1add7960022dcea6d9a1562823a35829b33e9a3586c0f6b2407b9e4e7bd3e9ed

Analysis

user interaction
yes
max time kernel
73s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bitware.exe
Size 8.4MB
Sample260703-rmyl3say21
SHA256 1add7960022dcea6d9a1562823a35829b33e9a3586c0f6b2407b9e4e7bd3e9ed
MD5 8b88a171dc36b281103e148952234e5c
SHA1 b307406428532d01c3bad313d7d89e5168ede85b
SHA512 4b858a6df21747c18b0a397b746c1cc728b9777d7a070d8207e0ab158a3a6da75126d52be7b4d1c90f36778b264eea58402540561e71ea4196e8acdbba4e478c
SSDEEP 98304:9Op09KXTqUKUWc6ndSKCm7Gygu1ODhMzScViMfl:900UXTvKUW/RCjygu1o8Tl
TLSH
T103969C759A9D4F1DF072B079C187A223A7F1BC0D2361DF8BA9C49C77481F098BAA560D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4280	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
94	5404	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	Bitware.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bitware = "C:\\Users\\Admin\\AppData\\Local\\Bitware\\Bitware.exe"	Bitware.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5404	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275620078087301"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	powershell.exe
4280	powershell.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
3468	Bitware.exe
3468	Bitware.exe
4716	Bitware.exe
4716	Bitware.exe
3468	Bitware.exe
3468	Bitware.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeIncreaseQuotaPrivilege	4280	powershell.exe
Token: SeSecurityPrivilege	4280	powershell.exe
Token: SeTakeOwnershipPrivilege	4280	powershell.exe
Token: SeLoadDriverPrivilege	4280	powershell.exe
Token: SeSystemProfilePrivilege	4280	powershell.exe
Token: SeSystemtimePrivilege	4280	powershell.exe
Token: SeProfSingleProcessPrivilege	4280	powershell.exe
Token: SeIncBasePriorityPrivilege	4280	powershell.exe
Token: SeCreatePagefilePrivilege	4280	powershell.exe
Token: SeBackupPrivilege	4280	powershell.exe
Token: SeRestorePrivilege	4280	powershell.exe
Token: SeShutdownPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeSystemEnvironmentPrivilege	4280	powershell.exe
Token: SeRemoteShutdownPrivilege	4280	powershell.exe
Token: SeUndockPrivilege	4280	powershell.exe
Token: SeManageVolumePrivilege	4280	powershell.exe
Token: 33	4280	powershell.exe
Token: 34	4280	powershell.exe
Token: 35	4280	powershell.exe
Token: 36	4280	powershell.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe
Token: SeShutdownPrivilege	5196	chrome.exe
Token: SeCreatePagefilePrivilege	5196	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe
5196	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4280	4716	Bitware.exe	92
PID 5196 wrote to memory of 684	5196	chrome.exe	98
PID 5196 wrote to memory of 5404	5196	chrome.exe	99
PID 5196 wrote to memory of 1196	5196	chrome.exe	100
PID 5196 wrote to memory of 1196	5196	chrome.exe	100
PID 5196 wrote to memory of 6004	5196	chrome.exe	102
PID 5196 wrote to memory of 6004	5196	chrome.exe	102
PID 5196 wrote to memory of 5640	5196	chrome.exe	103
PID 5196 wrote to memory of 6128	5196	chrome.exe	104
PID 5196 wrote to memory of 5640	5196	chrome.exe	103
PID 5196 wrote to memory of 6128	5196	chrome.exe	104
PID 5196 wrote to memory of 520	5196	chrome.exe	105
PID 5196 wrote to memory of 520	5196	chrome.exe	105
PID 5196 wrote to memory of 5936	5196	chrome.exe	106
PID 5196 wrote to memory of 5936	5196	chrome.exe	106
PID 5196 wrote to memory of 5888	5196	chrome.exe	107
PID 5196 wrote to memory of 5888	5196	chrome.exe	107
PID 5196 wrote to memory of 1244	5196	chrome.exe	108
PID 5196 wrote to memory of 1244	5196	chrome.exe	108
PID 5196 wrote to memory of 5924	5196	chrome.exe	109
PID 5196 wrote to memory of 2000	5196	chrome.exe	110
PID 5196 wrote to memory of 2000	5196	chrome.exe	110
PID 5196 wrote to memory of 4720	5196	chrome.exe	111
PID 5196 wrote to memory of 4720	5196	chrome.exe	111
PID 5196 wrote to memory of 3320	5196	chrome.exe	112
PID 5196 wrote to memory of 3320	5196	chrome.exe	112
PID 5196 wrote to memory of 4276	5196	chrome.exe	116
PID 5196 wrote to memory of 4276	5196	chrome.exe	116
PID 5196 wrote to memory of 3880	5196	chrome.exe	117
PID 5196 wrote to memory of 3880	5196	chrome.exe	117
PID 5196 wrote to memory of 6036	5196	chrome.exe	118
PID 5196 wrote to memory of 6036	5196	chrome.exe	118
PID 5196 wrote to memory of 5992	5196	chrome.exe	119
PID 5196 wrote to memory of 5992	5196	chrome.exe	119
PID 5196 wrote to memory of 5000	5196	chrome.exe	120
PID 5196 wrote to memory of 5000	5196	chrome.exe	120
PID 5196 wrote to memory of 4312	5196	chrome.exe	122
PID 5196 wrote to memory of 1564	5196	chrome.exe	121
PID 5196 wrote to memory of 4312	5196	chrome.exe	122
PID 5196 wrote to memory of 1564	5196	chrome.exe	121
PID 5196 wrote to memory of 2700	5196	chrome.exe	123
PID 5196 wrote to memory of 2700	5196	chrome.exe	123
PID 5196 wrote to memory of 5496	5196	chrome.exe	125
PID 5196 wrote to memory of 3284	5196	chrome.exe	124
PID 5196 wrote to memory of 5496	5196	chrome.exe	125
PID 5196 wrote to memory of 3284	5196	chrome.exe	124
PID 5196 wrote to memory of 5532	5196	chrome.exe	126
PID 5196 wrote to memory of 5532	5196	chrome.exe	126
PID 5196 wrote to memory of 624	5196	chrome.exe	127
PID 5196 wrote to memory of 624	5196	chrome.exe	127
PID 5196 wrote to memory of 2516	5196	chrome.exe	128
PID 5196 wrote to memory of 2516	5196	chrome.exe	128
PID 5196 wrote to memory of 2364	5196	chrome.exe	129
PID 5196 wrote to memory of 2364	5196	chrome.exe	129
PID 5196 wrote to memory of 6096	5196	chrome.exe	130
PID 5196 wrote to memory of 6096	5196	chrome.exe	130
PID 5196 wrote to memory of 5924	5196	chrome.exe	131
PID 5196 wrote to memory of 3208	5196	chrome.exe	132
PID 5196 wrote to memory of 2456	5196	chrome.exe	133
PID 5196 wrote to memory of 1708	5196	chrome.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Bitware.exe
"C:\Users\Admin\AppData\Local\Temp\Bitware.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3468

