461ee6ccc5d00c864d096824a6cabeb1eb5f8309f2019d28ce7b9b1b2f24cfc2

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unconfirmed 995639.exe
Size 268KB
Sample260724-prdflaek3v
SHA256 461ee6ccc5d00c864d096824a6cabeb1eb5f8309f2019d28ce7b9b1b2f24cfc2
MD5 9b1d069153a6aaf684d1845a76bfaa18
SHA1 21585c286b4a36503b5e9b2a67530f5408acb0d0
SHA512 dd87c2174f3556624b65a4b4f4ad05fb76c442d30e4874235d170f1cea24b0be777f96f0f1a21b1a83309a3fd4c05becea950ec39c4f533c438664c9fdeebf43
SSDEEP 3072:EvZY6xuHfh3afmcAt8guApy58q4nLm17nkLs1RlTilLzDV3adtl1MGlJ2oDME6RK:2YHfh3ifaLm17Jkat1ERM4Wb
TLSH
T10744B61FEAE618E1D9B6C0389153B13FF8B174A6437197D7A7815A070B62BE4E83E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
43	discord.com
61	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
476	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	Unconfirmed 995639.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293701496576469"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Unconfirmed 995639.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{E2998E69-E253-4F69-9A6C-150E1A66FDD8}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Unconfirmed 995639.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Unconfirmed 995639.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Unconfirmed 995639.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Unconfirmed 995639.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	Unconfirmed 995639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Unconfirmed 995639.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5056	Unconfirmed 995639.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe
2356	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	Unconfirmed 995639.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1792	2356	chrome.exe	95
PID 2356 wrote to memory of 476	2356	chrome.exe	96
PID 2356 wrote to memory of 5920	2356	chrome.exe	97
PID 2356 wrote to memory of 5920	2356	chrome.exe	97
PID 2356 wrote to memory of 5776	2356	chrome.exe	99
PID 2356 wrote to memory of 5776	2356	chrome.exe	99
PID 2356 wrote to memory of 4744	2356	chrome.exe	101
PID 2356 wrote to memory of 2340	2356	chrome.exe	100
PID 2356 wrote to memory of 4744	2356	chrome.exe	101
PID 2356 wrote to memory of 2340	2356	chrome.exe	100
PID 2356 wrote to memory of 4224	2356	chrome.exe	102
PID 2356 wrote to memory of 4224	2356	chrome.exe	102
PID 2356 wrote to memory of 756	2356	chrome.exe	103
PID 2356 wrote to memory of 756	2356	chrome.exe	103
PID 2356 wrote to memory of 3268	2356	chrome.exe	104
PID 2356 wrote to memory of 5320	2356	chrome.exe	105
PID 2356 wrote to memory of 5320	2356	chrome.exe	105
PID 2356 wrote to memory of 5324	2356	chrome.exe	106
PID 2356 wrote to memory of 5324	2356	chrome.exe	106
PID 2356 wrote to memory of 3652	2356	chrome.exe	110
PID 2356 wrote to memory of 3676	2356	chrome.exe	111
PID 2356 wrote to memory of 3652	2356	chrome.exe	110
PID 2356 wrote to memory of 3676	2356	chrome.exe	111
PID 2356 wrote to memory of 2972	2356	chrome.exe	112
PID 2356 wrote to memory of 2972	2356	chrome.exe	112
PID 2356 wrote to memory of 1972	2356	chrome.exe	113
PID 2356 wrote to memory of 5952	2356	chrome.exe	114
