bc163b34de39ac8dd8e6a813d19556da59a25f9e3ab2d4ab2ee2c9cb7d8e35d0

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MecchaChameleon.exe
Size 10.6MB
Sample260708-pwpdnagy3r
SHA256 bc163b34de39ac8dd8e6a813d19556da59a25f9e3ab2d4ab2ee2c9cb7d8e35d0
MD5 035d48ff86f071e61b861a957a4a2ae9
SHA1 dfd5c43464370bb407ea3e81659ec87b4df66b3b
SHA512 0fb13511fb20e8d06abe771b148640c72b0544517d13afc3d281aaf96ce49389f5a96f59e7d4aba1cb77ae70e80b3860499516cc74f9d66dc0b5a87059b6544d
SSDEEP 196608:2Dqn6BAmciPyrZM3kPQMmQIQwzAJTXGwkQluxZvXnSu4:2Dq6XL6VMkIR98pfluPnSu4
TLSH
T1F3B6330E33E8DE95D42B15B236B9306E59F0EE109090BF9C10F2CEE3575A59E6E952CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MecchaChameleon.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MecchaChameleon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MecchaChameleon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MecchaChameleon.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1544	MecchaChameleon.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5684	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1728	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279882292758497"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
5296	chrome.exe
5296	chrome.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4956	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	taskmgr.exe
Token: SeSystemProfilePrivilege	4956	taskmgr.exe
Token: SeCreateGlobalPrivilege	4956	taskmgr.exe
Token: SeBackupPrivilege	2060	svchost.exe
Token: SeRestorePrivilege	2060	svchost.exe
Token: SeSecurityPrivilege	2060	svchost.exe
Token: SeTakeOwnershipPrivilege	2060	svchost.exe
Token: 35	2060	svchost.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeDebugPrivilege	1348	firefox.exe
Token: SeDebugPrivilege	1348	firefox.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe
Token: SeShutdownPrivilege	5296	chrome.exe
Token: SeCreatePagefilePrivilege	5296	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
1348	firefox.exe
4956	taskmgr.exe
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe
4956	taskmgr.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
4956	taskmgr.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe
5296	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3628	1544	MecchaChameleon.exe	86
PID 3628 wrote to memory of 2376	3628	cmd.exe	87
PID 3628 wrote to memory of 2060	3628	cmd.exe	88
PID 3628 wrote to memory of 4104	3628	cmd.exe	89
PID 1544 wrote to memory of 3896	1544	MecchaChameleon.exe	103
PID 3896 wrote to memory of 4908	3896	cmd.exe	104
PID 4908 wrote to memory of 1728	4908	cmd.exe	109
PID 1840 wrote to memory of 1348	1840	firefox.exe	126
PID 1840 wrote to memory of 1348	1840	firefox.exe	126
PID 1348 wrote to memory of 4904	1348	firefox.exe	127
PID 1348 wrote to memory of 4904	1348	firefox.exe	127
PID 1348 wrote to memory of 4904	1348	firefox.exe	127
PID 1348 wrote to memory of 2728	1348	firefox.exe	128
PID 1348 wrote to memory of 2728	1348	firefox.exe	128
PID 1348 wrote to memory of 2728	1348	firefox.exe	128
