f568f696d20ab57e8703a8b8a2d191dffa58720c479ee512270b3d21753c3cc8

Resubmissions

01/07/2026, 00:12

260701-ahke8aax7l1

28/06/2026, 20:15

28/06/2026, 19:58

28/06/2026, 19:45

28/06/2026, 19:31

28/06/2026, 19:13

28/06/2026, 19:09

28/06/2026, 19:01

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kairu.rar
Size 335KB
Sample260628-ygrd5sdw2l
SHA256 f568f696d20ab57e8703a8b8a2d191dffa58720c479ee512270b3d21753c3cc8
MD5 9c6971448c2abd0784281a9de0929d11
SHA1 aa415b48aa214a76175e48bc46827b8f221e1fe6
SHA512 a030e414753fea5561e479a5ec22a7a58af793f7ca31828a8dcf12784666e127a6335a6c097f1799c12a36099c1c06e18a00708350160fe9c6f8f256cbd0d0a2
SSDEEP 6144:9twn2UIdGixiGtTeC4bLGSgb7NllTWMC+LGDrscVArcQq3l72dbQTW93S:9e2mGtTe6z9z7CrArxq3l7qQT/
TLSH
T1FF7423C82F877CD55A7F2CD6D723CBA01438AE5F6A08F42EFDB7B101AB058A48059975
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
26	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1388	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271496396475093"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{60CE45DD-7D98-44F6-9162-F94E96178F92}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4436	7zFM.exe
Token: 35	4436	7zFM.exe
Token: SeSecurityPrivilege	4436	7zFM.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe
Token: SeCreatePagefilePrivilege	5856	chrome.exe
Token: SeShutdownPrivilege	5856	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4436	7zFM.exe
4436	7zFM.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5268	5856	chrome.exe	92
PID 5856 wrote to memory of 1388	5856	chrome.exe	93
PID 5856 wrote to memory of 3144	5856	chrome.exe	94
PID 5856 wrote to memory of 3144	5856	chrome.exe	94
PID 5856 wrote to memory of 4232	5856	chrome.exe	96
PID 5856 wrote to memory of 4232	5856	chrome.exe	96
PID 5856 wrote to memory of 6096	5856	chrome.exe	97
PID 5856 wrote to memory of 2632	5856	chrome.exe	98
PID 5856 wrote to memory of 6096	5856	chrome.exe	97
PID 5856 wrote to memory of 2632	5856	chrome.exe	98
PID 5856 wrote to memory of 5840	5856	chrome.exe	99
PID 5856 wrote to memory of 5840	5856	chrome.exe	99
PID 5856 wrote to memory of 692	5856	chrome.exe	100
PID 5856 wrote to memory of 692	5856	chrome.exe	100
PID 5856 wrote to memory of 6036	5856	chrome.exe	101
PID 5856 wrote to memory of 6036	5856	chrome.exe	101
PID 5856 wrote to memory of 2488	5856	chrome.exe	102
PID 5856 wrote to memory of 2488	5856	chrome.exe	102
PID 5856 wrote to memory of 3668	5856	chrome.exe	104
PID 5856 wrote to memory of 3668	5856	chrome.exe	104
PID 5856 wrote to memory of 1184	5856	chrome.exe	105
PID 5856 wrote to memory of 1184	5856	chrome.exe	105
PID 5856 wrote to memory of 5600	5856	chrome.exe	106
PID 5856 wrote to memory of 1516	5856	chrome.exe	108
PID 5856 wrote to memory of 1516	5856	chrome.exe	108
PID 5856 wrote to memory of 4580	5856	chrome.exe	109
PID 5856 wrote to memory of 4580	5856	chrome.exe	109
PID 5856 wrote to memory of 5508	5856	chrome.exe	110
PID 5856 wrote to memory of 5508	5856	chrome.exe	110
PID 5856 wrote to memory of 5872	5856	chrome.exe	111
PID 5856 wrote to memory of 5872	5856	chrome.exe	111
PID 5856 wrote to memory of 5676	5856	chrome.exe	112
PID 5856 wrote to memory of 5676	5856	chrome.exe	112
PID 5856 wrote to memory of 612	5856	chrome.exe	115
PID 5856 wrote to memory of 612	5856	chrome.exe	115
PID 5856 wrote to memory of 4436	5856	chrome.exe	116
PID 5856 wrote to memory of 4436	5856	chrome.exe	116
PID 5856 wrote to memory of 4836	5856	chrome.exe	117
PID 5856 wrote to memory of 4836	5856	chrome.exe	117
PID 5856 wrote to memory of 3464	5856	chrome.exe	118
PID 5856 wrote to memory of 2968	5856	chrome.exe	119
PID 5856 wrote to memory of 3880	5856	chrome.exe	120
PID 5856 wrote to memory of 3464	5856	chrome.exe	118
PID 5856 wrote to memory of 3880	5856	chrome.exe	120
PID 5856 wrote to memory of 420	5856	chrome.exe	121
PID 5856 wrote to memory of 420	5856	chrome.exe	121
PID 5856 wrote to memory of 5352	5856	chrome.exe	122
PID 5856 wrote to memory of 5352	5856	chrome.exe	122
PID 5856 wrote to memory of 2092	5856	chrome.exe	123
PID 5856 wrote to memory of 1420	5856	chrome.exe	124
PID 5856 wrote to memory of 2092	5856	chrome.exe	123
PID 5856 wrote to memory of 1420	5856	chrome.exe	124
PID 5856 wrote to memory of 5212	5856	chrome.exe	125
PID 5856 wrote to memory of 5088	5856	chrome.exe	126
PID 5856 wrote to memory of 4288	5856	chrome.exe	127

