0d2b7dc88ed7f71e8ac0d09a3b7a2bc02f10997a2c95b7f491e3a23b75e4feff

Analysis

user interaction
yes
max time kernel
111s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NiceHashQuickMinerInstaller.exe
Size 1.8MB
Sample260710-v358msdw3l
SHA256 0d2b7dc88ed7f71e8ac0d09a3b7a2bc02f10997a2c95b7f491e3a23b75e4feff
MD5 1cfcbb67599f769de33b9dc7deb6545b
SHA1 74bf00b01e3bb8a7ecba4a8ec13f477300a81044
SHA512 1617b65ff1e59f0b619c36bae96b88df7c64c0436c8d9e99542d84aea6043740d694a5cd79fd611e322b725cb8057e288d62c4749395053facbcb9523ba2b043
SSDEEP 12288:j22WIdAaCcaZ9gJ0gpmk7NXD4rKeXe9G4rKeXe9E4rKeXe9C4rKeXe9ITRc:yIdAaCcaZ9eVpZXtTS
TLSH
T18A85688F89D640E1D831B5BC366AC9B908170F77A1E60526D3F234189A3B627F4B3677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
84	raw.githubusercontent.com
1	raw.githubusercontent.com

Downloads MZ/PE file 1 IoCs

flow	pid	Process
78	4216	chrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4716	excavator.exe
4716	excavator.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
4716	excavator.exe
1260	NiceHashQuickMiner.exe
5268	NiceHashQuickMiner.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3692	NiceHashQuickMinerInstaller.exe
5872	chrome.exe
5872	chrome.exe
4716	excavator.exe
4716	excavator.exe
4716	excavator.exe
4716	excavator.exe
4716	excavator.exe
4716	excavator.exe
5268	NiceHashQuickMiner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	NiceHashQuickMinerInstaller.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 4868	5872	chrome.exe	87
PID 5872 wrote to memory of 4308	5872	chrome.exe	88
PID 5872 wrote to memory of 4308	5872	chrome.exe	88
PID 5872 wrote to memory of 4216	5872	chrome.exe	89
PID 5872 wrote to memory of 2616	5872	chrome.exe	91
PID 5872 wrote to memory of 2616	5872	chrome.exe	91
PID 5872 wrote to memory of 2396	5872	chrome.exe	92
PID 5872 wrote to memory of 2396	5872	chrome.exe	92
PID 5872 wrote to memory of 4600	5872	chrome.exe	93
PID 5872 wrote to memory of 4600	5872	chrome.exe	93
PID 5872 wrote to memory of 6076	5872	chrome.exe	94
PID 5872 wrote to memory of 6076	5872	chrome.exe	94
PID 5872 wrote to memory of 1056	5872	chrome.exe	95
PID 5872 wrote to memory of 1056	5872	chrome.exe	95
PID 5872 wrote to memory of 3540	5872	chrome.exe	96
PID 5872 wrote to memory of 3540	5872	chrome.exe	96
PID 5872 wrote to memory of 6096	5872	chrome.exe	97
PID 5872 wrote to memory of 6096	5872	chrome.exe	97
PID 5872 wrote to memory of 1156	5872	chrome.exe	98
PID 5872 wrote to memory of 2472	5872	chrome.exe	99
PID 5872 wrote to memory of 1832	5872	chrome.exe	100
PID 5872 wrote to memory of 2472	5872	chrome.exe	99
PID 5872 wrote to memory of 1832	5872	chrome.exe	100
PID 5872 wrote to memory of 2248	5872	chrome.exe	104
PID 5872 wrote to memory of 2248	5872	chrome.exe	104
PID 5872 wrote to memory of 4928	5872	chrome.exe	105
PID 5872 wrote to memory of 4928	5872	chrome.exe	105
PID 5872 wrote to memory of 3316	5872	chrome.exe	106
PID 5872 wrote to memory of 3484	5872	chrome.exe	109
PID 5872 wrote to memory of 3316	5872	chrome.exe	106
PID 5872 wrote to memory of 3056	5872	chrome.exe	107
PID 5872 wrote to memory of 3484	5872	chrome.exe	109
PID 5872 wrote to memory of 1756	5872	chrome.exe	108
PID 5872 wrote to memory of 3056	5872	chrome.exe	107
PID 5872 wrote to memory of 1756	5872	chrome.exe	108
PID 5872 wrote to memory of 1360	5872	chrome.exe	110
PID 5872 wrote to memory of 1360	5872	chrome.exe	110
PID 5872 wrote to memory of 1900	5872	chrome.exe	111
PID 5872 wrote to memory of 1900	5872	chrome.exe	111
PID 5872 wrote to memory of 3540	5872	chrome.exe	112
PID 5872 wrote to memory of 3540	5872	chrome.exe	112
PID 5872 wrote to memory of 5192	5872	chrome.exe	113
PID 5872 wrote to memory of 5192	5872	chrome.exe	113
PID 5872 wrote to memory of 248	5872	chrome.exe	114
PID 5872 wrote to memory of 5920	5872	chrome.exe	115
PID 5872 wrote to memory of 248	5872	chrome.exe	114
PID 5872 wrote to memory of 5920	5872	chrome.exe	115
PID 5872 wrote to memory of 1776	5872	chrome.exe	116
PID 5872 wrote to memory of 1776	5872	chrome.exe	116
PID 5872 wrote to memory of 4188	5872	chrome.exe	117
PID 5872 wrote to memory of 4188	5872	chrome.exe	117
PID 5872 wrote to memory of 1344	5872	chrome.exe	118
PID 5872 wrote to memory of 4204	5872	chrome.exe	119
PID 5872 wrote to memory of 2820	5872	chrome.exe	120
PID 3692 wrote to memory of 4716	3692	NiceHashQuickMinerInstaller.exe	123
PID 3692 wrote to memory of 1260	3692	NiceHashQuickMinerInstaller.exe	125
PID 3692 wrote to memory of 5268	3692	NiceHashQuickMinerInstaller.exe	127