C:\Users\Admin\AppData\Local\Bitware\Bitware.exe
C:\Users\Admin\AppData\Local\Bitware\Bitware.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Bitware"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd71a6c728,0x7ffd71a6c734,0x7ffd71a6c740
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,1897929284489966086,10442723006761928919,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,14248482003502644588,4669900397546430690,262144 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,15643647529985077328,13390727192325580233,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,17412247812856836998,2817362760641215234,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,9068680779841711506,6143921034968872457,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,14272756733841657082,7567574001482207981,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,7276819263363223590,14982592070070274653,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,1538834000845036530,9477377404694459025,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,2451424955277584096,17856274784596558892,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,12178814229488073369,9406136960796154391,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5616,i,17342072747063552413,11497307601300624344,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5628,i,8358144814004775660,11394988336770210895,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,10012638118188538297,17202198412663242569,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6000,i,14090652267479558776,10918883242326667899,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6216,i,10992868208072211029,14905495724941606488,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,3765323996438524164,2621931415699612042,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5216,i,5533970165323347518,4063066263898036136,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3288,i,12610316795361637735,1030654115169516428,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,8432914976303480811,12269745710679951322,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6536,i,6978606892064976766,2744036036562292175,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6508,i,384063420550723796,2186460634394142697,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5900,i,1646173098276138639,14027332219742512790,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,5404674032782733222,13976572893054206615,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5728,i,9303009961169915754,13037879514115312675,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6412,i,6755523193877521936,9650404955217969155,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:9
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5988,i,5060678483501117438,6495669821711131327,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6212,i,18334630679764286059,5603873566891778546,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6544,i,12023552840446343296,5510896273489653071,2097152 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,10937377943916567401,6848509087231196977,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,9804109179553369844,12481636656578178199,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3532,i,2722655293898630532,1079362546717392383,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,10854315088077943866,7357683275218623735,524288 --field-trial-handle=2000,i,3153361013100486906,7797867874995164145,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:1708
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  PID:2044
- - C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2044
    3⤵
    PID:984
- - C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2044
    3⤵
    PID:6092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5604