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\kairu.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa2afcc728,0x7ffa2afcc734,0x7ffa2afcc740
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,7434881294479293144,1967752352993468635,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7544052598488722326,9283374872799129160,262144 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,13006218320065783008,4648741628589650335,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,14428465209220923403,15368958319739779626,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,16386883766170766898,15017161302432043729,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4596,i,3008660660614186724,15289060704999241107,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,9837629457757038818,6511144928225183643,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,12499237868735120845,1416509760234432487,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,9768060522053988577,1680532470875673482,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5064,i,12261149502849333858,7531727090658197292,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4600,i,3316677693845047789,16511506691650125635,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,7242022438684290977,5115411953704007559,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,11188084660720891464,8475858673960230174,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:12
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5920,i,4621856716784983016,3457639828099707777,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5968,i,2191769465389184447,11436650200632087475,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6224,i,10541131146305412778,13792665188912808571,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,10192314439019514741,14709054480561137937,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6412,i,14333955662747620872,13269029325094176221,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5984,i,4083590084184563461,13067795621376994066,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6648,i,6644734061835746343,2120570404506247716,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5968,i,1731800062832114747,7884361844003361652,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,10626260462266701711,11921982719816545878,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,3810331108412571800,8917130934890311402,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3264,i,5602022387332750532,2679569441560917804,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,8404844163592400295,7564163119969663603,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3680,i,5589366649924020506,4698177257441738411,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3484,i,4835054749943567538,125365951240789927,2097152 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:9
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,9270780011384709581,14489198667154608885,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,7597993615407337708,11900499135854534692,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3576,i,9894936908547117525,1035834333512868679,524288 --field-trial-handle=2028,i,10217114839896786222,2531628486002810654,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:4288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 02fd8ab1ecd85ddc003fb5f146a99d4cc427a3d7b74b6c80c472e17997c1b8a9
MD5 2f3e3dd0f5926f071ffead09f0cd61c9
SHA1 386205a459971bb35d38af48d5be0f7c270a3600
SHA512 16b21976867c1842cdb0a8e5bb428d5e3014e765c5d5e36c5d1f17f215d3ddc42f0887bc1e0d563b31a5c8a4eb12cac272416b25f0ab1f8cd8a86d339c1aebec
SSDEEP 96:8PrMQwLXmOx8vDppiNDKwfp0IV3lCbdGpMBEVOb9MSkMsgGZiuFysx0wiFsH06jg:WrMQwLX3x8vDppiNDKwfp0IV3lCbdG+V
TLSH