PID 2356 wrote to memory of 1972	2356	chrome.exe	113
PID 2356 wrote to memory of 5952	2356	chrome.exe	114
PID 2356 wrote to memory of 5032	2356	chrome.exe	115
PID 2356 wrote to memory of 5032	2356	chrome.exe	115
PID 2356 wrote to memory of 5728	2356	chrome.exe	116
PID 2356 wrote to memory of 4876	2356	chrome.exe	118
PID 2356 wrote to memory of 5728	2356	chrome.exe	116
PID 2356 wrote to memory of 1880	2356	chrome.exe	117
PID 2356 wrote to memory of 4228	2356	chrome.exe	119
PID 2356 wrote to memory of 4876	2356	chrome.exe	118
PID 2356 wrote to memory of 1880	2356	chrome.exe	117
PID 2356 wrote to memory of 4228	2356	chrome.exe	119
PID 2356 wrote to memory of 5308	2356	chrome.exe	120
PID 2356 wrote to memory of 5308	2356	chrome.exe	120
PID 2356 wrote to memory of 4200	2356	chrome.exe	121
PID 2356 wrote to memory of 4200	2356	chrome.exe	121
PID 2356 wrote to memory of 4284	2356	chrome.exe	122
PID 2356 wrote to memory of 4284	2356	chrome.exe	122
PID 2356 wrote to memory of 5588	2356	chrome.exe	123
PID 2356 wrote to memory of 5588	2356	chrome.exe	123
PID 2356 wrote to memory of 3448	2356	chrome.exe	124
PID 2356 wrote to memory of 3372	2356	chrome.exe	125
PID 2356 wrote to memory of 3116	2356	chrome.exe	126
PID 2356 wrote to memory of 1452	2356	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\Unconfirmed 995639.exe
"C:\Users\Admin\AppData\Local\Temp\Unconfirmed 995639.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xac,0x134,0x7ffb7aedc728,0x7ffb7aedc734,0x7ffb7aedc740
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,2316627919369296032,12087774527270741415,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,17611852855587461347,11063536337474269577,262144 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,8341515452972922760,243134893607326399,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,5029685366307833050,14221159691411768797,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,14945135794957001474,6078096762953052067,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4756,i,7302895324028014233,16205765661289417392,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,4924530545221004530,17617265734809822935,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,7588123012293518933,15635843628052247814,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,282297797596867354,7723869214249557409,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,7736900262249504151,4193240323678457591,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5844,i,7724547456273027887,6031320877370042485,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,2388305856110407618,12717309744982170552,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5528,i,14127865921738118735,12342045738976215620,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,8263347398736462934,7639966711352039637,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5684,i,8409885981206697992,10490658427220913421,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6048,i,17137233145947787177,5422046628854563478,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6356,i,3943684576236563774,10515099850011547185,