ec10a1317152aa57d76eec8cb3e1e7dc7f52e45c7a5d742c0baa1e394496ec20

Analysis

user interaction
yes
max time kernel
1739s
max time network
1702s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeluxeMenus-1.14.1-Release.jar
Size 3.9MB
Sample260710-d5ep2ady7x
SHA256 ec10a1317152aa57d76eec8cb3e1e7dc7f52e45c7a5d742c0baa1e394496ec20
MD5 cd50b1ffbac63a4b50c74607af74828c
SHA1 a7ae9ad69aa47bbeb3e42444d5823a0eca885f16
SHA512 c6f01e85ee5b96bba4e65571db133c45fbf157baec4160ecc83eb9f744cbc914e31079bb70cecd9b64fa329564b2e8c842e43c9976a365a54ccc5eb719ff8b65
SSDEEP 98304:UthO2c+fUssk9IhuTRY32Sf6VvtVdiAK8:k9LfcMI7f2tmAK8
TLSH
T15C16C01665CB3A3FF66B61702DA11463EA3E55EBB10B80D120F41EF864A6C852EDF74C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4308	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2292	4744	chrome.exe	88
PID 4744 wrote to memory of 2756	4744	chrome.exe	89
PID 4744 wrote to memory of 2756	4744	chrome.exe	89
PID 4744 wrote to memory of 4308	4744	chrome.exe	90
PID 4744 wrote to memory of 4752	4744	chrome.exe	92
PID 4744 wrote to memory of 4752	4744	chrome.exe	92
PID 4744 wrote to memory of 5708	4744	chrome.exe	93
PID 4744 wrote to memory of 5708	4744	chrome.exe	93
PID 4744 wrote to memory of 5156	4744	chrome.exe	94
PID 4744 wrote to memory of 5156	4744	chrome.exe	94
PID 4744 wrote to memory of 756	4744	chrome.exe	95
PID 4744 wrote to memory of 756	4744	chrome.exe	95
PID 4744 wrote to memory of 4412	4744	chrome.exe	96
PID 4744 wrote to memory of 4412	4744	chrome.exe	96
PID 4744 wrote to memory of 2916	4744	chrome.exe	97
PID 4744 wrote to memory of 2464	4744	chrome.exe	98
PID 4744 wrote to memory of 2464	4744	chrome.exe	98
PID 4744 wrote to memory of 5944	4744	chrome.exe	99
PID 4744 wrote to memory of 5944	4744	chrome.exe	99
PID 4744 wrote to memory of 720	4744	chrome.exe	104
PID 4744 wrote to memory of 3672	4744	chrome.exe	103
PID 4744 wrote to memory of 720	4744	chrome.exe	104
PID 4744 wrote to memory of 3672	4744	chrome.exe	103
PID 4744 wrote to memory of 2352	4744	chrome.exe	105
PID 4744 wrote to memory of 2352	4744	chrome.exe	105
PID 4744 wrote to memory of 3892	4744	chrome.exe	106
PID 4744 wrote to memory of 3892	4744	chrome.exe	106
PID 4744 wrote to memory of 3876	4744	chrome.exe	108
PID 4744 wrote to memory of 1528	4744	chrome.exe	107
PID 4744 wrote to memory of 5848	4744	chrome.exe	109
PID 4744 wrote to memory of 3876	4744	chrome.exe	108
PID 4744 wrote to memory of 1528	4744	chrome.exe	107
PID 4744 wrote to memory of 5848	4744	chrome.exe	109
PID 4744 wrote to memory of 5796	4744	chrome.exe	110
PID 4744 wrote to memory of 3020	4744	chrome.exe	111
PID 4744 wrote to memory of 5796	4744	chrome.exe	110
PID 4744 wrote to memory of 3020	4744	chrome.exe	111
PID 4744 wrote to memory of 4692	4744	chrome.exe	113
PID 4744 wrote to memory of 924	4744	chrome.exe	112
PID 4744 wrote to memory of 4692	4744	chrome.exe	113
PID 4744 wrote to memory of 924	4744	chrome.exe	112
PID 4744 wrote to memory of 700	4744	chrome.exe	114
PID 4744 wrote to memory of 5488	4744	chrome.exe	115
PID 4744 wrote to memory of 1264	4744	chrome.exe	116
PID 4744 wrote to memory of 3688	4744	chrome.exe	117
PID 4744 wrote to memory of 3688	4744	chrome.exe	117
PID 4744 wrote to memory of 2272	4744	chrome.exe	118