PID 1348 wrote to memory of 2728	1348	firefox.exe	128
PID 1348 wrote to memory of 2964	1348	firefox.exe	131
PID 1348 wrote to memory of 2964	1348	firefox.exe	131
PID 1348 wrote to memory of 2964	1348	firefox.exe	131
PID 1348 wrote to memory of 2964	1348	firefox.exe	131
PID 1348 wrote to memory of 1272	1348	firefox.exe	132
PID 1348 wrote to memory of 1272	1348	firefox.exe	132
PID 1348 wrote to memory of 1272	1348	firefox.exe	132
PID 5296 wrote to memory of 5320	5296	chrome.exe	135
PID 1348 wrote to memory of 5364	1348	firefox.exe	136
PID 1348 wrote to memory of 5364	1348	firefox.exe	136
PID 1348 wrote to memory of 5364	1348	firefox.exe	136
PID 1348 wrote to memory of 5364	1348	firefox.exe	136
PID 5296 wrote to memory of 5676	5296	chrome.exe	137
PID 5296 wrote to memory of 5684	5296	chrome.exe	138
PID 5296 wrote to memory of 5676	5296	chrome.exe	137
PID 5296 wrote to memory of 5744	5296	chrome.exe	139
PID 5296 wrote to memory of 5744	5296	chrome.exe	139
PID 5296 wrote to memory of 5892	5296	chrome.exe	142
PID 5296 wrote to memory of 5892	5296	chrome.exe	142
PID 5296 wrote to memory of 5884	5296	chrome.exe	141
PID 5296 wrote to memory of 5884	5296	chrome.exe	141
PID 5296 wrote to memory of 6772	5296	chrome.exe	143
PID 5296 wrote to memory of 6772	5296	chrome.exe	143
PID 5296 wrote to memory of 6796	5296	chrome.exe	144
PID 5296 wrote to memory of 6796	5296	chrome.exe	144
PID 5296 wrote to memory of 7068	5296	chrome.exe	145
PID 5296 wrote to memory of 7068	5296	chrome.exe	145
PID 5296 wrote to memory of 7136	5296	chrome.exe	146
PID 5296 wrote to memory of 7136	5296	chrome.exe	146
PID 1348 wrote to memory of 5992	1348	firefox.exe	147
PID 1348 wrote to memory of 5992	1348	firefox.exe	147
PID 1348 wrote to memory of 5992	1348	firefox.exe	147
PID 1348 wrote to memory of 5992	1348	firefox.exe	147
PID 1348 wrote to memory of 372	1348	firefox.exe	156
PID 1348 wrote to memory of 372	1348	firefox.exe	156
PID 1348 wrote to memory of 372	1348	firefox.exe	156
PID 1348 wrote to memory of 372	1348	firefox.exe	156
PID 1348 wrote to memory of 2152	1348	firefox.exe	149
PID 1348 wrote to memory of 2152	1348	firefox.exe	149
PID 1348 wrote to memory of 2152	1348	firefox.exe	149
PID 1348 wrote to memory of 2152	1348	firefox.exe	149
PID 1348 wrote to memory of 3196	1348	firefox.exe	150
PID 1348 wrote to memory of 3196	1348	firefox.exe	150
PID 1348 wrote to memory of 3196	1348	firefox.exe	150
PID 1348 wrote to memory of 3196	1348	firefox.exe	150
PID 5296 wrote to memory of 6500	5296	chrome.exe	151
PID 5296 wrote to memory of 5280	5296	chrome.exe	152
PID 5296 wrote to memory of 5280	5296	chrome.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MecchaChameleon.exe
"C:\Users\Admin\AppData\Local\Temp\MecchaChameleon.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\MecchaChameleon.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\MecchaChameleon.exe" MD5
    3⤵
    PID:2376
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2060
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1728