C:\Users\Admin\AppData\Local\Temp\NiceHashQuickMinerInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\NiceHashQuickMinerInstaller.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\NiceHash\NiceHash QuickMiner\excavator.exe
  "C:\NiceHash\NiceHash QuickMiner\excavator.exe" -h
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\NiceHash\NiceHash QuickMiner\NiceHashQuickMiner.exe
  "C:\NiceHash\NiceHash QuickMiner\NiceHashQuickMiner.exe" --test
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\NiceHash\NiceHash QuickMiner\NiceHashQuickMiner.exe
  "C:\NiceHash\NiceHash QuickMiner\NiceHashQuickMiner.exe" --firstrun
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa4638c728,0x7ffa4638c734,0x7ffa4638c740
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,10872587014338216052,16326422941195368641,262144 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,9895084081250711464,3337792767904991548,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,1533487025896404989,1121318708998106637,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2856,i,4627347339541010694,5286428517717681473,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,13622502821106726879,1334838765876754940,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,7456049450514474607,16928111460430744093,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,9953742563537032346,2242858957228399901,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,15246525905812241164,15532455471153408031,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,8428610097902224889,14374470259472749688,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,14240283266344343313,12661173320298069620,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,311604012527435640,1531209797643358418,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5500,i,5941276980061721095,408186847794712878,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5692,i,1280374674651754968,15996993046255929479,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,10803919877919539952,17333034740022140863,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5604,i,15207903099476027485,7303066441861076373,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6224,i,8421540804859241356,764750921259145754,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6236,i,12755650662507269835,8285710380738903766,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,3749717411931729155,11604951799107677465,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6148,i,8114365646882989513,16773189416729363880,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6508,i,9219042830298839444,1580519018413406862,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6496,i,10728387900437885645,11496304523693872187,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5988,i,8070639409648095168,7719829464466220323,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3452,i,14603502286192042099,11368284799044015872,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:9
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3496,i,10493438711627604117,4032644788412641239,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6128,i,14902853952432250563,9421842734418569756,2097152 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,6158799615577683972,17433952700751422099,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:12
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=260,i,8481307755383348246,11246850691608400772,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,15140835168371317079,1002694332222466075,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3580,i,1910421834691082207,5832149309041313913,524288 --field-trial-handle=1876,i,16030218271568836739,5817798309560332368,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:2820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1280