PID 4744 wrote to memory of 5080	4744	chrome.exe	119
PID 4744 wrote to memory of 5080	4744	chrome.exe	119
PID 4744 wrote to memory of 4492	4744	chrome.exe	120
PID 4744 wrote to memory of 4492	4744	chrome.exe	120

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DeluxeMenus-1.14.1-Release.jar
1⤵
PID:4064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x9c,0x134,0x7ffe5216c728,0x7ffe5216c734,0x7ffe5216c740
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,6837494174862739455,2944088646589942850,262144 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,13349241977503932047,11399847744538068528,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,10774804813597343230,17867046666467092653,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:13
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,11725552108198631407,14361635699868082236,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,4891199020531547044,18111586792379813788,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,3824075723352310367,643558345576242549,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,3498296836574435865,5482560387027840867,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,11949731528762981794,1337112782184668164,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,18388710136462664234,14202868293421498911,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5508,i,909861097539238034,9968523219020386042,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,2380071102560243268,1138877412413031462,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5856,i,16901572766575649046,16965140691479341336,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,4656081304254820992,6170802633036948262,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6252,i,13122022604504400133,3759860273064122480,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6376,i,10401319344749725224,13633487399067247536,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,11953236786955483234,9202050293703846128,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5804,i,4575458028116405912,8756779267518760992,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6380,i,12692626401406417779,9237684001413194961,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,13168099258410691135,9364110751025791592,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4776,i,16878267663638539866,8828709015090617731,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:9
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5788,i,568904233449689174,7509050542992055477,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,10426442424659709741,9609205072801087515,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,7243954962804191305,8104535610030202954,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,11400802270849978179,5205910646847343997,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5644,i,3408689685654515298,11686513354195962515,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1192,i,6301611625309959777,8344059797412864284,262144 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3712,i,14103455585859169889,6059762079250829146,2097152 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3664,i,8259147639466906382,60998633843546493,524288 --field-trial-handle=1920,i,17887268283555203721,6656790027552497500,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