T1AD91F8E32AD92588CB4A49372FE4EF3CB3335247AE271DC6BD224872716438D152D186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 09701991c23c7a213f8973c7526e4dfa4de72d81aae1ae50307d53764c5ce851
MD5 aaf2de87117736838d88ccfaafd924bb
SHA1 572c0c53639d202fce385106d80ddcb1b59fcc48
SHA512 d3a8ae96f0ce86e0638ea54e95e22d167d465d1a986774dc4947395ed32af4f712e8d63218919f78f75ca3e6fe15fd51d4a76ad38d7615cdd2d2e59b1a9fcf7e
SSDEEP 96:DALLuduBXCr0mJx1pouNueyuI1uejueuulu+uGK:DALLW0XCr0mJH2Sry1rjru8d9K
TLSH
T118A19DB7C7E88A6DC91162F4AB153E1FCE2D0D2443183D2AC8D5AF4F53E6572E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 577003279fc1e29fdfee0722ed6c96f6327030eeabc68a362646d728c87338bd
MD5 a1c9f54b0615ffc39f50c5dee24b657a
SHA1 fb17840a62f6bc5880bcfea98ce87b43c765c37a
SHA512 c7832a5bc868c925850a17ecff8bd33cda77951515886179506a63dcad79fda624120f74e7c1649575d521f51ac6b8141906adf089104e526d15bd7c39661c96
TLSH
T109417BF7C3E8897D990156F8AB152F1BCE2D0E64532C3C56C9D4AE4F53E1972D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d76bd11b11c47550f84fc1576f3bcdb65f37919e49797460501df3838e9895fb
MD5 a93d4107645849cac880d3a4a26fb24d
SHA1 1947060d9b002b81602dc456d4d21988b6740830
SHA512 08c8e8f40e48f27ab825aafe7ae3b9fd5bd6284aa2605c019496b2b48cfd3d32125bc336014b036bacf88b28869c37b6b651451f1d5d61defef0be6f22ff8687
SSDEEP 192:+RMCHZcrv7TAPRp2D89UHsb+WNnjnOVMI23C2gecqgv+VyIsnAUgE:+RMCHGTaXPKwbK2y2uv2E
TLSH
T12F42A62AAD10753BACDBD219F965BB53E3F6102232D42E84E6FC8A2C15D79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0b646e4960ce973804a6019720aebf3621278c819cf773265ccd7bcfc93d52d0
MD5 69a40be95763c9b93a0b25a97489992e
SHA1 706cc9ee3fc2855eb4fa3bf4675b9373f13a043f
SHA512 408448e411cce6c7a5329d06e85d88bd26c79e3ce0adfc05739f24991c5893da62ec6eaea30f6a10e36213c84e652ba0eb61a46ec463b4984b9f4b1849fc1c86
SSDEEP 192:+RMCHZcAv71APRp2D89UHsb+WNnjnOVMI2BC2gecq1v+VyIsnAUgR:+RMCHGcEXPKwbK242Lv2R
TLSH
T13432962AAD10753BACDBD21AF975B753E3F6102232D42E84E6FC8A2C19D79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8ef6f84b9fbcc466b23af67ca69d375f8d69934551f6acab2425a455c2d1149c
MD5 bddabbf862b75d60a71dfe3f8c26fa1a
SHA1 460fcbd2e6548af4d38d59cebdf83f0e9dccf9a2
SHA512 643ce7fb1405b4a598b3e0d1814fd17447522f65988ddd42b3518b42166b94f8ca80032f5ab66ec6f0b52b18beff4472c7b6cdedd4879c20aa937d4dd0cd855a
SSDEEP 192:+RMCHZcrv7T2PRp6D89UHsb+WNnjnOVMI2FC2gecqsv+VyIsnAUgE:+RMCHGTgXLKwbK2s2qv2E
TLSH
T1E642A72AAD10753BACDBD619F965BB53E3F6102232942E84E6FC8A2C19D79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0f7e51736b187db6ebc755b52b45586aff9250f91882a6d8fc52c6fbbc7e4c6f
MD5 4e967107f7327a1c605f289c5f509fb2
SHA1 344ad648ccbbf8621f9738324a1e8c7d76c659a3
SHA512 ad84c4ce20d8814006d104794a8ca8d0b25273699b71813c37616a567c9343859cd639838298baac6337d83c7a236a3ef6f19350924c8f631eda871ce6e445e6
SSDEEP 192:+RMCHZcYv7TAPRp2D89UHsb+WNnjnOVMI2BC2gecq1v+VyIsnAUge:+RMCHGEaXPKwbK242Lv2e
TLSH
T15642962EAD10753BACDBC21AF965B753E3F6102132D42E84E6FC8A2C19D79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 f6311b53fe18157dbb2000c72acbfb5defbc391325ee0f8e21a78021d14d30ab
MD5 e5b070cf5411b795a4f5d834e53cd111
SHA1 33668266d7695357d1264c1c8b9bdc2740e33d0e
SHA512 981c6f4a1e6e86e4c18d6533e1a5a20724b97692b95ffa29b43f90850c9c314d0962352b0b762d50d9e4dbfee08e172db07b9fbf40cf99ec2c13f73c49d1c100
SSDEEP 192:e2N4K6CM7KxkXqK4I40pUZNCgVLHrKHfFKslEO+kXzKD/RU+ErUkKN9uyGl9VvOl:/NjpM7KxkXqKf/pUZNCgVLH2HfgslOkQ
TLSH
T17332F727A84D9A7F4FD8E508CC52AB8B6DF5414773780C2496FB9D0803997CA114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 11c89ac8b28011d7b099835c1ef5205b0d9b992a4e152711f38143edbddebf55
MD5 045a555c0163f7be848ab2151368f6f1
SHA1 9ed865305f62e544af8a1633385b8c625499816d
SHA512 f6abf0f9ec3c0644680557674733625d8b94a01b85a16f5cfe86fe027cd09f47142d751f31e46242f9075f7c202eb6433728abc19cd05ecb1d5aa930bd6bcd09
TLSH
