc744b93d1979e882776ff44102504c9521ca26baf15338ba584f
MD5 945abb7ea6abfc3c3767f3d3e7214ff2
SHA1 fbca79fdeb05fd1904e2aa53719f434a51ae2ab3
SHA512 464f9a17058b0c45cebb0a7a4b3434788e07390b783eabec23e709f547cfdd8bb79964eb3577c11fd02e0223f68db4e6c3396af5570bf8eb6c4100fe41590f8d
SSDEEP 192:1R+xTFJv72APRp2a9tHsb+WNnCZtVCGkwMGVyIsnAUge:1R+xpJTXlPwotLXe
TLSH
T1BB32D62FAD24253F5CEBD22AF9257753D7F5102671882E84E6FC8A2C05E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 26bcaf9ae375c79e2ea52a327be18abc1a26624314bfbd12b558af01a33a0dfa
MD5 eecc9859a01c1c05fd46607ee16e2c6b
SHA1 bcc57222bb5f4dbbe22ca92c5eefde7e9f694fc1
SHA512 5a3cf77cff59e258907eb14e36183d31745b5ee6d6abf117c7ee48029b0398daeb74aab87640d5b34297cc1a40bff2ab6d3adb43ee644cb4e2664ed1be34ea79
SSDEEP 192:1R+xOnRYv72kPRpma9tHsb+WNnIvhfCGkwMeVyIsnAUgE:1R+xCREfX1PwIhdNE
TLSH
T14542E62FAD14293B5CEBD629F926BB53D3F5102671941E84E6FC8B2C05E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 22f39fd7007f009e0fba3bca3a9385497c41780facbb3f42292bf31d02752b42
MD5 3b31c26a4ccb9666679f334f9b1ce334
SHA1 ba0595a5a0ca03c11c647023d4ea98512326aa17
SHA512 bcb05fb60de690895902d89e03f16fa9ea6a9a0af8931caca4a49d071ee8bbc67d6d204f8c85fee839f1a77b24850953fc76e99a437a1e49cb23cad87084254b
SSDEEP 192:1R+xTnRxnv72APRp2a9tHsb+WNnIvhHCGkwMSVyIsnAUgE:1R+xjRxvTXlPwIhVbE
TLSH
T1A842E72FBD24253B5CEBD62AFA267753D3F5102671841E84E6FC8A2C15E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6883d77241a6a1555f85d88bf2a102ccc00e9204d91019929ad0e835e578010d
MD5 9137ee1fd899af4dcc70cb0af8723a08
SHA1 d896283df0902b41298170e312e8740e2632327d
SHA512 1a956ead7cf2164963e421e63aebe5efe260b6481b258aeae2b266f8196d1ef0a8ab54dbf5c167035e7913b30ddfe1e5869d2f707af37eb75ad37219e2020d47
SSDEEP 192:1R+xTFxnv72APRp2a9tHsb+WNnCZt1CGkwMSVyIsnAUgE:1R+xpxvTXlPwotrbE
TLSH
T13532D72FAD24253B5CEBD62AFA257753D7F1102671842E84E6FC8A2C15E79DC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 68ea1653bdf530c16d7f07a606c6d903ad42e397504f04cd038236829db89fe5
MD5 31a1fade8bc7beca83396f1cd9aa283e
SHA1 7c29774c4bb3b278903f9588291c8bb75d84327b
SHA512 be8d23ee0ebb47934b2f6cac79ef7f5b648f598f652f85462652871c9775690f0d9f957636312ee5e84e1e0c585bcb7072b984ed9b84cdc90c23289926ec97ad
SSDEEP 384:cejgb7KxkXqKf/pUZNCgVLH2HfgsloXXODgX+ErU3HnHGeW4wFP:cugb7KxkXqKf/pUZNCgVLH2Hfgs2nOUv
TLSH
T1D352F86BA84C9A3F0FD8D64DDC13AF4FADB5014B76680D2496FB5D080395BCA114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a2ebee646a734fc45f9e86b945bfe18759dc42b430afedb285659b88b28f5d81
MD5 b3f760b78f758e29468d130c8ccb2979
SHA1 a741732df32b2931bcc1b7815d6d236206bd3372
SHA512 a86f5638c14d4ee7d82c4333cbccf4af6d228c7a3ff6def3db0e2f8afda27ec3469a1202d56798fb84810ffe2ad870e77a3576ac00f75fd13f9397635d936f23
TLSH
T1E7A00214D9C42612CD145A71A9E5454127E258192563C7435EEA2585995B5C04326545
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b248c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b248c.TMP
Size 48B
SHA256 329061427af5768590c9ddbb430b80b6cabc8e3695dfb4b3ad4d7e301344a974
MD5 2e55b588fc1f8d3b42d7e509692d8f39
SHA1 be04890194b316ea5b5b4f117596959898034462
SHA512 1a583b5a11ee76862025113615da4a4424b4e8d1482a46e633553bd1e1857dc9c0056cb72fac0af02fb2f40f96cd38e7ec275be9887e9e606f21920f50c231f1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 53e99568207d45d8b22027364fc558353b4b2a4660ccfe43f13f12871f79b125
MD5 4bb7e6951240b6909fe38136bed7fcc6
SHA1 a2bb59ac90591b5eade08cc7e6d2c9ade84ea732
SHA512 606e3153d943c96302dc2ab7b67bb36c2e3be3e8a8f8cd735f424b004e367b9876e2ab735958473837bad603e73e540d5324ee90853d22cf7d138791d27954c5
SSDEEP 3072:hXiuUiNW+6j6mNmV6K+jowHv0l5NIWp79RMcrWj8Ya7zB5p0:x96jMVQ7Hv0TNIW/uWHPS
TLSH
T117C312D98CBCAE2312A4EB85399F3713DEB55FFF620A86D881DC1F44005B5245A57A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 d2cfe0af4254b4ba676300b45a17fe9a340edce8a60d39401f33d792fe0fbd97
MD5 501de2984eea20ceeded635dc19348a0
SHA1 1f684abf92658dbd3c4761c3ac1619e1d0400242