C:\Users\Admin\AppData\Local\Bitware\Bitware.exe
"C:\Users\Admin\AppData\Local\Bitware\Bitware.exe"
1⤵
PID:1520

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:2596

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 4fb6633176abb8d1be846cc49d65bf4a4a358af81b750bd2bca87604fdc98dd7
MD5 9336ac4d9169c399e889c1278c9fe0b0
SHA1 adca43997bf4725b6bca68f6f1cc157b038e34cc
SHA512 e1d5c466a1a6a7fa60860f72e42866e8bde5744195ed234906a876256360c23368eb46c746e527262e96eb225f7fee4b74e76cb1b7be531a0d98f88674fed3c8
SSDEEP 196608:POAyr3imdRaPKzLCl1IP0CmsxakQdtNuqmpEfBMJ:POHrWKKCmsxbQdjuqmpEK
TLSH
T1F3A6AE22B901C032E8D200B296BD5FFA993D5E341B3954D3A7C45DB95A705E33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.dll
Size 21.1MB
SHA256 735aa9c8dde82f0d8aefd1aced464df2e0ca44b9b3bd23b15737f670d53bbbb7
MD5 8fe70396076af509d116005bf87d453e
SHA1 f8a400bde73531548434021f02a5c20610981a48
SHA512 a743ea85b1c40236e050cd164296dbe4dd1cabebfad32c6602c0f614bd0487705755d088f063ec2e1ad239b4044147524651e9709fc52a5a947d186df5496d1d
SSDEEP 196608:9zkzU1hTZdlkxex+Xtpi/KZFdCjI+IQTLc8VvK3HWPsZLs:9zkelyiUyKcVLDVi32P5
TLSH
T18C27BF4EB8E206E4C2725070D17F46E3DAA2704C19AC6AB746E5412036337DE665BFBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bitware.exe

Path C:\Users\Admin\AppData\Local\Bitware\Bitware.exe
Size 8.4MB
SHA256 1add7960022dcea6d9a1562823a35829b33e9a3586c0f6b2407b9e4e7bd3e9ed
MD5 8b88a171dc36b281103e148952234e5c
SHA1 b307406428532d01c3bad313d7d89e5168ede85b
SHA512 4b858a6df21747c18b0a397b746c1cc728b9777d7a070d8207e0ab158a3a6da75126d52be7b4d1c90f36778b264eea58402540561e71ea4196e8acdbba4e478c
SSDEEP 98304:9Op09KXTqUKUWc6ndSKCm7Gygu1ODhMzScViMfl:900UXTvKUW/RCjygu1o8Tl
TLSH
T103969C759A9D4F1DF072B079C187A223A7F1BC0D2361DF8BA9C49C77481F098BAA560D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.cmd

