4e1dd372212a9a0b07808318326dc6a9e7192b3b5204bdfd10e1f12eb5755d4e

Analysis

user interaction
yes
max time kernel
900s
max time network
873s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUKU SHORT!.txt
Size 27B
Sample260706-pawkvaew7t
SHA256 4e1dd372212a9a0b07808318326dc6a9e7192b3b5204bdfd10e1f12eb5755d4e
MD5 cda17fd4ba965c4d251b21ce4ed8ae45
SHA1 f32b810fcc8334b17fca8b1f010b68beded68a32
SHA512 16a7fbd43d55bdcb6effa5056343d03e00c032edf75c189d57bc6c81ccc91fa85f197bfc3106e57ebb53d23f5f5e8f6c7084f0527cdd9e66a56e42b9b9820fb5
MD5 SHA1 SHA512

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	34	https://bstlar.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16e7edc4f08d1f7	5

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3868	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278133120062911"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3484	3420	chrome.exe	89
PID 3420 wrote to memory of 4940	3420	chrome.exe	90
PID 3420 wrote to memory of 4940	3420	chrome.exe	90
PID 3420 wrote to memory of 3868	3420	chrome.exe	91
PID 3420 wrote to memory of 5616	3420	chrome.exe	93
PID 3420 wrote to memory of 5616	3420	chrome.exe	93
PID 3420 wrote to memory of 2976	3420	chrome.exe	94
PID 3420 wrote to memory of 2976	3420	chrome.exe	94
PID 3420 wrote to memory of 2136	3420	chrome.exe	95
PID 3420 wrote to memory of 2136	3420	chrome.exe	95
PID 3420 wrote to memory of 4472	3420	chrome.exe	96
PID 3420 wrote to memory of 4472	3420	chrome.exe	96
PID 3420 wrote to memory of 3076	3420	chrome.exe	97
PID 3420 wrote to memory of 3076	3420	chrome.exe	97
PID 3420 wrote to memory of 4300	3420	chrome.exe	98
PID 3420 wrote to memory of 4300	3420	chrome.exe	98
PID 3420 wrote to memory of 3516	3420	chrome.exe	99
PID 3420 wrote to memory of 3516	3420	chrome.exe	99
PID 3420 wrote to memory of 1496	3420	chrome.exe	100
PID 3420 wrote to memory of 252	3420	chrome.exe	101
PID 3420 wrote to memory of 248	3420	chrome.exe	102
PID 3420 wrote to memory of 252	3420	chrome.exe	101
PID 3420 wrote to memory of 248	3420	chrome.exe	102
PID 3420 wrote to memory of 1964	3420	chrome.exe	104
PID 3420 wrote to memory of 1964	3420	chrome.exe	104
PID 3420 wrote to memory of 1872	3420	chrome.exe	107
PID 3420 wrote to memory of 1632	3420	chrome.exe	108
PID 3420 wrote to memory of 1872	3420	chrome.exe	107
PID 3420 wrote to memory of 2436	3420	chrome.exe	109
PID 3420 wrote to memory of 1632	3420	chrome.exe	108
PID 3420 wrote to memory of 2436	3420	chrome.exe	109
PID 3420 wrote to memory of 3016	3420	chrome.exe	110
PID 3420 wrote to memory of 3016	3420	chrome.exe	110
PID 3420 wrote to memory of 5572	3420	chrome.exe	111
PID 3420 wrote to memory of 5572	3420	chrome.exe	111
PID 3420 wrote to memory of 4376	3420	chrome.exe	112
PID 3420 wrote to memory of 4376	3420	chrome.exe	112
PID 3420 wrote to memory of 2416	3420	chrome.exe	114
PID 3420 wrote to memory of 2416	3420	chrome.exe	114
PID 3420 wrote to memory of 4832	3420	chrome.exe	113
PID 3420 wrote to memory of 4832	3420	chrome.exe	113
PID 3420 wrote to memory of 2040	3420	chrome.exe	115
PID 3420 wrote to memory of 2040	3420	chrome.exe	115
PID 3420 wrote to memory of 1828	3420	chrome.exe	116
PID 3420 wrote to memory of 1828	3420	chrome.exe	116
PID 3420 wrote to memory of 4360	3420	chrome.exe	117
PID 3420 wrote to memory of 4360	3420	chrome.exe	117
PID 3420 wrote to memory of 5832	3420	chrome.exe	118
PID 3420 wrote to memory of 5832	3420	chrome.exe	118
PID 3420 wrote to memory of 276	3420	chrome.exe	119
PID 3420 wrote to memory of 204	3420	chrome.exe	120
PID 3420 wrote to memory of 276	3420	chrome.exe	119