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {4e3878f5-0477-4220-8230-4ca560f0b0c0} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {21ed7cef-943d-4ced-8c28-c25711e9d5ca} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 27276 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {5edf2c03-cf3a-4c5f-88e9-1f5c4478edc2} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27276 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {6dafcbe6-c669-4436-89cd-e853923d96d6} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3252 -prefsLen 34775 -prefMapHandle 4272 -prefMapSize 270279 -jsInitHandle 4276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4316 -initialChannelId {7f65885d-2c1e-4da1-b9eb-0968af33ee7d} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4716 -prefsLen 35012 -prefMapHandle 4748 -prefMapSize 270279 -ipcHandle 4812 -initialChannelId {e642335a-684b-4100-af46-93e0b11f9983} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4944 -prefsLen 32900 -prefMapHandle 4948 -prefMapSize 270279 -jsInitHandle 4952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5088 -initialChannelId {7ffa7270-bab1-4f88-9b3f-4891aec49bcb} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5024 -prefsLen 32900 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5100 -initialChannelId {4e3456fa-9ba7-4006-a789-d6cc1fcebceb} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5052 -prefsLen 32900 -prefMapHandle 5056 -prefMapSize 270279 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {2ca56842-7e53-4e60-b2fe-8df7fa25ed57} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ff9ec87c728,0x7ff9ec87c734,0x7ff9ec87c740
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,14393986691020478897,4023909245393093843,262144 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,16936257536600980743,17666475452680354324,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,1196920607295717378,6106694157476303388,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,9367453844658098382,10332593403099378559,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,5060119955466295076,2433520775136865402,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,17901615136800142328,12144349313901693661,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:6772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,668045068700966085,11926255230730165771,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:6796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,2714734861144148444,3985424469237189476,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3964,i,16968422858773969832,6413652476759585320,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:7136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,13570814607871741366,10407308719455752486,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:6500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,2959585667081228697,2604615679254799728,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,10595332116614922531,5962053480627581761,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,773910119712325556,2418312303933129937,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:6404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5572,i,2437037366726002522,4773318936335465476,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:2
  2⤵