  2⤵
  PID:4492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4152

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 5ba73d15f96186f35d774edad9ac214246d5f0660e39dc4fb48dbd4d76a53a22
MD5 76cf35a1d74803f671be6f727a682bc4
SHA1 484108649b0413c888c3be8d15589442a0e70fcd
SHA512 40beca095888ab220d4b8ca58306b81843b22a4d39796847c795fcb2e966626ebc059a8b0fc5d6af4789ff7338d4cfbe35aeb6d6004f2be310b700234ddb632a
TLSH
T1C9E0C22C16AA121ADF75D13DA4F58CD0CC52FD640BA21B227CCABACE05135F755C0C46
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c55595802e045556bd154b10eaba1dfa217eed382b354faffe782e7928f6585e
MD5 3d8e4e6c0196294bc469e0d82811d38d
SHA1 c7ed4141b22ef8831d1ccdb2a7a186999de82f6b
SHA512 7f2d4be50f64b5276f6fc60bc8d8b53e07ac982fc4e2b0f9320d0503742c7cdf8e2ae0107cd8a0f8b00cb7231bd3d9c3825bdfb65c9a19f450a322518c5dfc01
SSDEEP 96:Dx8H9VxDSJlaAgCxqI4jh1Z/+haPCdrbLfPsNPUE:Dx8H9VxDSJlaAgCxqI4jh1Z/MaPCdvLI
TLSH
T16CC18CF7C3D8862DC95156F89B257F1FCD2A0A28422C3C26C8D8BF5B93E2471D25525E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e04485d6c49fa35b100dd6c607faca09808f553fee1b792c83c1993988258d0c
MD5 17acbe84b92a86a623236531d380fdef
SHA1 d9f4f01dbf41e0d9650bfd4cb10359307003c06b
SHA512 a1068aa39a500d4689c8338f58bba0800c1ecf172057d8d6416d1cd587f45d554aa9c84b8cafff05edb65376a5f54152e64baa004d40fe77c50cfe6d1add33b9
SSDEEP 96:D0ujtlxJJ5JxxAgCEdUjh1uZ+haPidrbqfPiNPiNUqK:D0ujtlxJJ5JxxAgCEdUjh1uZMaPidvqE
TLSH
T15EB19BF7C3E4862DC91156F89B15AF1FCE290A28032C3C7688D4BE1B93E2472E25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 20271092aa4f7f7f217bee6bff6f0eef632149612d21778ddf26d4814a88667b
MD5 06eadfd1e2a0cc1c0bc90ca791794f9e
SHA1 fdd1075b78d8e06f496ac434d67a2e316536951f
SHA512 132696b9f9a12c3655d7fced6edb97130df551253556a0b4f2747b829f40f7fb1183c78308280dea78c4f31d5975165e94f21dd464cc10ed09f0a3e0a7270746
TLSH
T17D519BB3C3D49A7DC51152F89B217E1FCD690A15121C3C66C8D8EF1B53E2972E20029F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 076c6f1fdfd20a5facfd88312e3f8a5fcd1f087a3c38788e2fbf837e35062024
MD5 51bf78726ea8cd5fd7e53d90c67e096d
SHA1 4bb209c521b9f8a7a8873d66d5331f21271827c2
SHA512 bce03d0376363fe26ba8130020e687bd24a57eba3707af9c647593b1453f6c534370f785a4a6f57701907f90002f60b03b7c35200f75559029d56bbde1662cd3
SSDEEP 96:D0um9VxDSJlJwAgCEdUjh1Z/+haPCdrbLfPsNPi5cE:D0um9VxDSJlJwAgCEdUjh1Z/MaPCdvLl
TLSH
T17CC18EF7C3D8C62DC95156F89B256F1FCD2A0A28032C3C66C8D4BE5B93E2472D25525E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5ab8e428380acae911d50efde6c963c4d634896969306dd7d01c1151ccd507db
MD5 e8c1b1398c30f0b8e07837de6776c324
SHA1 8ef196e6c58f808a3b3f4ce75220d9bb63aecbdf
SHA512 62703afe57f6a82b9cbf43550d10d3cadeadfdd3b639e1d11765aa52603f7d17dd338a1bd88c560e33139df977a70d4499ff57f90bf15a1e43af81c1bed55c4e
SSDEEP 96:D0umjtlxJJ5JwAgCEdUjh1uZ+haPidrbqfPiNPijiK:D0umjtlxJJ5JwAgCEdUjh1uZMaPidvqx
TLSH
T133B18AF7C3E4862DC91156F89B15AF1FCE290A28032C3C7288D4BE1B93E2472E25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6fb3d752c4b3175cf1454498f91a52886560e4ad5d650efb0b0768f4154d0ac8
MD5 b817b76c7392767749b4a8d163896904