PID 3420 wrote to memory of 204	3420	chrome.exe	120
PID 3420 wrote to memory of 5924	3420	chrome.exe	121
PID 3420 wrote to memory of 5924	3420	chrome.exe	121
PID 3420 wrote to memory of 2044	3420	chrome.exe	122
PID 3420 wrote to memory of 2044	3420	chrome.exe	122
PID 3420 wrote to memory of 1552	3420	chrome.exe	124
PID 3420 wrote to memory of 1040	3420	chrome.exe	125
PID 3420 wrote to memory of 5568	3420	chrome.exe	126
PID 3420 wrote to memory of 3364	3420	chrome.exe	127
PID 3420 wrote to memory of 2972	3420	chrome.exe	128
PID 3420 wrote to memory of 2972	3420	chrome.exe	128

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\FUKU SHORT!.txt"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff807cdc728,0x7ff807cdc734,0x7ff807cdc740
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,11469681439030274070,11315761875843916039,262144 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,4087925488364253156,11623268473455904025,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,2522845925634512971,14176660396589655864,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,101815682853738240,14035110575304770467,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,15631502584857890078,8055599672877933994,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,6655595252554753564,12068005314414091897,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,13043558134996494391,6032284299551924369,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,2068365085684623996,7686900382096759774,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,5661316707138450950,3393586078651400689,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,4899955999681426585,6733526365295691454,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5476,i,11877539050432437414,14479922695277399638,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5488,i,17032670221626864515,9928886923665805491,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5824,i,3643118315056934873,3392292292862021169,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5956,i,2253165628914119755,17086936538136995344,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,16953574143896083532,12216653898005608645,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3256 /prefetch:14
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3928,i,8831363237850334948,10976971831623862617,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3652,i,655511620786710950,15772867906280757923,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5936,i,13474835154766820606,16984142258623123149,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3544,i,286496093105130857,5086772237649718281,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3512,i,7687770698588196700,15598471172887455100,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3704,i,4475270858236011805,12809850589151316867,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3572,i,17979600250766452852,525758353675801260,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5408,i,16571022269214786640,10505617760836192033,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,13930535995680045222,2743806317299387004,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5932,i,4318338727908948188,882617230458238124,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5476,i,7369974532347490934,11876503914036083597,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5868,i,1383471700101210788,11663290349716595075,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5768 /prefetch:9