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5864,i,10089519428831132756,8807221944936204777,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4600,i,9771204879958220471,15690045218861085867,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5344,i,14418364609028144668,16105723132736965923,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:6452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3436,i,2270834194283088739,15650212304740282911,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,270122451291567893,17223123985992115729,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3676,i,10566601754698876445,6125143628822449103,2097152 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,2760710062581254468,1792876982096018004,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,16998530195326036110,9785955242906793758,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:6292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,18208324244561047813,5056470666910205635,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:6288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,16713015578768689325,5864850886988199017,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,13365679026035812998,12685809936806146106,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:6788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,4666125899040636040,5866612370301502535,524288 --field-trial-handle=1972,i,17563589996514774776,944655460855996329,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:6672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e5d71b15f7ec07565d10a9a14812233f9c77db94f4c4cdd5dcfe338447c0776b
MD5 ec16b11546fd296f0c14e883d0171330
SHA1 444798c425ca24043a0f550452a5f3d47fec0938
SHA512 68b5681ecb1e349e7af6c99b766f4c16ca638f330de90f4797f007f40a778b2e4ffc0231ea25b7f9ecb87c1195eeab9f7c4b171fd2617718872eddcf034d5c64
TLSH
T1E7E02BBEC961EC2B28FE175870558745F650135B2740894B7A3C850C8FF1A3B9645C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c60216cbe36d1721a24486798c9938c0456b97bc7706eadc973ba66727764548
MD5 30933b027d96e20134a268ea89f3127d
SHA1 fecd79b8c20f124cabbbe59d9715c348e7eded0b
SHA512 ce79f17c8b36eb7f913fac8a8653633d7a9e19becbea41ba0bbe324538635821f1006c9a80f6f2b8b751feadd8cdc268d81958eae9dd5c87cdc8314287aa1469
TLSH
T13D210E84038591FCCB924DF45CF349F2B1750422F9630D72E8ACA47B1553BA099D74FA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7fa83fa3c3cbf2fd74726314b4a68a86b093b8e70825d60d59d3475c8d2c1fbe
MD5 486838b7f78c8b304bc54bebd3796ff2
SHA1 e6f34be4e4e38e09a1d35eb6bc0c268b394ec48a
SHA512 ca4e9b09e87d17df691823426386cc2fc94a448c498c48b39599d2a53cd1b577883ee0e8859dc76cb0eacecbef54abce683d9a15fb158298287806fe05591fc0
TLSH
T19A3130944356A2FCCB968DF41CF349F2B5750022F4130DB2E8ACA07B2553BA059E30F6
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4bb757da041d8b9d0fa372cc03dd4ab40ae105a120c1ecc9579fb234905efdfe
MD5 661661503274d392066fbfcd8bf026bb
SHA1 4135d5a52fc3cf446c07dbbaceefcd58b9bb5e97
SHA512 f6bce05b77579fdf3d3132d025a7f0a7e060df2af83f662426103e38a88cf5677793d02a75f791dd68fb73cecc1584677f5c8ebe31037ab03910c9147d748d9d
SSDEEP 192:DbcNT6r29Qr8IAc5bk7numthVRgwAsKWzzROR:DbcNT6r29Qr8IAc5bk7numthVRgwAsK1
TLSH
T151F19DF7C3D4C62DC85162F59F283E1BCE29092462683D6789D4FE8B63E6472E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 95cee327aea59205015ee1dc85fbf167a03db12ed72f94340f52c57e6b9b36c3
MD5 033a7c972c8cba91420c4ad6c9e3f46b
SHA1 36ae85a170fde0082475aaa0713a63583ac4bf29
SHA512 f97ddabff3736a71aa1dec0d741bc8240e0059cdf8188f30f38289b4031a1982b4fb56b51fbcf77315447474f1b194771662e01f71ee9fcb96bae50998491293
SSDEEP 192:TRbgHZ0v72vAPRp2tZ9THsb+WNnuKFtl2Dt26SsOVyIsnAUge:TRbg5wC6X2FwTx2J26We
TLSH
T1B842A56EAE11253B6CDBD31AF922B72BD6F2103175D42E84E6FC892C15E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a3f95e1303fdc48df8797d296660c1ac7d3a5770422649a3ae7e68a8139659b6