SHA1 80138187199090b1e9010d09510bc4b0ce4ec3ee
SHA512 d224d4eafc85112cc151d6c3b3854ecdcd5f34926183af94b869fcbc8847242015eac3445af069d5c5ee9f8590ea2c7bf1c0577f6d3c4a42d0d9b3314f31c565
SSDEEP 192:Dx8H9VxDSJlaAgCxqUjh1Z/MaPCdvLfPsNPZBcE:Dx8H9VxDSJlaAgCxqUfZ/Ma6dTfENBBJ
TLSH
T14DD18DF7C3D8862DC85156F89B256F1FCD2A0A28422C3C27C8D8BF5B93E2471D25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e4d385985799f400ced7e757446ae247a21b3bb404b899570527d3e9a2aeeb32
MD5 21aba639db116aacb692073d6c29eae1
SHA1 df55468f91120d3c7b1435eef267fb6258a560f9
SHA512 03740f784f8800d6f1fa5f0ffdccb1a81b1a8513ee4c66728a4ac6a5ff870a349d021546a2251ec2f398e5d87889393fa751c44ab82d5387ffe857c6a61dc88a
TLSH
T1D4F059A7B6BD7473407A05AF5E047C056CB6B4320641A8F5CF5A936D90866F71B02433
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c794d4690b463a989f3386b50adb536ea70a5a5dd5ed3e26295634cf3577522b
MD5 09c02fc0c572b86206c85016f78f2c32
SHA1 a1f423dcad58cc5a365bd9bd5b09dedc882e96d6
SHA512 3873d9c4d5a5dee5ab90927e1db3b901fe1eb9fd318c9859ed3f79b936eba2dfbeb751a0de83c3cb7c7e433f361224c298dbedb60197f492954b6d964195f0c7
SSDEEP 192:pROcBzj9Hdv7DdPRpDY0O9rHsb+WNnucLn9EUimF8yIsnAUgE:pROmzjpdVXs5wZ5EVmSE
TLSH
T12642961FA911797B6DDBD229F92177A7E3F5102125E02E84E7FC8A2C15DB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 65ffee7d13206bfea871b527c36285db5ea499edd1b634caf225866efc015e8a
MD5 8aeaa88066af06024a02fe1b1a86386c
SHA1 e94eb2ecd25eeb2032cda393e1588480c3a88f29
SHA512 f2dc99d570783c05623435a2d6c1035732334a5c1e564b6157a013011b71c26732f0fb7e97f6ba5ee5fc14e69e9bb2387143fa15af1e73d41276e22f8bd29c51
SSDEEP 192:pR2jY9Av7DAPRp2b9rHsb+WNnVaUWYmFVyIsnAUge:pR2jqcSXw5wEUjmze
TLSH
T18222942EAA1579BB6DDBD229F9257793E3F5102121E03E84E7FC8A2C14DB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fe8c08b12f83dbb43f0faeb2d6a730cf2849f2c091c68ef7c037608ae586848b
MD5 b04a994d9fe70a61b8805545d77e41de
SHA1 4d9293d6acd51423fda384ee13f5f32af8a26a3c
SHA512 5c4605f935b94fa7c592ee7ecff1982f19cb47937afb280f5d0f61d6a97c792b57e69d8dd14d7047cf5d49336570caecaeaca00ff7fb9f8d3def3dae0a2ed166
SSDEEP 192:pR2j9HGv7DdPRpDb9rHsb+WNnVaUyimFVyIsnAUgE:pR2jpyVXf5wEUvmzE
TLSH
T13132A61EA911797B6DDBD229F9257B93E3F5103126E02E84E7FC8A2C15DB5CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 13bbcd8100fb68fa8e65d181657b1bea4599ddb7210bae8687ec5c437002761f
MD5 48a224c9e98f0e28c35806a3cb7d5ef8
SHA1 1d5cb7e582d594ee4a8fccc1c6ca7bcf505ec165
SHA512 2d9ffd145c11fe64155531055b3a98047b3ebc45235dd2957c2ff088c4107d4790c3f6f420edc6f6c9826323f4870145dc0a9ab709af458bef0c88839c965244
SSDEEP 192:pROcBzj9HLv7DdPRpDY0O9rHsb+WNnucLQm2HimFVyIsnAUgE:pROmzjpzVXs5wZt2CmzE
TLSH
T10642951FA911797B6DDBD229F9217BA3E3F5102266E02E84E7FC8A2C15D75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6b844c45fbff9a09ca3743346aac4e015ad43c233360b02805bc6b34ae35eeb7
MD5 a33e664c8cc0ae370191ff4192db3b33
SHA1 eaa7479f88c464747591cb4fc09630f5023a76d0
SHA512 9719ba61e971b9ebac765139c174f72a3bd260cf129eeaec81d3b06c40ab9ee992e8bb029553b48194ee76784c22d5d2beeea7a6750592a1ba7a331e389c865f
SSDEEP 192:pR2jYDGv7DAPRp2b9rHsb+WNnVaUWYmFVyIsnAUge:pR2jmySXw5wEUjmze
TLSH
T17222A52EAA2579BB6DCBD229F9257793E3F5102121E03E84E7FC8A2C15D75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2efbe4f98da47ebaf25ed55884304da9284b4fefbea8ebcdbd8f6e9d0ccdbe46