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6524,i,12977341151880200066,661143575348773446,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3612,i,11627494662440417105,11157071228472106162,2097152 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,16501156594913572331,1288050023640238081,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,14099835282744050880,8627777823861903621,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,16231798665440793476,16338467329165435711,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5664,i,3998286512239481115,12853525301128441143,262144 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=6072 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,10892553730288049874,2319369631270473464,524288 --field-trial-handle=1888,i,13053986009254072612,5843415293221020171,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3164 /prefetch:14
  2⤵
  PID:2972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2536

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 84cc56d4b17d807f6da1be8fffaf9c29f8977d85e7c11ffa2ed6df631905ff06
MD5 25b8974b339e0ec56bd5a7c93d0c6225
SHA1 0783462f4b269fea607c415c8e59edeb817bb8a1
SHA512 489b7f6d4373a24309c511b29b55209e78a0b3930b1d1c878e126533da8d4cc4e4ddb90f84fe5063798aeec7fec607da7ce90bf71ead526f15b0b89fe05851c1
TLSH
T1A7F0F4BAD921AC3718FD5B2860A44A4BE75013972B80995B3B3D820C8F7163B468A82C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 964a472b9156f6cdfe545a51153622516b0215d87b7efaaf471357fc3fdb7d53
MD5 12af9bd8bb268aba428d51583b73d6da
SHA1 3c0e181599ed3787e993f2833199b3bc2499c72d
SHA512 ec7354a17a0a4c0639b75c57b3b57c99a11df326fd3e8c9476f651903e9f099b78cdfc5a9e2c957ee2f78db4bab7d96d8ac38cedfd12174e391a78c230501c44
TLSH
T19DE0C2E51DD08FACCBA0897C29B90D0956B4C7CB249E179382C1E8797712A91D60C724
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 7b1579c4048ba10df6c89270938d8a4c2b2359bd9ecf25ec411d417d7fded0ac
MD5 320933b1741395a8d341e81aeda304c4
SHA1 ec5f9763d75c322f5718d4d9b0e3618dcf6193bb
SHA512 a9ab29b9a2d15a8ecc1c06b51436fa517c7d5311260d299af442fcd5ad2fe1a35e792155ac0d20f4babe9c23793d20eaafe546a2af3d48220111af6d6b96e8bc
SSDEEP 192:DznWN1H26cGw3OcyA0M376h4L2YXB6R0k12zdyRK:DznWN1H26cGw3OcyA0M376h4L22B6R0Z
TLSH
T180F17CB3C3D9C66D981166F4AB246E2ECE1D0A14931C3C26C9D8BF4B93F2571D21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f1188dbd3afb553f9122aed86f2b74b9d8f3309be90114bb6e772bfe2206f1d9
MD5 bc54a974bf556bad79ebf429f6d1cec8
SHA1 5543548252b99e883e0ed98ac67c0c04b1934583
SHA512 cdbc931fc6a148cb21c10f8e34eb9ce37ccd3b80e288c2e19823885a345d9fec0b42c27ee0bc10286c3a72a5c1316a9e844d1966746f9e8c492155e6a1a7f6df
SSDEEP 192:DBh12mdM5PRa4Gw3NEd70M37mdL2YXB6R0k1tjyyxRowcPHLjh4OX:DBh12mdM5PRa4Gw3NEd70M37mdL22B6s
TLSH
T1A2027AF783E5C67D991166F09A246E2ECE2D0A24532C3C26C9D4BE0B93F2572E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4d1ca2358b274d4fd9fd349aaeed139a4fe0b8ee7ecbac7110bf1576bf61f305
MD5 19dcdc383eba731cdafcd2c752e85a6c
SHA1 5404c4c265df76922670e08bf9b6497f8b1090e3
SHA512 ff1111241ce0b1ab0953c88aa40c83e886d0f9dfe3f3a622274ab89fcb48e808ad2d456ec6a4da0e07ced8c06be211cde9c99357a82bb63e827b407ad44b0165
SSDEEP 192:DBh12dM5PSloUGw3NEd70M37mdL2YXB6R0k1tjyyxRowTPLjhn/1K:DBh12dM5PSloUGw3NEd70M37mdL22B6I
TLSH
T11B029CF783E5C67D991166F09A246E2ECE2D0A24532C3C32C9D4BE0B93F2572E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c495f2fbb426c71e852625555775c622f6d9e0b4a5fff925d3b261c83babde8f
MD5 905bca9eb953b9ac5579ad9c77a8887d
SHA1 84599486ab90ee48a25ac6ec9266a6d4ff902442