MD5 88d292e92bbe32265ed9f617c3a2eb9a
SHA1 c4e065425d796a4f1939a5ad435c9cf7d29ebd9b
SHA512 819c8a097953f1b9c06afce787ca64c7364c82c6aaa621c78d18703ce1e57ab112cd9821fc249c77cac00d83c492f613758357d415d4fae05952389862c02659
SSDEEP 192:TRDUHZ0v72vwPRpy/3Z9THsb+WNnuKF99EDt26SsnVyIsnAUgE:TRDU5wCqXYFwT9EJ26xE
TLSH
T1CE52C76BA911297B6CDBD31AF922B727E7F1103175D02E84E6FC8A2C11E75CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 234ce5e7adbf888ebbbbafa604720c4ff4bae5f87fa4bc3099606082ca62a632
MD5 4a64da3e38f7a81ad83e7503bc0e1fd3
SHA1 8f4c4b3729bb75d32e1a24972cfc4e79ddb0227a
SHA512 4ceb0100ce32d92954438c367f255692df7a4138114ec7fabf91cc058e2d2fe159884f7b0f3c025a38bec35770f9911ac9f5fa5112953e9a6b6f2ca0716b9db6
SSDEEP 192:TRDUHZ0v72vAPRp2/3Z9THsb+WNnuKFqOeZt26SsNVyIsnAUgE:TRDU5wC6XkFwTRe/26rE
TLSH
T13642B76BA911257B6CDAD31AF922B727E7F2103175D42E84E6FC8A2C11E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cf4316a8c82c947a2690cef58ea6371946c49ee313bb6f30a44d8da25159cb5a
MD5 38ed9bdca09a8021b243c8abcfa081c9
SHA1 950637c26262a091c7ceec0ee09e44faefaa3594
SHA512 9ddeb5ff07f9ac5b2a4d9b7e3b9cb1ef1f78a7ae876d3e9918a85be2077a96ef13c4c1208c800b1af3a144b6393c4df11a833af6261647fa9b21ca22b75910f6
SSDEEP 192:TRBdUHZ0v72vAPRp2/3Z9THsb+WNnuKFtl2Dt26SsOVyIsnAUge:TRBdU5wC6XkFwTx2J26We
TLSH
T1AC42A62BAA11253B6CDBD31AF962B72BD7F2103175D42E84E6FC892C15E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 6fae25f212fcfceaee341e86709c97eed9d6f16c5dd67ad0f67e5322356f086a
MD5 9f6e6f63b9d8b7f952f52b8aeb4f789c
SHA1 8addfe31f4608bfb6e48041f9ae25dccbcf6ca11
SHA512 478322100550765dfc785e0e5cc58ff9d6b4c223e2338bc280c543d7962ffb419b4eff141eef4e7e9895506fde0fc1d767df7fbf7359cba8b71c41b6903c5298
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3lVHGwIB3WhmiKoUZ:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHO
TLSH
T14352E967688D963F0FD8D68CDC17BF4FADB1015666640C2897FA5C08039A7CB115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7d904fdd07a033fa1ad83de512a0c750edfa37d9cb23053643842c7be077a419
MD5 d9bcbc78dfeb1fdc724d5b3b74f619b5
SHA1 6732aba9366de48dcc7f0f9b76eee00a52b7c1ed
SHA512 f88036c3f5057608ea7f6264929348da2290c9ace6fc8562c0b936db51143b4a383b93acd61a6919def4013effe78851ac72b3f548eb62f8f588ee32bc1d512b
TLSH
T1BDB01200C0665720C841C1B01B0B208933904E27C900020283D0F9A6A8430E01238241
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 facb096decc50d6f2397480f5b419cee383e36c51fd4e89e8131afb0f3e71608
MD5 b18678fe4c51b66d78792adf15aa835d
SHA1 7da363b2250f5af30e45b1ec44382efb6ed53fb3
SHA512 1d8c9a30a3861a6bd96090cd459ec9a50009d40d5a8c65bd2180a9b84eb5185084005c9957e1eb99f124fe39d261dffdb064c432c5cad1c450ebdb54cde564a3
TLSH
T1B5A00215D1C00825ED4142F4ACF399816A5648951D51470764A215489AAB1C08111640
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1df47a040a35697b31ee2cff1c971ab1ea51b9fb1493e18f71cb1474c5a977bd
MD5 36cad28e8f86ce3d61616333aa332c10
SHA1 02d69feea131ed0ab933633f949a2e55f1370c2d
SHA512 bc5bc0a671b417eb3fa1b9ad3338ede3872215d107f1481d74e430bbd2ce8b270a0b87a8ec4118dc299180db891bbd2bc2b48b59fdee564e53e5fbb589c9f79b
SSDEEP 6144:Ypbps0VcSJggqIRou6m7Rkm1tYpBeh2BAof:obdVTJgDIR3V9oBGcAof
TLSH
T1A43412769EF0EC725DB09A5BE8CA071F0DB6A5A3CD1DCE95D4E92B0462CE5C90709838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a5da48e1febf847becddbf96f7781cbd4a4910807fce44b08d2b1cbf802e6966
MD5 62dd5b66937968f89b43a7276bf6f5f9
SHA1 6c98d87c6bed0f21818b871af03badded13df118
SHA512 0986ea14fa877d3b797934c56fae3b6bfa0871a22fb86992b6b4aa9efa2a426ecc22e26639cce3914cfae540c89396a0df1b3225cf51a289267eeb4f07df5f20
SSDEEP 3072:jGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:am7Rkm1tYpBeh2BAom
TLSH