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\236ac4d6f0ce42e8b46bf0ba716d60bb /t 4888 /p 5872
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NiceHashQuickMiner.exe

Path C:\NiceHash\NiceHash QuickMiner\NiceHashQuickMiner.exe
Size 1.8MB
SHA256 0d2b7dc88ed7f71e8ac0d09a3b7a2bc02f10997a2c95b7f491e3a23b75e4feff
MD5 1cfcbb67599f769de33b9dc7deb6545b
SHA1 74bf00b01e3bb8a7ecba4a8ec13f477300a81044
SHA512 1617b65ff1e59f0b619c36bae96b88df7c64c0436c8d9e99542d84aea6043740d694a5cd79fd611e322b725cb8057e288d62c4749395053facbcb9523ba2b043
SSDEEP 12288:j22WIdAaCcaZ9gJ0gpmk7NXD4rKeXe9G4rKeXe9E4rKeXe9C4rKeXe9ITRc:yIdAaCcaZ9eVpZXtTS
TLSH
T18A85688F89D640E1D831B5BC366AC9B908170F77A1E60526D3F234189A3B627F4B3677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\NiceHash\NiceHash QuickMiner\log4net.dll
Size 264KB
SHA256 2a968d587e6579254446f9fbec669bdcd659e487e89256fcdf0114a55cb5b749
MD5 2138af60b5343dd66d4a7f5d22693e19
SHA1 63d59196e772434782e1f1be41f54a1b812d71e6
SHA512 945d068a5d19362be133c17231b2a3cb3443212d2c3a8122080dc489d402cb6c92999be3ca26b5e228c8eb50e7cfba8f8f9daf219d78ab56c7364407385d2567
SSDEEP 3072:mYomTrnlgoLHnOa7Y+YJ6IKOl3HDvdyZHHME3nY7vTSGF0MMkEn7GDRGvmJJ:mYBHpY+YPXhmHHM22vTSoXMARGv
TLSH
T1964406252BF84A59F2FE6BB8B835441587B2FD56B87ED74E5D80A0FD2C63B008911363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhqm.conf