T1DFD0A75BB48811D1DAEF4B912756255E4325388910E9C4987012001A54B46D3A213FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 e180f68e696a76c190dba8a32e9096585b8410fad5f5e4a657be4ee1fdc88eb5
MD5 7d42cd563a36f1c04af2749c98eab87d
SHA1 04672cbaa885bd8d8202fb15cff37b0530b0c782
SHA512 546b4d59f487a139bf093127d23c2e18a10c28dd40ab6eafc3009ed2df1711ea397a4273ce896fb80175203aada5b88ecc5b08e7480bc647d4fcff3ef2f6857d
TLSH
T1ABD0A75BF49111D1DBAF07926766259E42753C8914D6C488B012201E14B46C3A216FB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a5e3e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a5e3e.TMP
Size 138B
SHA256 9418f162af8a1f6d4097d07c4ab117058c7b17a194f0fb7c7e45a8df7bdcabfb
MD5 430206b261565ac79113af9903299d3b
SHA1 636a8f5194c5b9bf3fbe3fa8632cc163c44d9bcf
SHA512 e46480384382c70cbe45c0be78aa00ae4b2b25e7263cec0844cea3eca9d5b98c67018db21f53cf956501a98e5662d61e5607f033fc1c1c6079352052927617b8
TLSH
T171C08C63A4400092CB1107A002262909470A2C8918C6C8C8A02330152034A937101FA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a639e044f3c425d8981c70fc4d528d97ed261bfd8d6bf00ad281cacf01f7b536
MD5 ebd41394303e8eb21cbf7a4bd2d9ad6c
SHA1 995602ffddff11e454f767b239cf3fada2e23f5d
SHA512 d33d6bc4d3a3391cd7ec5f8c2eecbf04e2f44bb15da3c6b45d86d02c53161d3208c4f3db3b37ade2067ca169443a022855ad6352354ce3ea46c8974cecb8636f
TLSH
T178A0021145D00561CEA94F7060E1164573555914D5565343749208D4DDDB1DD6181744
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5abf4a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5abf4a.TMP
Size 48B
SHA256 8250002f95d64228cb201cc72729214f4ad355e5403395b2eeeec9d0d4fd1c1f
MD5 3d9e85085f57db0fb6de59a824aa7238
SHA1 740d3feb24b1cfe23b930d29553b50ea7b928557
SHA512 706ad30b24f31b3aef13d17dee453289d72beffa5fbe74414bbe294601531b36f0c21ed4efcd60ba5a83d67974aa8c930f314cda2975ad987d874f680e21a0f4
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f45884501f9ca318ca0838c0e2ebfeb4728af7af3dea488bcada6877fcffed31
MD5 aeedffc19f2d500a1c32f28180e1e98f
SHA1 d61abe9590ed9b88d0819c155a2b5cbc31e2bf7f
SHA512 60157b90ff39f8daaf9f650bbbbd528698bc6ca228f260365a5177b14082fc91d128a2c86ebc159a3a0a9b60ab951a6448dd3754b9c03ba7b4c3191b6dd71e01
SSDEEP 96:dC0d+0JdBXgpHy6xfYBxdM51RDotok51SDRjB6vGyvGdidgbsYv4a:dC0LJdBXgNy6YGDUDO/T7idgbsC
TLSH
T1D6A11871696C8A7B98B6D84578523B13CFB4615BE622AF94D5DC0F0C11E70F91741623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 81e1aceaad504c53d823ba0cc37f63c850d780cebe01e2e09c17a961ccc0de4d
MD5 d37c35285df19a8db88a83a01c6d69f5
SHA1 f208eed3ce37392a749fb62e817089b6fb18edd8
SHA512 9ea035da9b61de675d1dfc67b879c2a73ea073cc1f74ad0017ed9a360851dc68227cbc74786aa3f85dacc2cc0992cdaf4d619b3c55cd24b2bf32ad61b8eb140f
SSDEEP 3072:ipwkStHN2rDhN2aSxqlWYRdrwGa7E/C8uXkxiGiKY1sK6h0/C:ipHSttY13Xb5zuXltKY1sK6hz
TLSH
T193C3127277169D5744FCA9C83003BE2B5D787923BC2597B8D14EAF0229AC5CEA3138B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 44e0fd9d7e303557d5fc5d108fcc5c98c53a16c8d7d945d45e68b1d5971ad87b
MD5 6aa6ac0bdc76cc43761f5048989d9625
SHA1 b9ff6d875a6e3649595f9d321b09785385c000eb
SHA512 2c57963393016ca05873384d934beb19d67c38d38e68b00bb341d2204ae326ca327ca3aaabc19f382a6a2b9d25797401e10e7bcbe1757f914539a107449cbf0d
SSDEEP 3072:bkStHN2rDhN2aSxqlWYRdrwGa7E/C8uXkxiGiKY1sK6h0/C:4SttY13Xb5zuXltKY1sK6hz
TLSH
T167C312527716AD6741FCA9DC3003BD6B5D787D13AC2292B8C14EDF4329EC68E63128B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 a455547bf514cce6dba9f5a064a4ff1692d2095e83f518e45fb19cbf7ee9392f
MD5 7b6c02ecf5d3610abb0ae163375b7e1a
SHA1 a1a72dba232071a496aff594fc9f563327b020c3
SHA512 eacf73794c6d076f533a5d7c12592383096acf256ead14f7731dea4f0613493c0413a698a26cf7ff5032b8309917bfab1457092675aa027783622db2f75c98a9
SSDEEP 3072:akStHN2rDhN2aSxqlWYRdrwGa7E/C8uXkxiGiKY1sK6h0/C:ZSttY13Xb5zuXltKY1sK6hz
TLSH
T1AFC312527716AD6741FCA9DC3003BD6B5D787D13AC2292B8C14EDF4329EC68E63128B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