T115C3123B5E71E9375979A74EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 a31d50dea0e0bdb4694d7b709c38d77b4c4dfcf6133b55c7e18d06eb939758c3
MD5 fdb72f9f71f0e98f08c5ac7f0d233c0e
SHA1 7dd03840678ad8da243a07327be6f327c4b9a481
SHA512 5674cd2facfcfa003613b4fa7deb033f69a80611757137324367cc09e4e1ce1737623942b9915ee3defe112de70ae1f7d3f6648ab584c47efa417b5f6724e449
SSDEEP 6144:wObps0VcSJggqIRou6m7Rkm1tYpBeh2BAof:xbdVTJgDIR3V9oBGcAof
TLSH
T1DC3412769EF0EC725DB05A6BECCA1B1F0D769593CD1DCE91D4EA2B1422CF6D90208839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 59b24703beaccff984ffb7da6bf41aa599fdff81f3fbcb304677d9b6933721ec
MD5 172429ba8c4a30a43edb3ea28443daa0
SHA1 13391d793057479e617f682e40eb45a234d40d1b
SHA512 99b8dbf9d6706d0d33eb7486ad473febea301870f41e7f9225149aec04982b6aa838758a68cf6ff8397fa8f267a574abbbf6fed4e7ff2525ffef3708093072a4
SSDEEP 6144:dObps0VcSJggqIRou6m7Rkm1tYpBeh2BAof:EbdVTJgDIR3V9oBGcAof
TLSH
T1393412769EF0EC725DB05A6BECCA1B1F0D769593CD1DCE91D4E92B1422CF6DA0208839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 cbe1f7138f6aad159df1bf30f40d9c54ccc98b6d50d02b21c9ec35e556ca39e1
MD5 1f3e35a87f66320343ac9f5f4b948610
SHA1 5351787803d3fa17d137f2954d24e712847760bf
SHA512 86a81727fd11350a3ce791bac311d621dbfbafb1b3c9ca5021152cbe38e675222c784cd840a2e712a80b3ab7a42c43eba78e103672777f2dc8d8517a297210ca
SSDEEP 6144:oObps0VcSJggqIRou6m7Rkm1tYpBeh2BAof:JbdVTJgDIR3V9oBGcAof
TLSH
T1863412769EF0EC725DB05A6BECCA1B1F0D769593CD1DCE91D4E92B1422CF5D90208839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 25ef77b5753c0e01a7432d8ee6a37e6c07fc8506f5990fa6814c8fd5773d9712
MD5 89f59082710b6fd63bc95daa84420d55
SHA1 8febfdc41fd02284cfefd234095532d760ac50f1
SHA512 ead97faa5ce85d90a52ceaf7938e327d7e0812d6628dbf2fb49852b58fbed7631c29b4e7cba6cbf6a4509720b97839ffe60c5a039bc99233bee9a281befe2269
SSDEEP 3072:j3lfd4FnKM/EuE92Ld+nBg3hpBG58OS2lTt9m:pfCAM81m+nShpBQ8OSGtc
TLSH
T1C3A3AFF6CF928D3D64FFD0296F82893FF9262404B3A72008C923671165C6F786779A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81f020bf-f740-48b8-9d2e-5cec89f7eacf.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5296_907066168\81f020bf-f740-48b8-9d2e-5cec89f7eacf.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5296_907066168\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1751ce24b1320b2463a209df5096440d1978c24c77a968e91bd53cbf67365d83
MD5 cc8135d79c62afe10b8bbf36498ec950
SHA1 b01fe780313581f01e364966ab3224d1ec0f2433
SHA512 db84bf201fe2cbcd829338551c20eaad7ddd83aad7009673a77c979ad57b3868207b1ca9422c9da37429955ce99a86c324392793acb736f6e186ffa5cfaaecb5
SSDEEP 192:DCnrg1d66JozGzgCl6mc0dQOv5zboAQZbWyjOMN:ld66JozGzgC1jBboJZbWyjR
TLSH
T103E11D64E6288A3FC404027BCCA61F814F39389A984E7F1535DC65482D5B2DE7A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9635b78614a2abb89fb175c42652bcae4fe8f001e74d08bcafe7396032f0ba74
MD5 b4cf2eb1053c398365251751b3b939f9
SHA1 107aaf6e555d5983a31ad3d0695f7796a422f226
SHA512 aaf624c9f013f76f994f81637dfa40f3b52231b202f5377a4d3fd41b8b0b2f92c871c8b9ca326e7b9160d85c3bca87b767e7e3ac53f182acd0933ba0b4a31f33
SSDEEP 192:ROv5zbowbbWyjOMuCnrg1d66JozGzgCl6mc0d:ObowbbWyjqd66JozGzgC1j
TLSH
T1E6D10B64E6288A3FC404137BCCA21F814F3A399B984E7F1535DC65482D5A2DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e363d2ec2858a90ce3fbd213879458127799f8cd3afc7ce9f9b819d1e8a81690
MD5 3960629fdb74a14cd698a1e3a6fae7e5
SHA1 5e0559fab6254b17416fbc76fafcd871b0fea4fd
SHA512 be83a8c239aff11fd0d12fcba99c6faa60b56a4f7b69ab854ea7dc2bd2de7f94e256a80582184ce504a751c15fa58a5186b767538b1fc8f52c86bdc05aaf64fe
TLSH
T116213D9C3AB94D7B59C7E36CB44102CE93958E4608471E430D02EF8DCE91ADD316D47C
MD5 SHA1 SHA512 TLSH