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,4025616473000653642,9543823900657397506,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6092,i,381153211951003597,17600857412536286096,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5712,i,932714755379531320,2702895427443796575,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6292,i,8428693291459612780,6263099785071904059,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6324,i,11721338831576272654,13476508364668389490,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4768,i,6321016620317528494,13641038655933344928,2097152 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:9
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,18062974279292559045,5461789028346308685,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,8326344603036937516,6583879745772950968,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,16045709079988056248,16132390745659592469,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,17583175343832187853,6339831980355936686,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,12351087867980003094,3514419784255027646,524288 --field-trial-handle=1904,i,12527818032808051467,13233832621666407569,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 a05757a7703cb937aae5fa99f127740037aaa42262e8d555d42cfa7c9f5418fe
MD5 b36cbc3c589f21321a0801ac36f9c331
SHA1 e08d663be12c0c1a1ccd0727d6ab121cd228a429
SHA512 00a7e3b8f5033f3be670b971773a54292fa43d43abe01b4d55e906e96724465e89ec0f69ddf6902a3c1566c9ac4777ac109efff0c27d731c304d890620f16e8f
SSDEEP 48:6I9tIz4wmh5PTqejRTOGH3KtiyiRFRkBr1AXPA7fTdnnim/PTa4BlDdKlYaYlwp:6I9tOM3Oej9XVYr1AWTdnnJza2iYK
TLSH
T18BB12A91D2B01C57DFC28BFA81E6A928BCB040F093475E0E7C8205B112727D6CABDF90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cc96ce14e908ec9db2329e3991876e17aeedbc5542f320d0fe32867085fc3657
MD5 840161a8718f6a3b28076865758bfdd2
SHA1 b793383b6d016d9016fdac7327714cd80e0893f4
SHA512 e9e453b100a6f3bcd9bf11d36ed4c86f6f1f688dadcc9caec2e70188ed393a4cc17cbd290d4e47d6c5c8ee8185e2433a48b38d95bef7c3e30908b404d1267ac5
TLSH
T1543188F3C2D89D7D890456F8EB153E2ACE290E18522C3D26C8D4AE1F67E2876D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d3581cee9dd5afea377ec5a5edd422b5319c0bb0140583f41d1a13b9c6304929
MD5 8086e4e849a310e6e55b478ef3f431c6
SHA1 62c79349c355460e0c53bd380de44d86c035a5ba
SHA512 86b3428b96f0356dd0948f4437797136bbf5ea6384efd7a1e5b35a1f9129898667b49f09684018792a8b5d084dc58ed7717a90658efa2e7d73a60760c3feb869
SSDEEP 96:DOhQqunuKJwx11LsPUuVueyuEuecue8uyuKK:DOhQq8PJS11LsPUmryRrcr8JBK
TLSH
T18CA18CF7C7D8866DC91152F4AB157E1BCE2E0D6843283C2AC8D5AF4F53E25B2E24065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 dd4e66e72ab18179387c64f30dec9cfc3f6167f11836cb383ac5765860c257b1
MD5 6052216bdd30378f4d097c538f8cee4c
SHA1 65ebf3d3fc2562d9049d1002b1f70a5533dcac59
SHA512 2a0063304116519b3947bb81ca29df77f19035d0cb1ddaa8499b305fe792bd8c0032727b5c1d6055fb4f357d6643ef2f75e1ad7daecdb50379abaa2005675e3d
SSDEEP 192:NRCsaupv7pAPRp2rI9XxHsb+WNnS5OWF2DeeW2Nn2+VyIsnAUge:NRCs1pAXjfwIl2O2F22e
TLSH
T1C832852EAE10693B6DCBC22DFA657B57D7F6102161D42E84E7FC8A2C15DB6CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5222daed245175e4870628888570306f6d59ee13785940edb25daeff61d544ab