triggerbot.ahk

Path C:\Users\Admin\AppData\Local\Temp\7zE45102889\kairu\kairu\kairu\kairu\AHK\Bad buissness (good)\triggerbot\triggerbot.ahk
Size 1KB
SHA256 288f4d2aea71ed677b473a6d15e11ab869fb2db8d888b002bd535efee0473b15
MD5 dba8e296c5fbb833b56d5f4d495c4b9c
SHA1 75cc7be3c90819fc1c2249447d40062ff3a8b97e
SHA512 dbf2fbaff6d4cb9714a30c1496f87aa080067258028fff0e6f03d6ad1ba5351886d62d94383c656d5e487d8a4fe18ca1cb4dda0b4c71fcaa7c3ba0e087b52492
TLSH
T1F34103F796173D97417BAA6FD9134227F72EC3AF11273022B9DC99681F2071942C1D4A
MD5 SHA1 SHA512 TLSH

Submit Download

camlock.ahk

Path C:\Users\Admin\AppData\Local\Temp\7zE45102889\kairu\kairu\kairu\kairu\AHK\Combat surf (great)\camlock\camlock.ahk
Size 4KB
SHA256 3bbf1341f19317a53ae065174c0f153edff2f31feaffe487ba5327b486f8cc33
MD5 2ad4479d897f693643416451d758702b
SHA1 cbb33d5835016d768f11b99f2c69506af385517c
SHA512 aeb79507008be2663769ed55bdfca9f39741146ddeb2824c9e676f78d1c436affa1fc6cd4c3d90505c842cb8e417eca358fec8787b84ea4ad2b956a29b110715
SSDEEP 96:QxvDs8UIBStPuT2l6csxwPI986wVpysHlYI1yKkYas+mx2eqs:8fSt2Tu6csePI96VwsHlYXS+mx2eqs
TLSH
T17E9175F765D73A9F91BADA1FE802410BF60E81420A3760A875ECECF41F5D4A501E4EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7zE45102889\kairu\kairu\kairu\kairu\AHK\Hyper shot (great)\triggerbot\config.ini
Size 109B
SHA256 33d01edf3c763da6730dde980012481deaf23ba400906bcd712d713187bbc91d
MD5 9934795bb3321b44990cbe9817bd2e3f
SHA1 a16a3d357010433a9f5fec3bd6273e1ebc223d01
SHA512 d31fa5ba09204c5903ef09351e9fe64cdf300d48f1589946d2fd0c84078a2c62ad279596e70f157bc486900e650ccc0def71e56f12bde360ac7129b935177e05
TLSH
T1BDB01257D3E06CCB90FF090AD914730811D025E823D647047A92C1464F56C10103076C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5856_1810758810\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download