MD5 17c63efef5dbc2aa4e684e885c4c3119
SHA1 7e6574cc2a914751cdc141be825452297ba4b6fd
SHA512 f327c1f7b2e55e9510dafacd03bf9134f918cb3f651aeae04a8c89f8dddb5ba8dfe90ee9d2f8654235e1b96bbc18cdf3582349d9205ccfce5b63b9e43f1af03a
SSDEEP 192:pR2jY0Lv7DdPRpDb9rHsb+WNnVaUyimFVyIsnAUgE:pR2jtzVXf5wEUvmzE
TLSH
T16E32B61EA911797B6DDBD229F9257B93E3F5103126E02E84E7FC8A2C15EB5CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 65f4b2e0bbaf652c0949d38eba6d9f958d519bc5085e7627fd40cac21e6bd50b
MD5 543857d710459f751e41a7e85423161b
SHA1 ac1c871a3e8f70179b5d3f593c20bf5fcab42acb
SHA512 9a93efbf6a0be20679a8b163bed6d1ffc8a609d0e821e34523b93ec04dd7c21fefef5ecb80a388f4c7120e7fa7f1c12684b6f1c27bdca641cf651c01e8dfeb6a
SSDEEP 192:pR2jYSgv7DAPRp2b9rHsb+WNnVaU0emFVyIsnAUgE:pR2jX8SXw5wEU3mzE
TLSH
T16332A62EA91579BB6DDBD229F9217793E3F5102125E02E84E7FC8A2C15E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 c1f8c35ec5840aaba22c52d1b72792303f5bb1fefa96d4fa5bdd43a92c5362b2
MD5 2b0b548d12d72939c9c72853bcc0a4e6
SHA1 d5c0538fbe32aa6aabf64a7ac323816570b57e43
SHA512 8df9d83105b4b30487f58af3336b4c0a82289f2d32d6df5f90841bc9059c46b6c81cefa38abef44c4b0b4087104d792352d47480d67e3bf46090886a33d67431
SSDEEP 192:pR2jYGkgv7DAPRp2b9rHsb+WNnVaU0emFVyIsnAUgE:pR2jzk8SXw5wEU3mzE
TLSH
T16832A62EA91579BB6DDBD229F9217793E3F5102121E02E84E7FC8A2C15E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 62c185a84639a9787494e9c9ac841ba30ce42be94f462c0f4afe68805a45662d
MD5 0d1bebec42dceb46ff3a354e1e6994fc
SHA1 d7293843f44e741785bfb2d30b76b4828224aa23
SHA512 6b75795a8d2914003f3efb0996d76ed38672d1f089ce14ac7e682c6695d4a74877619a38fdc6f9ba479473f24bd1b935dda3a6e0258af4469d5f742d452ba1ef
SSDEEP 192:pROcBzj9H4v7DdPRpDY0O9rHEDHsb+WNnucLm0glimF8yIsnAUgE:pROmzjpkVXsGrwZ5gUmSE
TLSH
T1D742951FA911797B6DDBD22DF92177A6E3F5102126E02E84E7FC8A2C15E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 487c4f6037675156396a77cf0c9de1a80b3e1fd81ee4d93d73dff0a71452ae6f
MD5 f8cd84b4556efde705597f68feb372ce
SHA1 b98305633cbbf785b4fa4254cacbe3d369cb8a5d
SHA512 b9d34111cfb8a21d3caebf05e963a287df2a38143cf13a1169f7671ae0c3f9ff67298a9dc03d0bfa6549b0d3400a671f65ce1fed1a9f9286b279a0e55c5e1614
SSDEEP 384:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsXODzi+ErU3NyHGm2ZxT2:vVzm7KxkXqKf/pUZNCgVLH2Hfgsr+OXk
TLSH
T10B520967644D9A7B0FD8D65CDC12BF8FADB5015662A40D2453FB9C0903E57CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 d933006d4ba771071c02b30962aa73e9c85318978f1fe56b20013461a0c99c12
MD5 28148fb199f16514906e6ae0cb4d8e6c
SHA1 4103fcf7b3988657822375bd30a5ff1bf6fe91cd
SHA512 d80e119a8e5a3c44d6dccc66d86f59fbac8493424f5016bb09c4a0d7806f9c84db846c83ba55f7cea3d796a5fa3b1189711f9b166e54a503aebe90c1382d6340
TLSH
T14EA0023015D24C01D85803F063C202C16F3068140306F347D1D0505C8C631828241B50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 31cc3ce593b6fc3dca18e5ee3b13ca43e2e9fa9de2dcc54f8870551daf5cdf49
MD5 653227656cc641ebd365ea296c187539
SHA1 90f4d06c65ecc4f19ae15ee1054bc5692bdcd0ea
SHA512 b98be3ab9dc43836f41d85732f66cee6bda225132356c7e0fc63cc0485e1680f22d48712df05cdf13f21541841262d67883729bd17c9dd6de81f9b1b15981d33
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3004086dbccb0abef08f7a966f543b2629c5eeff123e724b79da7e6fab79bce8