Path C:\NiceHash\NiceHash QuickMiner\nhqm.conf
Size 1KB
SHA256 923a17d31bf2820a049ab5b101509bf5a976197ae9d3c635cf6eaf808fff76e5
MD5 e38d25306b611f4681b6cf93e8274ddb
SHA1 25d7239fc9119e6341f0a1950e7f069cf406f8aa
SHA512 6af9e08c59ca5a5873ae7ecbb9962a1ac3b1357621caffb548d0841ef0f4ff448f63023ac173bd0dbbd881878fcf54fc4c8b58efe28d245fb3ec22e36f58b10c
TLSH
T17A31881F1DC406FE1006A6BEE934C63147235FDE621B7866F9693E2CF59F42A1082DA8
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 acb0366c1751aa5927e2bc5e8c96163d969295f81c786bc3f104f25587973738
MD5 254d5c2c68904e3cb960178559d7628e
SHA1 118fa3be5d353bd7c0fa0d37f1f3ea2198fa0b53
SHA512 ea834d73a886b3cb3a64046956a417cf0660b80c7cf22bfe62ed0fbe6ac91a573a169f54401b74b7b747c87943d3a8eb9f43fd96b01a9250ccda096852393801
TLSH
T1880125144C2118F95F094BF10A59C5AE2808712770F157497CAF59E05940F5677F141C
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_CEA5E1FDDBFC4886E06B57AACF74B6B6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_CEA5E1FDDBFC4886E06B57AACF74B6B6
Size 638B
SHA256 54a0ac94147d6d6b9706aa67789f2ffbbe4c7d3738f2db3bcf2ca7079eae7cbc
MD5 fb3346b660315822a5009b3063a93367
SHA1 a8c799ab3d7b2fa7ffe0d6d6e68e6873060819d7
SHA512 c6af5471a0505d70ec12a7faa345d12ddff181c102925ffba0c602ff6bd2039cf39315f7ff7155966d4030e3f0b1670914bbfe0c76a7a252920ec8d0b7147b00
TLSH
T163F02D878C07D0D6FB921C3401D6F4A37046302571E883AE23B8A7963FD63DB5904462
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 411e98f6edaa976fa4cd54df17e531d1b87d7b39c319fbafc0059bd9cabf2dee
MD5 a9ac1ca6efca9435d205fa95c3229127
SHA1 3a593c305ad07a9227fcfe4786ebcaadae3b9a18
SHA512 1a56c99ad810d415c47437f5ac4f860a03631cdb4aabbd665e59b3db96c282b58e2f848408a9b312ca8a33124230e77d110a499f0055a7e0e788aa0777b77ed1
TLSH
T1B831E9E23EE47D101D098E94A89D8B727CB071B6BA540C783454401AC4A3FA0285981E
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 2cb69101f6600f88dfce66b37d8544e22420d205deecbed4e1f1299b3544b2d8
MD5 79ad2b22e8ae0d1a9b2f214975dfc9e1
SHA1 d65fecc817df8bf6ee5b152d1cd5ed48e5187dd0
SHA512 9a68651c6a8482c8919cc5d7b5e1278a86d00c24219fb140fde5917a346f77334a88cccc1084e40082dda3839d79d7044a4b3eb8ff4b91c8fbb67b1151eaef41
TLSH
T176F0AB3819F6003BF1BF5DB50AC8A9EA8C02F117080018B80AA392090D2BF4C1C5307E
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_CEA5E1FDDBFC4886E06B57AACF74B6B6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_CEA5E1FDDBFC4886E06B57AACF74B6B6
Size 488B
SHA256 d9d73d2ead8e4e04947ed97e06d1e766406f55b546e0f0d960ec865c3910ad83
MD5 4b5f28a632c494b310cc00359f350512
SHA1 3a165b48a53d261c7b45f1a8ad718f1bca9953e0
SHA512 6daefea4a851e6e4b5aec84fbbf758d801ce0e0c80acad3d1db804871fd6708e8c1c258dce6ddb882724c9801e9f058b34e6ad162ef3820a7435645243337262