SHA512 ad0b93ba93585af8167ea2a04b2c8598e1bb92b2f40d27e7b59bd677a4cda01393234c0cbda38f1c69ba9c65f7bc1e444e59177f2d77e510391ac66858c56505
SSDEEP 192:DBh12mdM5PSl4Gw3NEd70M37mdL2YXB6R0k1tjyyxRowTPLjh4/HK:DBh12mdM5PSl4Gw3NEd70M37mdL22B6J
TLSH
T1FE027BF783E5C67D991166F09A246E2ECE2D0A24532C3C36C9D4BE0B93F2572E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 f6f4a0dfc5e7b3e06f8ed05b8be4ab46c50d57ec29cfe6ca79744c533579016b
MD5 07df3e0fd6a4349d0ea92ba36120c8ec
SHA1 84ee11a57f62457e6737139e5d501a916bdebb2f
SHA512 1acec973e0fd6fbf59cba29121d8bf3b6e32f6b3a377663cb86a2b5b9b09978f018a217d57390573a2fc4c6c9e3df0dd830acf8564540ef26abae3478f217d5b
SSDEEP 192:DznWN1H26kRa4Gw3OcyA0M37m4L2YXB6R0k1tdy4xRowcY38Zy:DznWN1H26kRa4Gw3OcyA0M37m4L22B6n
TLSH
T10A227BB3C3E9C67D981166F59A246E2ECD2D0A14532C3C26C9D4BF4B93F25B2E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2e56229b0f4f1b4a002be314d79504d0662e4444f4b7bb98304587482eaf8f97
MD5 dcbb1a32af6efdbe775399a4e68e9fdf
SHA1 53bcee268e193c63e57d4ac151e8ecad13e620a4
SHA512 01bedaff392dbec3e5f175aaa22aa1b95b56d833fc2f0c0445ebbf37e1fd24594c75c8a94b840d86f654197fcc61295a03ec06cda37ec52b3f773653297980ad
TLSH
T1E0216A97927FB4AB1438497B3D4078052D7AB430024268E4CBDB82ADF0C35FB2E16466
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 96e74393696028e426b74b98918a408e4e719a329a22bef05f8ad616db4d6143
MD5 2fc86adb5a0d52fe594e285f95ac59ac
SHA1 caa0ba09de6464e38831968bf89b3d4f28aa8c73
SHA512 53a42ef6419e1e07a822ad5fcbd32f67afe794c0c2c96602471065155ac0d4f40c70c06956cc4cdd4b386a02f5662625e6fccdacef90e5bd7080a1a84a27b272
SSDEEP 192:BRg8FXEvv7QvAPRp2MjkX9e3Hsb+WNCispLXY2R9wkwk8DVyIsnAUgE:BRg8VEnc6XIwXw+k2YnlE
TLSH
T10F42B52EA914293B9CDFC22DF9657B67E7F5102171D02E84EAFC8A2C16EB5CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 175b840b9794ca27b95dd0870a1161490c9d14e4f2ef0023ce4574afe1f4734f
MD5 b79677f230f9bdc7b6e7200645936287
SHA1 906df0523a71d04d497a72e6ece18d5a2cc3d11a
SHA512 3d1830aee98bd43109a363e0f0e41a849ad628d0a8545f5f6ad42c6c468e2ff7462650b890cfaa6a91fd39f352b0630b11c805c17ce90347c79b906837b77b8e
SSDEEP 192:BRg8FXEvv7Qv2PRpYMjkX9e3Hsb+WNCispLXY2Q9wkwkIDVyIsnAUgE:BRg8VEncQXCwXw+k2XllE
TLSH
T1CD42B52EA914293B9CDFC26DF9657B67D7F5102161902E84EBFC8A2C06EB5CC231741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af29009e8735041a42d5558b99c81f11f078a00b3e2c0ca88683f2af17d6b11c
MD5 d28da392e3221e55a6354bb8a9e6cebb
SHA1 7dfe3834ba3415acc88781ad9fe42d22d544150e
SHA512 fad7ade82f16ce392bd6216c0b8cf22e4fc7c43a1fd9f6631a9340e5e4948a320250124fb2cf4616d1f07d9c4f2238fc5647781ef0a1305bc45260ad818b480b
SSDEEP 192:BRg8FXENv7QvAPRp2Mjk79e3Hsb+WNCispLXY2U9wkwkeDVyIsnAUge:BRg8VEtc6XAwXw+k2bNle
TLSH
T1D842B52EA914293B9CDFC22DF9257767D7F51021B1D02E84EAFC8A2C06EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b544ecc86d414358f37ad4423c580f72d8754d7593917415e794bc2d5c16d7a5
MD5 13c545602e40cb01ad14ce3a6dd2f9dd
SHA1 16affb6b0afa200bbb4d1b56fcc9e803f0efb4e9
SHA512 43069164499d639ed8b2e162169a4f1df93e3f19e42cc5d26e90f55fdfaa24d24efafb91d4ada09a8c6a71d97a327d4303a22e754b979d48e1a31fa028f98cd7
SSDEEP 192:BRg8hXEvv7Qv2PRpYMjkX9e3Hsb+WNCispLXY2Q9wkwkIDVyIsnAUgE:BRg8BEncQXCwXw+k2XllE
TLSH
T14742C52EA914293B9CDFC22DF9657B67D7F51021A1902E84EBFC8A2C06EB5CC2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 97800c4e132e36c59e2709a0db9583e753b3c2861660c1ee049ba782ecd7071b
MD5 7d88086f42d1e39edcf71f619d64b069
SHA1 785a2a2ffa54fc0a2aea4580901910abcd6d92b4
SHA512 5279fff816e7710de0de93c5571df020389e593dfae5a4d999486c3ae72807196dab57316455c1bd4d9fc5438505644861af355c16011025b999ccc6332bbcc3