MD5 a0be1f531cfa4584ed26d39692a8ecdf
SHA1 936c7c2230ebfa3aae0aaa62e78406e88b7ff0f5
SHA512 6772400427a8aa47fa0b30938b01d3166a7457a5c4f6f63edfb2090c2fe9c2c4bbdb6d2e36622e92494713209fe4a4eb68e6040f3556ee3e1919240e7876065c
TLSH
T106A0025193C659D2DE5A92B870654981AE957E185D51430374F7045CCC5F2C54211144
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 0c7a423237fdc5aa95ac2e323c3f5cb4c667b9462ed9f3c9a645d9d0a561ffc2
MD5 f9e55286a2eda70861d649107a67fda3
SHA1 ad218831e354f1f0d8b3df18d9788c7ceecab0b9
SHA512 ec204efb00b4742f96369f77646a510593c9c481c783420d9c06e139d182f614f2ef0b7eb89dc6d817680d49ab52b7fd0a0a3fc6a2dfb44a69688373ce7e0156
SSDEEP 3072:MRpEQmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+j1:MRpEQmSo0khmRgB36T8Ljk3
TLSH
T170C312269C7ADCA116BC0BAC51563CF74E20835318E618FC75DE6F4A12FBC680B1709B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1f61d75c884c2b4911f210af6d4406a3b0f7746814ac926184db65c535a069b2
MD5 19d2c08cc15e6362fef577a4666c7d03
SHA1 775f634d8a061be35d5652dec7d2a3489ee51539
SHA512 065d10b7bfb7d8ce32a850f7301664b49bc236aee21351cd719579b42baa6e854e5e305792cd2975809c9e124098ee3e92b5712bdd5f56a8e49c070cc29f16fe
SSDEEP 96:TC6yd+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5oFADsB6xGyv4YR5geObETev7:TC5cTkJaRZi/CF2lIDUDQ2gZIR5geObV
TLSH
T1D4A12B3264659DB76576DA8DB4523A43DFB9722B7950AFC8D9DD0F0C19FB09C0342023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 0777f7c80d7780bd1aefc119063c021ab453d7d7092e1a64e4ec73a28d87edb9
MD5 dcd4bdc6c0cd5513b19f3704de38d3f2
SHA1 70a18e814fc47efcb1e5df848647499383771381
SHA512 7eb223cd72218575a8b6e606b4e84a8772ce8ae6c550b13ebf3d7926cbffdf8e058b21e3723ef9e8221fcafb64058ce32c4e4fcd32251fc9525c3bf4cebc9557
SSDEEP 3072:ItQmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+j1:ItQmSo0khmRgB36T8Ljk3
TLSH
T196C312029DBAE8A111BC57BD959B2CF75F20425318E604FC7AEEAF4612F7D68031709B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 4c18374fce637bf3a14194e1a43d22045b2c3f66797deea2a195301a232910b7
MD5 cd3b796fe3751aa8eca60e654ec2d5a4
SHA1 570ad691b8acfff68da826aecc24372979717cc3
SHA512 a29d3858dcc82c80e384d1a4220dcd2652e8f6c7dea3aa62d32296c5cc8caf1d310f7d7aa530e51eeb0cf96e62c1f505eaab7e50bdf3ac1f29e4e6b55fee4446
SSDEEP 3072:VtQmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+j1:VtQmSo0khmRgB36T8Ljk3
TLSH
T165C312029DBAE8A112BC57BD959B2CF75F20425318E604FC7ADEAF4612F7D68031709B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 184e705c5d4b7db523b2a59a4de1c03bf55a3949dce4fd9f526e7e1de92011db
MD5 5883d6282a9882366bbb36086bb4058b
SHA1 87c78e3b16ea7550f002bdbb5f77787b5cc8939f
SHA512 97ce99909dd611783c9803a4c3be7db5cfbb247ed848d52c2cd9e40cbad93f7d60fc96537bfbdf153226355168b2f19ebc4eaf64c9dd40fa44b8cd018aa6239b
SSDEEP 3072:IRpEQmiroahkqpWNkiQge/jcnE1CPyvb1BgcovCg/+gedEcglm8+j1:IRpEQmSo0khmRgB36T8Ljk3
TLSH
T102C312265D76DCA106BC1BAC91563CF74E20835318E618FC75DE6F4612FBC680B1709B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4744_1976358674\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4064-2-0x000001C300000000-0x000001C300270000-memory.dmp

Download

memory/4064-12-0x000001C300000000-0x000001C300270000-memory.dmp

Download

memory/4064-11-0x000001C3779A0000-0x000001C3779A1000-memory.dmp

Download