TLSH
T19FF0AB3C7CEF106DF0B7A9B583EC75E27A1AF122744AABBD115203166A22F41AC91612
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 4eb989249e695c9322121231d226e59fa9154cd7e4791453a5fec9ccc141d11e
MD5 a1fe10acb9664b75b6d6a79582708d21
SHA1 2c1b5b9926646b8d8981d0f72228d0cfb9646ba1
SHA512 5df0120efaf46a19e83f5c057794d50baafce72c331ba4722f9f7c64793556e4e83921123ea63e49bf63db08fdd15e681f5c8164cd616cc01d4b6789a2e3f9ca
TLSH
T13CF0AB386DF1107DE077AD3786D8B22F9CBDF622540596AB266207166B0E9830FA0572
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 1024KB
SHA256 6d11484ccaa6d727c1db6a7b3ad75e327a5e28cdb89364a8dc0a4eb944ab6109
MD5 d5be2963bed269d739e3478fbf78fca8
SHA1 e67cfb088a4ebc60e26e37103c8367c2baf787e2
SHA512 b97ba59e9e1cd7da34874da6eaf640b6b1b843dda6f447d50083fd587fa0ad3e2be1ad3765cb15547cd9e7685dad6f936185fc8306cf7051ba364280f179ee21
SSDEEP 24576:j50N63XRXTXiQF6Wc70gCOJSeKFCI/o46u93L7:mQ3BXTd7c4gLSehI/Ys3L7
TLSH
T1772523B98F8806D2FBCCD26E64D4EAE6DCD83805C748ED5F21487611883748B669F63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 51KB
SHA256 7009feb62caadcec218564f7b2708664a4c9d161565476ff53e37a8f61284932
MD5 1d5c3f00f7ec69d3750a1b074cc69378
SHA1 2f21b5ff48ef2f7a0070d4de32fd4071e22b8a4f
SHA512 60ab019fcdf0e45a0bde7bba69bd025fc79db5be9b7b7542649e79f97f97f6ba0c63c763f9dafd356a86bab125621df90825178d9137eca2d7b6b4c1c77dd63b
SSDEEP 1536:t5lHRY8HxotwBQPsPzIqwFDyFojWVc/qBb:xxnhZMfJyrVc+b
TLSH
T1323302DC6EE54C0D85B3463A485C9E8A2C4AB38DCF2179AF0D244B58405F7E7A7186FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 37KB
SHA256 38a4786f6bd64caba3d389c188f86dc81ee56936c485ac1a209fba63a35f3457
MD5 d99527d906865f5e816307127c3e48a9
SHA1 d1cfe25f66b9a990c407c39ad07efd1c1efb1a28
SHA512 cc66cec2bbddd89ee52a1d6bba7df7ba96d39f135a73827c0d5d06cdc47a0870b88e0d7cece459279a20bc8b0a7796e8c774451f351da2c05cfaa13e96271994
SSDEEP 768:vWW671BaEzPbTPyvya32lzacfkCcCRSz3RYHceH+vWw1E3ZMLadV47Np/ap8GtLV:egEzTDyvyzDNcZRYHPwe3Z3V4jMn
TLSH
T1AC03F18B6D04DA5D3B2B1B7263CD46D8FD3D486C450C861798EACE6F1E8D812872B588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
Size 1024KB
SHA256 813e871b55f983ee980442ed2b2171d51c179db486388bc66862797f7cdd5252
MD5 1ae148d2858cb3980b775c18924d0ad4
SHA1 7a2e3732da9c7501638cc1a77fa8cfa5c76c3434
SHA512 3e333ff45aab4bb444d2189d268e3b7c258ecf121350d5b4d9aa68c595e0ec672abf49e11dfb2da6d5ae446ecd650cd644a14aff429108b729f7205ca2d028d9
SSDEEP 24576:l9BJHroGLjDU6xzA2xXC8vIJV3VnDR79sEsUidJc2j81pjmN:jBJLoGLjDU6pA2xy8ExR7+Jp81pyN
TLSH
T1AF2523197D0CE9E67A2CC17DD278EE1AE4D190D1C8C1C9B3591793CAEE71068B2CE638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