SHA512 8f9be37a84e9ddf2eaf0e44eebddd5f83688f39794182bb69cc0ab1455bfed5b55588e65ce80542ac1728db19a521cbd3e49f6aba5c2123b23036f35a26a4a06
SSDEEP 3072:SEiuUiNW+6j6mNmV6K+jowHv0l5NIWp79RMcrWj8Ya7zB5p0:Su96jMVQ7Hv0TNIW/uWHPS
TLSH
T13CC312FE8C7D6E2312B4EB88258B3713CDF49FBF960A95D8A19C2E44004B4245E5B933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c4b28eb8961594f83115e5de0b36c62f5fccaafd73ebcc2222d0694dd6351dc1
MD5 5c230583cc61ee1c913600f526eaccd8
SHA1 2bc9bb08c17560052582a1917596e663c29eaf3e
SHA512 f0aaf60264a7f232e42200d75e954036981332f75ad33d827c6f76c5eaea5dfdabef18aac7f995cc95d5f56ad948ea8f464342e21d6c08cf4138f3ae5598f1ee
SSDEEP 96:v2C0d++kFdxZnbnfcaXAKlRDotok5W+XDlB6GdGyvJFduqsUbEDrUv4a:v2C05kFPRnDUDxbNwQuqtbCC
TLSH
T1B9A10676B96D8D3749BAD985B0562B03CFB961ABF6219E40C9DD0F0951A74EC0742233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 46e788b4fea2bdd456b03dca2145963cc4fdf3fd7aa69de573eff486b882634f
MD5 cc1ef57ffa46ec74f1e0536dfbb0ca9f
SHA1 63133a2d8370463a919e3e9eec11bd942ef58209
SHA512 0fdefa5df138972703da697685cc110a1b2187d9cf9f3cefddf0546f9c8893e6acc4a650ad221715db97402cf47bb804c366613a84f352664c3cf14b6dff1c06
SSDEEP 3072:eXiuUiNW+6j6mNmV6K+jowHv0l5NIWp79RMcrWj8Ya7zB5p0:E96jMVQ7Hv0TNIW/uWHPS
TLSH
T115C312DA8CBCAE2312A4EB85399F3713DEB55FFF620A86D881DC1F44005B5245A57A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 036210b33085f4385f932964ae1570830aecc8271578a232dc7f0b81634493da
MD5 aebded4e5a01956b37e725a05b968161
SHA1 71d0b9d66df821629c6881319b3fb4329e5221f1
SHA512 d321ba34589971cb87d9a912e86b41342abede5f5abb1e4da6b3e3a25ed14fb9aaace4eec35cdb48a92772bba3ff62790de4955d23554048397c5ac799440ffe
SSDEEP 3072:+EiuUiNW+6j6mNmV6K+jowHv0l5NIWp79RMcrWj8Ya7zB5p0:+u96jMVQ7Hv0TNIW/uWHPS
TLSH
T125C312FE8C7D6E2316B4EB88258B3713CDF59FBF920A95D8A19C2E44004B4645E5B933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir716_1082104557\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Users\Public\logs\debug.txt
Size 732B
SHA256 6ad0f7a9aed91d4d50af42f58646ac69972ed4e604a7fc6ba7f40bce495d6ee5
MD5 2f6a01630af9aa1ce227ef3354398f47
SHA1 dcd9e2fbeddd1bbd921b70a51b712dab1246530e
SHA512 a53c6096c4f2dd01f1b810c38f22af4492b4ef1d4750c063a6a85913957214b7dabd080dc8746de7f331dace9184e683a5affa43aa4629584b7b883ff8ac9915
TLSH
T15E0129074AEFC03E1E2622DBDA98819205982E1B1F00B7923183695CD833DEA827F5B4
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Public\logs\keylog.txt
Size 109B
SHA256 962d257eea243ef2ea793e977f0d3b46307bd29badfa016b915352a90282b55b
MD5 8f801371eec5bc74848243adedf6ccd1
SHA1 46fbc048d5aa600952b8ec8014a951934be9de59
SHA512 2844a9cb0dd785713a7758e9f08441e047ceb260d49aa8875869f939281c587c56b1b02a4285f6bd3629f5898b87b5a1086bc7afd5b3be4e4ece162b9c2b2712
TLSH
T151B0921808FC350310298708A9851FD602043005870F0D80E3811298FB9084B4BCA684
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Public\logs\keylog.txt
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/1312-1-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-4-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-692-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-5-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-21-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-641-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-22-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-679-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-604-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-6-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-164-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-20-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-703-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-704-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-729-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-3-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-2-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download

memory/3196-766-0x00007FF780DD0000-0x00007FF780E12000-memory.dmp

Download