Submit Download

5a48af2f-9fda-4775-b9b3-0974c2a9aedd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\5a48af2f-9fda-4775-b9b3-0974c2a9aedd
Size 2KB
SHA256 0efb5bf9c8c4087502501ff6d97e042347da4ca4f4e56af107c560c68098ae77
MD5 234f0c74f7b32f77279d9bcc81348900
SHA1 b73c37289f629794204b8b854e9f2ef96f77e533
SHA512 83db1613184e06cabb8c095c042d8a4efb64bcab0e74bf34d3e0756942c8001c7bf5ac028ad0916c25a241c8c7d246e74ee354dff9e33f95c789875a75277f5c
TLSH
T18C41565C76785CF68CDAE18DD4D2338E53A08E0300C52CC32D91DE4C8C9669D237A46A
MD5 SHA1 SHA512 TLSH

Submit Download

95558abe-1ae2-4383-a137-0bb4a0ca85aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\95558abe-1ae2-4383-a137-0bb4a0ca85aa
Size 235B
SHA256 7e6471cde5ab97476e54d5185ae480dd44cf6c23c6dce3905f72e3147fea9fa9
MD5 dcb925e0129689289d47aa538ff67a4c
SHA1 fc7b6fb06ac59d785413e72de0e6e392576d8735
SHA512 309bd7b46947c69b21a2d52eefa138c9d54ed72aa87aeb32238dd2a6525dffebdafb69b97d35bb1ab5663e89a7ceaae428783b93b789505eade47e47e38e75e6
TLSH
T128D097812888632E48104F12B0A0A8CE70484C331172A820EAA50434AAB8EC56132A1B
MD5 SHA1 SHA512 TLSH

Submit Download

acee4778-679b-4fb0-ad47-ac0c16d4bf79

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\acee4778-679b-4fb0-ad47-ac0c16d4bf79
Size 15KB
SHA256 311cf19e0add6aba04bc74ff4d12178443372822ef35ac3893a87bf29de4d203
MD5 cda9f9aa2ae7487a88fa0667c768dbfa
SHA1 a0524def28c73902311b93f06b26678c2253e742
SHA512 aba723b4950f4b95d1cc234a681b68b3cefeca311e13f446bc84b0c5efabc52fa3c0250f653654d65bb19cacf48f48d22e42fc36a92f0cd2a1c49e83ebfb2a9f
SSDEEP 384:dP1AYrGP+zRQ17icRl4/HFriTBi3vd63I+PZ8:d9Ry+JcTed6fx8
TLSH
T14372B7162830497A8651E36998FCBFC7E1F528CF4C419FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6a04d4a-69da-49e1-9145-a1046a849f78

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\b6a04d4a-69da-49e1-9145-a1046a849f78
Size 883B
SHA256 ffd80774bf1e388480a6296fd81f74debcd1334052596b5a2464fb4ea3cf87de
MD5 7adc60ad45fb344975691c58f28282ea
SHA1 651358c65eb235203fc6a213c5b9943840af9084
SHA512 089b7beaa3051a71832963dd1f93952a1d2bafb71898b7f2d3124812aef2737256edac97fd99263723013e09a103f26e0da2008c43125551cdcca8ab392dc973
TLSH
T1D6110041F634B9F2CC78924BC9A137528FF8742380CA54143ED14E040C3AA2DA77674B
MD5 SHA1 SHA512 TLSH

Submit Download

bf75f72e-a4a3-44f6-a154-beb602694beb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\bf75f72e-a4a3-44f6-a154-beb602694beb
Size 886B
SHA256 c2bd802c9a27f2e2e04135173d912a3200a69b703c1ecf16bc6d91d742a3ff4c
MD5 2775b0be7d8e14f7b73ce68deba9d1a0
SHA1 fa0835170df48875fd31b293443210f5b794ee2e
SHA512 3ead5f01d3ea6363ed0b793815c80ff4e597bc6e46a55ea55ba85b379694e5c9f3fb97348477baabc630b155d4a2945780cbacbbbb7d5ecd7277538e1df16731
TLSH
T1171104419634B9B2CC78924BD4E1775287E8702380C619147E904A080DBF56EA77A707
MD5 SHA1 SHA512 TLSH