1df675d2-5465-455e-a311-b135bb889c8c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1df675d2-5465-455e-a311-b135bb889c8c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 7fb3be436ee9d13427a0e491ab28ae4dbeb5a673f2eff018a02f480ae8ef4317
MD5 99656560984b105a945270fd4a237aef
SHA1 afeb71f3023517b58486e2e97adeb180d214a0a9
SHA512 f60ceaa9aa61bee49db96222f2136e5a6c907a82ebd52ba77621aacc6381ca116d0680f31f3982985ff5e977de01739ec7f4e2856e6fdc25de757655bdba970f
TLSH
T118116F77A56D7463107CAAAE0F5CBC466CFEBC32055158F4CF5A42EDA0405FB0B06817
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7a819f1ede1ba3730998ec35a72c0a845befa64af865575b38234963bedb1572
MD5 c783277231552375d5379791f0c01ce6
SHA1 555aeca375ba4ebbdd3e6c1328d5a1d4865ad59c
SHA512 baf82f8db9d24fdaaca0919978c0395cd81f822cf3058166bfb2255a3343c4bcf5cadb2d5f9e24dc249802cf3dbae55eb8099f497ef7f24f32be337cb9a7f571
SSDEEP 192:eRhcBzmooyzv7xkAPRp2QPK9GHsb+WNn52Eb42yS7VyIsnAUge:eRhmzmpyLfXkgw4f2H9e
TLSH
T11132831FA924653B6CDAD21DFE26B793D6F5102275942E84EBFC8A2C01D7ACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 34e0d58fee6eaa0f25d8c88a6744d341dbfa74bcaae2d798a46893f85db5a3df
MD5 4a3d3a9c8f8214013b5106a746dff875
SHA1 a45ea2c7a3194ce893955cdc30d9dc78d991c992
SHA512 e779cea868b54e34bdef181e8cd277daae0bb2db35cab545c66f6ca9518aeb4793c9d06488517052415af27e82c693424a83ecf638536394acc8f8e2e31b9fda
SSDEEP 192:eRhcBzQooyzv7xkAPRp2QPGf19GHsb+WNwA52Eb4aEb2Uc7VyIsnAUgE:eRhmzQpyLfX8tgwafF2D9E
TLSH
T12342951FA824693B6CDAD21DF922B797D7F5202275902E88EBFC8A1C11D7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 1b0cf90314e956dde7a927d55a1697702b1af55beeb442365aca681dc342280d
MD5 2681719479af19f440d9a3a303052f0d
SHA1 68853d554365d390131ac84b0ffebf669e61868c
SHA512 7f0224e775350afb6d6a48f87d46521e0e906de751fd69437e28b4ebce8a9a2bf74fa343e5da9986233ccdbba2abeecb4c402cd2fd464a2eb7e9eedb3a423150
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU3GoHGtJidmNaA:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOR
TLSH
T16A520867688C9A3B0FD8DA4CDC16BB8FACB50157A2A40C6457FB9D1903D57CB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 cb5f1f7dee046df1c1fab671550b278a2b7c934e4022a96129607bf687de96e8
MD5 60e77ac451bcd166f1683e71d66a99dc
SHA1 95265a53f2483346a76c0995ee12c5d9ec67a3db
SHA512 ca6a6a1d468c75ad6bb2c402ddb65718ca5ec49fcbf6fdb7e31786890f18e0c2e4c57beb874f61234d21de13debbe28f4dd7f7d8a8b3aa309565996ca5d7af56
TLSH
T16AB011880000EA82C82EAE3083C22080B32A0800A3032002CAA828828A2328B808A200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 20a9811d41e0c4bcbbf781ef9eecf452710d5e7d11e341f81d80e8ffe0c1b429
MD5 38ba9f030d2e54bd6afa8e73df13afc3
SHA1 7bbef3f23224a833c2c08e868ad84fc51fca531d
SHA512 6b8d7bab61db8615d4f06153b12179bd29411c6dd622a6da109a199bfbd2793a1e5fc7ac2a591666c5871f4bbf84c2ffd6f6fd35464240b437778f3a476cf603
TLSH
T19DA0021041D42A53CD918B72756165453256585415917307D4955ADC8C5B1C18211510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 484fcdfd30461886ced90a8fc1355e8551b2f53bf3339b304bfd5124a346ab08
MD5 6506a63527717f92dcf68322d9f49953
SHA1 34dcf910cbb91eaffa1fcd3acd368567d037cb95
SHA512 73f0659ac277926b0f1e29c7c13655ca2386ca7e0e1c6b88d85b717b3a82abd300e0bbc3135f06b08a68ed8504ee4fcbb98c18aafa324243d727f57155b88273
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 deaa2d2ea62e8d87c84355d2069bc5b52890f991cae581c9d3c04df79dbb8d1a
MD5 cbf4f98464301ea95ae1d7be7488d107
SHA1 550e54dde9f13deab2d1ed7a1cfce7dad01ee437
SHA512 e7e8f85300a6af20d6da74efe9589b79b7b39b8c907b610254cd1de95127dab4a008e8e4df59936d9c606bfed3d667312d5da9a27153b55d581abd427490782e
SSDEEP 3072:cgPY/4IM9wkwpF0vH28dVjxY8Qhib+UT0fKaiJb52m7f117o4:Zwowkg0/pVjaTib+UT0fbyb5jd1k4
TLSH
T1F2C31230C5EE94F681B7DAF4B68A3A4EA5D205731D31DD86A9701A5303FC8A3C68BD47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 9021a033f2c47883d6645dc49681ae57b2c4a6a896a7c893f53e24f983b40969
MD5 c9611f5ecc807aa62aea5a8956830a7e
SHA1 c4a4f2c4eee044ef44324eb5fb32dac2cfdfac88
SHA512 ecb45dfd963e9d4ab0c9f670b123f00bc8795cc86cfbb17a7992045b910a730cf18f72898c3b71971e6eef882d6ea2f616949d3b88950440dc8f5f15b60950c8
SSDEEP 3072:zgPY/4IM9wkwpF0vH28dVjxY8Qhib+UT0fKaiJb52m7f117o4:0wowkg0/pVjaTib+UT0fbyb5jd1k4
TLSH
T15EC31230C5EE94F681B7DAF4B68E3A4EA9D205731C31DD86A9701A5303FC4A3C68BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 50b51d5088c78ebbb1c864d83abd1ee111c299c41b8dddc7eaba678d48cd31d1
MD5 d57db1b1c4bf5c7de049335f6d0dac40
SHA1 916d4faef1c72f0791f476fc2eb80dbaa8649559
SHA512 c91844cc593985d5e8aec0eb4d523afcfe1e98f5b35a73f1359e698420f6c7048118bdeb8ec104b6a097117fb0d499040faef6aea3938db77d0df0fb57a8df44
SSDEEP 96:SC6Ed+CVgOeTnnGBfYZSK3/jKRDotok5tcDRjB6gGyvhyLfOL1EbZP9v4a:SCzJeGnpDUDgR9E1mL1Ebj
TLSH
T12DA12B71B06D897384BA984DB9527B43CDA4219BD631AE84EDC85F0C42FB0EC0306427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5872_699857257\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3692-3-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-1041-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-24-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-58-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-1002-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-1-0x000001B848A40000-0x000001B848C04000-memory.dmp