MD5 272c9cf0e98e1add8e70959f78398fcb
SHA1 ea7816b4c14551e9c0fc1ef92b9eb877a660035a
SHA512 32ec00399a09992d3a77b10bd0143e984bf57ab9d995fdabbf970b0db42e9e7c95abe9258291b0a9dfbf972a13154cac1185ddecb224362cea39a548c9f268a2
SSDEEP 192:NRCsauzv7zUFPRpArX9XxHsb+WNnS5OWF2eeeW2Nv2+VyIsnAUgE:NRCs1LyXafwIl2B2N22E
TLSH
T17D42952EAE10693B6DCBC22DFA61BB57D7F5102161D42E44E7FC8A2C15EB6CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e0abfeb6e197d2cbe0ba59f989870735fc36f3c323d3f9d444d3a8cb84397563
MD5 b8111a45e93ce9ab1329adf53a43a385
SHA1 e844d412234ea01d8411f1340b50e0f5d6d1ad58
SHA512 d5bfb344b9e612ffcdf6cbfbd7fc1b6e96dd3215c016ea7e6ea4560e1ebcb914644ec27c10fea7c0574010e317f430bc95c238e995a4de1b3d9a3341f03d7abd
SSDEEP 192:NRCsaupv7zUAPRp2rX9XxHsb+WNnS5OWF2DeeW2Nn2+VyIsnAUge:NRCs1pdXkfwIl2O2F22e
TLSH
T15A42852EAE10693B6DCBC22DFA617B97D7F6102161D42E84E7FC8A2C15DB6CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7eb334056335a53ad4c28bca01be9f36e3ad00caec437312cf8a65815ee3aa33
MD5 eec93fb4c99ea6466d76475384c2165b
SHA1 328d2f505416997b9757cdb3eb34da1c2f10f882
SHA512 4491d48a04e66b24a2353dd1ed4a00be44f716bf4aa9f11ba8b8a18886d7a3f468dfa8c3b2e462a12c5d3f8a332ba5a83b35999fb70b9a7f154526dbed769bb7
SSDEEP 192:NRCsauTv7zUAPRp2rX9XxHsb+WNnS5OWF2ceeW2ND2+VyIsnAUgE:NRCs1rdXkfwIl2/2R22E
TLSH
T13D42852EAE10693B6DCBC22DFA617B57D7F6102161D42E44E7FC8A2C15EB6CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 e9e449bb51551e06e89df1202283c34bfe3d308cad7d2e97cc710755e5b5c29c
MD5 b0ae1fa2b43b55fd063e115403abbf04
SHA1 c1016b28003b12e5ef5fc2797fcae18c691be17b
SHA512 91467398bd393ca730527b95f4e72a57737ce4d9d01c7818881d2da6aacd526e31b933620ec36a0eb732e457df5e454cc5ce4551f2c782d3fbc65bad10e99aaa
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU31EHGSEM8n:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4E
TLSH
T10C52E827684D9A3F0FD8D64CDC166F8FADF6015666B8092497FA5D0803A97CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\9d12fab2-9806-4cbd-ad85-41ee62dc27d3\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 48e76d36cb27a6a7c54126ab35f4af1f25462e0eed4a128529569e658e105a00
MD5 035141fc08ef67bfb846a0a1ce8bb447
SHA1 ecb7075c1d9b5a2ea37f05aa68ed533145c8e05e
SHA512 f28abebbd73be6febf19c53cdcb019743bb1471caf461d398b2c4b74d45c61202442070293d9744c9cd3474ab16199c7ca3c1c71e2f99fab3c486ee47f3eee76
TLSH
T1FDD0A77BF0A64C60DBBA4AA12762196F47262D88588A90C8E803315EE8B5E579211F57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b709521d2aa495c17121aa92e7c0423578956ac131821c8b63423a3da3f9aeed
MD5 2d69f85f0bca09208af7ce44ff4f61d1
SHA1 c9f43695501ce93f4b01d1a3da0292711985c60b
SHA512 1ab2a2f5cb8361a348370a6e2fc6ed038ea99861126a1239fb2ba2482ead8c4b8710e87706cbd3dcf5cecaed05fa4075044331d90acb884c8daabf807321aeb9
TLSH
T1BCD0A76BF09A4D60EABE4EA12762153F47163988589A90C8A803115EE895E575212F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5aa077.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5aa077.TMP
Size 138B
SHA256 8e60962179d3ccb127171fc5c34350c1b42d09ad8b4446b77cf8b91937af6cb7
MD5 547b7d224c302694f4b46cfde74770b7
SHA1 6555c203b5954f72e1c9b8f8c4ff885f64b5610b