SSDEEP 384:CIjOh7KxkXqKf/pUZNCgVLH2Hfgsl95XODO5+ErU3bfHG+JhAx/63f:C8Oh7KxkXqKf/pUZNCgVLH2HfgsTdOKq
TLSH
T1D452F967684D9A7B4FC8D68CDC236F8FADF1014A66644D2857FA5C0803A97CF124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 86dc81c4b31d2d80483ad5b3a55779e7f924b5760d6737ad9b63bd4e3a9f8568
MD5 f5e1ad225d8624e558e415c4889cbb3d
SHA1 0812823f32d12bac357edf14124f440f4ce1a005
SHA512 de66c6722ba6643bbe0467de8f66229efd78893dae32e9c94ab94adb92b8fc9bceda514ead115f952af9d9ceda01925abcbe5cfa25772e8dd657bd537f0a4f69
TLSH
T186A0021B81C11C12EED483F075710F81236189541672538766928848CC6B1C45102305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af08.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe58af08.TMP
Size 48B
SHA256 f77cea6944fc624faed302de8773c40c1c23ace1d17e739029e7ebef7424f659
MD5 3473601fff00c4d0ac11b9675c990637
SHA1 cbe9a06880909e5de20ccd5e604d04608ef7563e
SHA512 c6202e6cf8562a62a2e9a0fb7ec5a6601e8c5a94fb2f76c8d21b3876ef4f74b778536f7e23157748373fdc451605e3bb198c49e562c517df1c5980af9a7167ba
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 bd741b954100905126a7f92af2ffaed87cb7a9a68657797aef1bd35afac7c2c9
MD5 0f70b48caaaf00802263c7c4afb8d62c
SHA1 4a1d05b477ff4886d25b7345a40e69d826eeb461
SHA512 b9abed0db05a8a39211331fbbb242778e0646d37c3217cc7fbd6f69fc5dba4b38422363d3051a85ffa8ce1574565c0b86cc73df8a6ffffb307ec3a650cedd3bf
SSDEEP 6144:5tL1kkk0anFe1OPdVbZ/yloO2kYoOxqLuT6cPiBDEMRIS7:vxktByWtX5xqCTGr7
TLSH
T190341256CAE3258E07A8FEB7F106995E4CE4C623C641FE58FBB44F4A46DECCD2200A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 a684befcb8dbc6122ef86d86b8c16638377ce345afb4c44741b1da6e8f5199db
MD5 2a2f976372354c6ea083c5caf9c92b94
SHA1 817b4170ab4fc2edb7dea24e747422a406e9810e
SHA512 75c8f95d00963d4b1fc13f8f06a854e82d16a3640abb7e4db4f6329d1c42fd064a15c7808256f580be6e1ffbc4c028a6b02050bb0c5bbc6e324032843fe72294
SSDEEP 6144:aXCL1kkk0anFe1OPdVbZ/yloO2kYoOxqLuT6cPiBDEMRIS7:uCxktByWtX5xqCTGr7
TLSH
T193341276CAD325CE07A8FEA7F006995E4CD4C627CA41FE58FBB40F4A45DE8CD2201A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 41d05543b4afdd3389346e11933897d7b7aca56d0cbe4b1c36af15da77e34433
MD5 6759ebaf564f0a00c8b87048a4b57881
SHA1 429004022b50d098641567e9f9329e1fe3adf079
SHA512 5e84286150484b4ba5cc39ad78f1e771203ca7b4371bfaa479db1da640ce09436bb18aacce4c79feff4595bfdc2c57b6fad16082673181a0286527eeba255e37
SSDEEP 3072:Hr1Y9+3NOxiWmLTKT8SIv0RPizlDEMRyMqS539:HhYoOxqLuT6cPiBDEMRISn
TLSH
T11DC3121BC0D6698E429BDFBAF02E9A519DA58237C109BE58F7E54F06CDDF88E1110607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 ddafd524e733c450a97e415a0ce59198376e28a10dd941063144a083a6db36fa
MD5 1830bee47c14396d599cf886db91c7a0
SHA1 5ddf9271edfbecbf76225437ba9b3b69e34445f7
SHA512 995b7062a028f1696ca4b56a65ec9cea97d91e16a015057c50b767a10e629332c3c59d7371e85b3033af808581dc6a0413ffa5db5cc2b4ea8d79cfafd5532c53
SSDEEP 6144:WtL1kkk0anFe1OPdVbZ/yloO2kYoOxqLuT6cPiBDEMRIS7:4xktByWtX5xqCTGr7
TLSH
T118341256CAE3258E0798FEB7F106995E4CE4C623C641FE58FBB44F4A46DECCD2200A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 b71e5a90b6ce09b4dbb3f81aa3644512ec26c86cec36b374b85480fe940f5c6e
MD5 d7aff997f0898122d7348bffcd94c128
SHA1 d716bd19decbad463e2e1fc9bf24edc484a63fae
SHA512 5312e8c1de9a2973691e84d58048e3ae519aa91504f77afc3acd21ba587d487cb555419c1710725a8d100e0e1bd2b4a909d1e15b438aa10a4cdc6531e02e12a6
SSDEEP 6144:WXCL1kkk0anFe1OPdVbZ/yloO2kYoOxqLuT6cPiBDEMRIS7:yCxktByWtX5xqCTGr7
TLSH
T1A8341276CAD325CE07A8FEA7F006995E4CD4C627CA41FE58FBB00F8A45DE8CD2201A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3420_152563059\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download