Path C:\Users\Admin\AppData\Local\Bitware\uninstall.cmd
Size 1KB
SHA256 879314ee40a2fae1ae127d02c157c243498c31946e411991c2cdad95bfabed8e
MD5 36b48c83c5a6cd5450ffcc5ddd4c775d
SHA1 9aeae2bf6e01eba040505c4dde44f60a15f47391
SHA512 9c0e1bdb8db18ca6962b320dcf717be73b15cb8f4dad88d648343d2e04e88868ce8303bd6b4fd63d5118d78f2645745f39e8c5f399f280ed30f074300e965248
TLSH
T1332184014BE84654FBF79F596DB8262E0537BC66A83EC56E11E4499C0AB3A30D820777
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a1f093ae1ed359ded6bab439df3347bd38f18fdec1f24276d9e77a9f8ee40d72
MD5 1d501e84ef5e8eac330c7c2724c0124e
SHA1 ab78ad1fafbcab439b141416c860b6809d68ab20
SHA512 b36948bc9fcdf677a8930481e5ac26c00ca37e627a6cb286ff1eab7e332170570b418d5241f637b47836715016f21c36015142cca32af698f93a077916e2b10b
TLSH
T15F51B66E96D62C0CCF214931C4A9EFD4E750194FCD012B7B292257EEE7832F1B005A57
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 24ddc6aa81a417b55d8a84618773f6b0149c7c56a0ed1c7edacce338ddb0f9b2
MD5 4576ee868fb70a4876f35a9ac4382d14
SHA1 bd50b5d4ed139359e3d7623ec693536f9573fb1f
SHA512 8ea051cd44ad3786d6757c94eb1d3496a820ce922a01cad416f4a75adf2994725673bfc8e433696d6a24e065bdc538ff3246a6a6c66e79f1f89ec4db38cddb05
SSDEEP 192:DFJ3b/S+y9ziXhQeY57GMngufcVTbmhqZ8NPQaP7fP+qvqQHlh5HA:DFJ3b/Xy9ziXhQeY57GMngufcVTbmhq1
TLSH
T19A029CF7C3E8C52D891156F49B15AE1BCE290A24431C3C76C9E4BE5BA3E2972E21174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7e7a5014d6fe014798ad284dbe69750a243a873ca2bb41799a19f3e79305c1af
MD5 6e890cb057d6026bee46e34da1d559b5
SHA1 fefd65295405d1d97b0f00629b190f58221d327c
SHA512 f55a4b0ff6c7e3f518f18cd9c480fb4e8fc0cb91f4472e92a5346fa82f67098dde326f25b413083dd3af97fe0edbded3a0b81adc4a4b08eb44569b2218ec02e5
TLSH
T1E43168B7D3D8997D890156F8AB156F1BCE2E0E18932D3C57C8D8AE0B53F2871D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7935db3af08c97ce955c64b618c5ec3879305c455c7686192ab471490f76e3e1
MD5 aa1fe1878cddaa4bc9ce9d3b38c1840b
SHA1 4e5561a04be5ab1ec9ee3988501c19b08bb86c72
SHA512 70fca45dda3dcfb40f512bfedbb01a6d36cf5006b8920cd32656cb7352f209299fc0a42e8e296ce6b8f9bb7e9689eac3a513a798dfeddf6d4a5604c1975908c2
TLSH
T103316BB7D3D8997D890156F8A7152F1BCE2E0D18532D3C57C8D4AE0B53F2871D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 eec25f9d85f1feb32053436a3a825147c63534905047e4fc948d60103d671422
MD5 dd0290b0b6936263109261a6685eea1c
SHA1 8104e7a51dd60465c21af87c7ee998f198aff502
SHA512 0b5c84846075cd73d62d71f90316df0f8d6a8e8ec6ebffa5a3342b55bf48fb15a62ec1dafa57d0ee12ea191cae8d496d3d92194f3ed5159a38259dfe0b1d254f
TLSH
T10F418D5B96BFB45B20388E7F5D05B80F59BBB832459178F4CA97822CB0469F70B22062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d30b7a5f65163db3d14cbefa7d5f137c5e6c38535b62ee7dc75cff70c53a2784