SHA512 b7f9890a94fd6729852fecfd19662cbe769ab5ad1ae7bf2aab45cf5b2319d4115378d17b3ff6edc3f5d7ccc8137017bcaa75a88e8075af0f3c68e19569f7711d
TLSH
T130C08CA3F0890D10CA6802600232082D430A2DC84C8AC08C680334192074E232102FDA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4894e4fdd57cbdc19f08068b0e190602aca8180c3a51c71e3b505c58667af19b
MD5 2a54b7ba99004430a549731dbfd9d996
SHA1 7bc77d6592bd2c4c13dc2fdefac5ee7455135011
SHA512 2db2ca049280c55b9cda92e33540455fc4bc9a84304a43e6105185f7565147fa834b9560c18ccf1d8011bcf97f679b5da2dd7b7764f6f6fe10588fd871593623
TLSH
T168A0021051D04457CF0552B0A2B219C27652885497554B07EA9A14989E5B5D4C111204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad87f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ad87f.TMP
Size 48B
SHA256 b349d3a313b4b4290c955d199e686a7772c4706ff16d3cc00c44ac6a392b4c43
MD5 780c5ade9fa09b7bba86d29846a2966f
SHA1 ebf1ec4a0548013386ffd274f86fd1dfd8ae2f2f
SHA512 84c9f2d532aa1229da123432e62c99e68459c9c12fa84a8e563458a061df3c2e8b2f4baf7ab52b9f3e81a9e459ebbd442e96d35ae7eeffea51ac7e1a3196f9be
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 7f7c2a14fac896a6b66eb07ea48a8996f66b919900d6e4dcf26a5280a456ef8f
MD5 00268525144a1e120549311d7d38e025
SHA1 1573db82ebe17a87c45aa1fd141666f92d746a88
SHA512 5724d1802e467af20a93c658ebadcebadbba0837efa6bc3ef1ac97a6833494de17425055a05c8a59953ab3eba63be7d84cee58b0bfdbbff6e3d39043a544ba4c
SSDEEP 3072:a3t2MtgujtnItzAApjnCVBhlA9yhUl2fBbuFqC9ea:a3tbrNApjCVBhWpl2tuFqCAa
TLSH
T1F5C312746C796C73422AD4423821FF378CE259F7CF0899DCD9CA4F8609C6B994B06979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d87d7ffde39edd3a487a975af085f5a653ab4899bfccd27c4a72d7a614b06234
MD5 5edc929149c36637fb87a30d401b3485
SHA1 3861371bb2855de8fd25152780b6c41606991331
SHA512 6951d78638c5d1f2781ae41dc7c10948a145d0b9662e74fde6bf76e11894091376a5a02472389843c40bfcf8f19b5990accf77fcb90d995da24a30f846bc2f86
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5smDOB6nGyvn0b4T8+ybJv4a:xC0ITo+TQ0InDUDbuPPb4T8+ybl
TLSH
T14BA1F939E0284DB74476D446F1626A43CEB9706BD972AFD4EAE90F0D25F70EC1341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 0c4d1a49814b7e2251bbd799650179a9fafdcf16dbb5fe1cca9788e936ba2308
MD5 01cd5b1b30257a8954a9f98f163d6498
SHA1 15b6f18d1da10e0174c27805d9a511c5e0ef448d
SHA512 28a961b4f1cf96f7ee98c87e96a5ed0e6c1e9f47f6c4ffb8d75709f2253f994df00972106510643e6b96c2f0457854373970e2989357b827db69f7271f2467d8
SSDEEP 3072:bo3t2MtgujtnItzAApjnCVBhlA9yhUl2fBbuFqC9ea:bo3tbrNApjCVBhWpl2tuFqCAa
TLSH
T10EC312586D7D6D33422AD4027C31FF3789A35AF2CE4888DCD5CA4F8A09D6BD94B05A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 9465aedff191a97f08f31617e9c8f4bed5e1e5eb4a16012c89a935d94d2cf5b4
MD5 c85b98d035453c3513ed98591fae63aa
SHA1 1d5a30d0ff3ed48c6cbf31e4484135f9203116ea
SHA512 28ebe46d687a6e64b12826d0191d87b6e0a8f2e43d9ac76d1589d924161be349d1654732d03c879a2eb256a63beaf2c3d3130a9f27801468dd655b580fc47b73
SSDEEP 3072:mo3t2MtgujtnItzAApjnCVBhlA9yhUl2fBbuFqC9ea:mo3tbrNApjCVBhWpl2tuFqCAa
TLSH
T16FC312586D7D6D33422AD0027C31FF3789A35AF2CE0888DCD5CA4F8609D6BD94B06A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2356_540248060\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download