Download

memory/3692-2-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-0-0x00007FFA4AD6F000-0x00007FFA4AD70000-memory.dmp

Download

memory/3692-1019-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-18-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-17-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-15-0x000001B8631A0000-0x000001B8631B2000-memory.dmp

Download

memory/3692-16-0x000001B863D20000-0x000001B863D5C000-memory.dmp

Download

memory/3692-14-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-13-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/3692-27-0x000001B863110000-0x000001B86313D000-memory.dmp

Download

memory/3692-1035-0x000001B862AC0000-0x000001B862B36000-memory.dmp

Download

memory/3692-1036-0x000001B862A60000-0x000001B862A7E000-memory.dmp

Download

memory/3692-1040-0x000001B863110000-0x000001B86313D000-memory.dmp

Download

memory/4716-1014-0x00007FF600080000-0x00007FF601080000-memory.dmp

Download

memory/4716-1013-0x00007FFA6DCC0000-0x00007FFA6DCC2000-memory.dmp

Download

memory/4716-1012-0x00007FFA6DCB0000-0x00007FFA6DCB2000-memory.dmp

Download

memory/5268-1043-0x00000147FF390000-0x00000147FF3D6000-memory.dmp

Download

memory/5268-1062-0x0000014799F70000-0x0000014799F9D000-memory.dmp

Download

memory/5268-1063-0x0000014799F70000-0x0000014799F9D000-memory.dmp

Download