MD5 494817fd4af29ed1112061f049b6a311
SHA1 69fc76502eb85d8bf4963293409b1ff0fa89b589
SHA512 aec3d496ea8c96c186f72f93875b61e01e31283f1471bf7321461acb70cfb549e96c3ec9a7ee7515e0ed07abaae97a78f8088fd0602afb6d7db903db4efccb5e
SSDEEP 192:1RK7BU1v7zGAPRp2hU9XHsb+WNn8BCpC2cUeeWVyIsnAUge:1RK7KFnX/xw072Due
TLSH
T1AA32C76EA914653F5CDBD229FE717B67D6F2002571D42E84EAFC8A2C02E79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 54e24b3287e7eda7bc642baaa2d19b26cf12a4128232da3782cef5c2ab05f150
MD5 062bd950aa55fa7122ae85f5f6332b8b
SHA1 61682176a36eec534c6f6071d740ba07eade0e50
SHA512 a2613964dea3f3f69fb69751a71d14daf48c3f44cc86f0f9f0a9cfbacb5d774b35c554de8b6b9b12a5352f5e7d07fa9ada77fe8d870d720d5f36c258554ea70f
SSDEEP 192:1RK7BP1v7zGAPRp2hU9XHsb+WNn8BCpC2cUeeWVyIsnAUgR:1RK7ZFnX/xw072DuR
TLSH
T16A32A56EA914653F5DDBD229FE717B67D6F2002172D41E84EAFC8A2C12E79CC2213427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c052afe4b52c12a1859c410cea526132c85a95a382e22e2a047cdb62de893e33
MD5 83d8b5edfbe9d52f092d3f84f3f6e4f1
SHA1 f9a94906ee677c64e8d92d722f159f354051f8d3
SHA512 a6b96dcc9711fc50c00fbe7ba372810bdefc1f77a7872149ec00fe14fd8a5adeda5674030f0915645a2c6340c787374b6fd5d1fa24ac71afa11180c6deef71b0
SSDEEP 192:1RKcBzTBU1v7zGAPRp2To9V49XHsb+WN6V+G8B7VmDpC2XUeEWVyIsnAUgE:1RKmzTKFnXT4xw+2gU2WuE
TLSH
T15C42B66FA924153F5DDBD229FA71BB6AD7F1102571C41E84EAFC8A2C02E79CC2213427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 cfc51d3859928083f0050ebc09da5cf683488fc81a434a3dc3574698aaf973be
MD5 c7ff674f71d095a87ca1008ee4ab7bd4
SHA1 c001279992543fd41db4b171d3ba612cfd4ab8a6
SHA512 7eed649f3ab191f653efb77b798798f037635c562a80d7c406b3c849aac75a3359d792d5545d2f488e364d75a323bd6e981dec84167c81f8dcbe84b3aee8b4d0
SSDEEP 192:ewL4K6th7KxkXqK4I40pUZNCgVLHrKHfFKslEAZP5XzKD/+5+ErUkKN9ZfmH63HH:RLjGh7KxkXqKf/pUZNCgVLH2HfgslV5W
TLSH
T16332D72BA48D9A7F4FD8D41CDC522F8BACF5029672680D2496FB9D0803A57CE114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 cdb40dd3d4bd94177e354beec25ea81ba99588b4e7edd367fca2cc9b0b81fc3f
MD5 2734d81c5dc1af7ff11f083b92c8230e
SHA1 8db887d9f1328d4bb41d58c7ba7abaea509e07bb
SHA512 55389ee4c4fd3072d38b560d7f24c26da6a00deeb163edffc0a3800f26e45313e77798d4aaf07b3d2842736621a4e236ac9cc0f8def7a52d72b5a12da39e5257
TLSH
T12DA0021041C01D59DD10A374E0B20D452355492D1E51471354F90AD999DB2C94111344
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a136a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a136a.TMP
Size 48B
SHA256 53d850ab547881ed1417f0c7a9fd71c2f2e0ea948e94509d867b07a2ed4d0c07
MD5 421b16daf19d4f9387975da7a0ce75e4
SHA1 069da14f237a4892b39eb1859fdafd029f38965e
SHA512 d5c194c99705b960f087706b849a2b1ea59dc531852ebf487f439f51ce4f0a8d1bff959936e8c75f333999e9f7089aa089401d4e475f049abc63c6be341b14cf