Submit Download

fa0febc3-c816-46c8-a540-c46e5347483f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\fa0febc3-c816-46c8-a540-c46e5347483f
Size 235B
SHA256 2e6227a9f3db3820ccadbb29b2f54dc98261e80a94ec63b4fabe478b2246e294
MD5 33da675110fbc865ffc89509234d3f47
SHA1 62ee419774f7b580b397c77cced5f45221504741
SHA512 787d7f8391d9252223fe27880725cbb70a570de2b20345546fbb03b6b7308357a2b11335292d50f91a09678b93fa2ce851692798874735281db79583803365be
TLSH
T128D0979064886B9C4E000F07B0A169D230858C3320A46C60C95205388AFEBC95271847
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 6KB
SHA256 35ff2a33b382d8d4a3ebbf11e6302d2aba79d0bfd0683daf76704d1ddddce39c
MD5 6a102714b6a775d1c8b29b53439dd1ea
SHA1 66a13bb492651b81f33b0113732a6d5e0ffa0670
SHA512 2086f75f2870801a5797e9cee09d36147e3117005224cb199a476cf5e9f522e3c1ff194b21a8eabea447cf5aecddee2c2a37a2cce265163772048ec8d08f2c91
SSDEEP 96:xHHUTUZfvqGqqkf+hE1zSuKSSlDdv9janLHH4/39Bw88n8L4cn/MVzW:9QRFf+hE3KSSQH4/39Bw889g
TLSH
T186E12F7891088F7F64B677ACAC688D716A72013BB7BF68D350B55484050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 14a17361ff81548cd286985578b2b4de3f7051286ab015ce8bc00c8fbedaa8bb
MD5 4988bdd9d83bf772adbb34cdd0fdf598
SHA1 e2084738e449b407a631d0fc3f4e8c657ba0e6ec
SHA512 f595c6a38b817d63c884eb6b6a68e63fbd06b3b63e4c0d938b7e9479d685f565595c261c2e49a3269bfe3f6c47492fa5e73ddca9790ddabcb91efd0ccfd1da88
SSDEEP 96:xHHUTUZfvqGqqkf+3nKF1zS7aESSlDdv9jTjinLHH4/39Bw88n8L4cn/MVzW:9QRFf+3KFMSSdj2H4/39Bw889g
TLSH
T1C8E12E789108CFBF64B677ACAC6889316AB2013BB7BF28D750B55484050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 26bf917e6d5b53b0eab7c34b56be5765ead05e50792ea2da81869c0e1e01f621
MD5 4a37ff040010dcf0d90f61508f87721d
SHA1 3ef52f11d172ab9d0a686ebb80278e3d878fca78
SHA512 bdee934487fe311fec9b3400933af132cb49ad196c03ad7ee36fb4470f669b8f6d6b628ba59fa6c72147ede434b1473eeef910466e417592b562968a3044875d
SSDEEP 49152:37snfswyaP6ryMtvJd5C9S8ARzMUghuRPbPxYUpq:rqfs7aP6ryMtvJBRzMUghuxq
TLSH
T11E1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hrpxbp.exe

Path C:\Users\Admin\Downloads\hrpxbp.exe
Size 7.2MB
SHA256 8de080f3e99dc52ebcd862d643724eb29788d1cd8ea8ec0741f32b6c069780b8
MD5 f93821f2444d218d60ccc8e8236ce34a
SHA1 822fd9d95ae5fab684598c82c803e6a2abec2e5b
SHA512 a81daef755144e2a485d78b0c00e69eb1f3668661b008456715e2cbb7e90887764cf0c93bea89f35c95b7f6891972808e996a62ecec2b11ff667b8c4bc91439b
SSDEEP 98304:uoJhEPO306zsuYE+8ptinHgyACLuTVnLfM4Ec5Ilfmg:vK/6zz9aAy/C1Loc5Ilfmg
TLSH
T1DF767C43F85569E8C6EDD23086358252BA707C890B3077D32B61F3B92B73BD89A79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1544-1-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/1544-2-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/1544-3-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/1544-0-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/1544-7-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/1544-4-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/1544-5-0x0000000140000000-0x0000000141A2A000-memory.dmp

Download

memory/4956-17-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-10-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-9-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-8-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-20-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-19-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-18-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-16-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-15-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download

memory/4956-14-0x000001D6403B0000-0x000001D6403B1000-memory.dmp

Download