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a25e8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a25e8.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 3c1f4da8bac716d41b60f30d8072390e75f13359b78f54eda60279b0b36b7411
MD5 72139ae6dfad335f5c101bba20efa090
SHA1 911e8a8d881a9a4ccbb032cf8c6fa6ff3d07d1ab
SHA512 68e3b31eb80f28e7dc4bfeaab090aaefa2a1e7936c88bde80b4303d096a71d5ce6b1c6fa6657db0b5bc419fd98245b8df4dffee0c3b7d73ac94e2cc81288be82
SSDEEP 3072:CO1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5v:Xmg1kQfATCFbzQACj8
TLSH
T148C3135A49E40DBE171204A121832EB5F7D5673FDF521FAC936A07B626D7C461387413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 ccc2895f5ff6c37044166a760ddcc56d94d47a39b19be6534d1fff517a6d4bb5
MD5 5262134bf8a3837681e0cbe3c6e5bb76
SHA1 3544a4d679625449375c4be3cdfc631784a87074
SHA512 59f6e7bbb5d645d49f5866e01848b51925de465358fc09bd1bfc0bcc009ce42a9d14d5d1b362c538d862178e069ebe1749a6d63f911b90bf7145111241722f46
SSDEEP 3072:lh1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5v:pmg1kQfATCFbzQACj8
TLSH
T1A8C3125E89E40DBE271204A121832EB5F7E5673FDF522F9C936A07B616D7C461387413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9ebd6f2fb2ba0aee56bac717a7887457663c82b260e7e5b84731bb24c1bcd419
MD5 16ba76e81f28408ee6add5c972b20082
SHA1 2950ae1e89cee6ca5398800a645b2192a7556302
SHA512 18ef24df6f3e82e8a2d8293853ad365758d50b0ca1567ef012f16ba59d084d3a6c1c48c2313eedbea7847f1a4e57c027c8ffc01d96e1792a3f74ad218801cf52
SSDEEP 96:VC68d+laPzyON3b/fVvMxRRDotok5iODMB6VddGyvvwjNxwb7v4a:VCPmaPzyONr1vmDUDRAQdwJjNxwbf
TLSH
T1E3A10772A028CD3759B6D485B1566F978EB461ABB6219F98D8EC2F0C12F72E80302523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5196_1029774306\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 218188.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 218188.crdownload
Size 9.6MB
SHA256 c377f327acf6f974085678aeb267ef49caf229abcc290fcbcaa88d3c5b28d571
MD5 c2578522848004b668a214063b29b1d7
SHA1 f717839175b602b73fdc343397d7e1cbc25e385a
SHA512 ad4e7f003548b0c6b89ca7b23ed099dffbac5bc0a878c07a9e5d9a428701286f84a9a06bacbf0d5bf9c65319ee50b8129030f42a922850d9f6ea6a10315f9722
SSDEEP 196608:eb1PrdUXKZWafizCk6jsNZtzmsxL50W7ANVSXrlJBKJhDp:e7UXKwzmsx100ANVSblyDDp
TLSH
T144A6AE22B900C032F8D200B296BD5FFA993D9A345B7954D3A7D42DB959305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4280-12-0x00000195B73E0000-0x00000195B73EA000-memory.dmp

Download

memory/4280-11-0x00000195B7220000-0x00000195B72D2000-memory.dmp

Download

memory/4280-10-0x00000195B7200000-0x00000195B721E000-memory.dmp

Download

memory/4280-7-0x00000195B6F60000-0x00000195B6F82000-memory.dmp

Download