d5266f0e30b338486a3ef597ad886eb307dae0370bd55414231d5859c1882682

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
decrypted.xls
Size 1.1MB
Sample260727-qs8hsstcrd
SHA256 d5266f0e30b338486a3ef597ad886eb307dae0370bd55414231d5859c1882682
MD5 c33a537a510ab5d36bb25ef7129f671b
SHA1 4b50d04a5793e92148f8aae59034d9e194f9c443
SHA512 f1d0e331791f47714b2ced3ac62ffa2c172e4d654aa55dda36a1f86788ffdd592c9f46afc856a447e7e8b3210a48c5a05765e55efde30f8a895ff4b89e2de3f2
SSDEEP 24576:d8tApcJ19vsFB/SgnQ4gbU+/waDpCN0ZQ3uHZFTgBsJk:d8t6B/SgNHbqive5FTE
TLSH
T1C645120261465638D2732F32C68F9C869F0FBF6F5C078EF51755B346293A2E48AA741E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1576	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296328530277203"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1196	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	chrome.exe
4796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1196	EXCEL.EXE
1196	EXCEL.EXE
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE
1196	EXCEL.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4960	4796	chrome.exe	93
PID 4796 wrote to memory of 1576	4796	chrome.exe	96
PID 4796 wrote to memory of 3516	4796	chrome.exe	97
PID 4796 wrote to memory of 3516	4796	chrome.exe	97
PID 4796 wrote to memory of 4316	4796	chrome.exe	98
PID 4796 wrote to memory of 4316	4796	chrome.exe	98
PID 4796 wrote to memory of 2556	4796	chrome.exe	100
PID 4796 wrote to memory of 2556	4796	chrome.exe	100
PID 4796 wrote to memory of 3988	4796	chrome.exe	101
PID 4796 wrote to memory of 3988	4796	chrome.exe	101
PID 4796 wrote to memory of 3876	4796	chrome.exe	103
PID 4796 wrote to memory of 3876	4796	chrome.exe	103
PID 4796 wrote to memory of 3624	4796	chrome.exe	104
PID 4796 wrote to memory of 3624	4796	chrome.exe	104
PID 4796 wrote to memory of 3304	4796	chrome.exe	107
PID 4796 wrote to memory of 4624	4796	chrome.exe	108
PID 4796 wrote to memory of 4624	4796	chrome.exe	108
PID 4796 wrote to memory of 4548	4796	chrome.exe	110
PID 4796 wrote to memory of 4548	4796	chrome.exe	110
PID 4796 wrote to memory of 2112	4796	chrome.exe	111
PID 4796 wrote to memory of 2112	4796	chrome.exe	111
PID 4796 wrote to memory of 3364	4796	chrome.exe	112
PID 4796 wrote to memory of 3356	4796	chrome.exe	113
PID 4796 wrote to memory of 3364	4796	chrome.exe	112
PID 4796 wrote to memory of 3356	4796	chrome.exe	113
PID 1196 wrote to memory of 2320	1196	EXCEL.EXE	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\decrypted.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbfe4ac728,0x7ffbfe4ac734,0x7ffbfe4ac740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,3456140492865934050,4420434715436944506,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,10839873110821161482,195702949831046145,262144 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,2033239555712571473,14689475345170036012,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,17865705364078432469,13983203242866247969,2097152 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,7124620457984145216,752120633128794826,2097152 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,14457259155136736090,12073806089706806925,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,7255493721419059186,11925428063412884091,2097152 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,10946644050374774189,11147770972322907042,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,8772445833411836953,14864612628767621528,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,13315059282090506787,6118537463405022234,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,6895522981106451786,4448247541657282762,524288 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5924,i,3994012402297791376,4047244826011790250,2097152 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5540,i,6088204592777223504,16552398705766633811,2097152 --field-trial-handle=2052,i,16479774976611060389,12555633289287272632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:2
  2⤵
  PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 31d74349525c69bae67c4831c39bfbb864f5b8dae7e1d1bc20efc790c2c4058c
MD5 eaefd7e36bc1a39c45bf02472df44614
SHA1 b4c80943f25bf7ebe054f82a0d6d6b69ef338913
SHA512 d533bbca0ffbf124e4a947bd19158dd92b6d63c884c043c52729706061e3d9fa3b4fddefd5340e63128fbbc18495bec5c860a08ee78b09a922d4609fb460d1cb
TLSH
T1C4E0E5AAC861E83B18FE071860614645E650139B2691595F763C950C8FB0A3A9695C5C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 43d0a43cf715f4259a507ddaf51bfb7638740ad7ae30ae3ccec71983b09d80b0
MD5 fce99a11e1b3056f339fbe6ace00f0dd
SHA1 b4bb4b457a66ae5fc9e41c4754ff9d766c713ba3
SHA512 ea43e268d373f5af35e1df9f625e1271278b7d3a7fa78ba7d733f007c17e505e0451cd7671c7bfccfc5a39d4bdf49966d82a64201cb61f480de4565c7284ec54
TLSH
T19B5178F7D3E4CA6DC95152E8DB216E1FCD3D0A15122D3C6288D8AE5B43E2972D21538F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 fca8903afce0e568bcfe6c2570d3661bb211986ebf0837e1e97d06d9c1e33b05
MD5 3aa178b85182ddd576bbbb3beefe96e0
SHA1 9091ab72a09a7578ad33c650dc701124bab0c36b
SHA512 7aa12238327795c61bff4801aeaea1e22c91053818a79eb03dab6816c7dd22ca0b1fbd85cb4032ec873534fb6f214b554645de256b6d7be0829643c108ee46da
TLSH
T1D1F059ABE76D746B00B944AE1E00BC0625B5A436414028E4CE9BC27CE0965F31B1A497
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 45810c5fdbe3fdf068c8c185a2ee9c20bc000ff18009a88be4bf4a3241956f1b
MD5 3dc214bba07d7d091c2bdf2f3be1f63d
SHA1 a7e7470e859572d2cce18e206da3e162e2191b4d
SHA512 f4c733b4a34b998e68de5bcec6a042294324cbc61883cf1119c87ed720d0c7c3aa5df698d3533042db4f334a04a5fa6127db0cc0a6e9347dc20baf6850c2aad2
SSDEEP 192:DRxiHaVv72vAPRp299THsb+WNnXg0AbeUAUuLVyIsnAUge:DRxi6lC6XuFwQ0YCe
TLSH
T1D132B72EAA10653B5CDBD219FD617B57E7F6103636D42E80E6FC892C14D7ACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 44a2a326961bb69b1d5a0dba71693d5fe83457fa7d2258759f0d1876348745f1
MD5 d90d76bad1e3aea77e485515f13360c9
SHA1 7fd14d92e405bdb3cdf3d97cfb52103b8355830a
SHA512 cbc31b50f064be7413619c9441be1094f4c767c61defd855058c9c537b13fb3b99d13467c2aa1b12420481e6471f6b673d9db4bc0686d8651bd6a92368d62e95
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3OFHGwIB3WhmPKoUA:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHL
TLSH
T1FD52E967688D963F0FD8C68CDC167F4FADB5019666740C2896FA5C08039A7CF115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 11cd4c2ebb2b28d629ea1e742af66aa49ed38d76ddc2a4ce550535ca6eb2b943
MD5 920b43c6f4a35074cf04312daabf959d
SHA1 807efc77b847130002fe286ce70f84184fb6b057
SHA512 7baf73872004e307a2eea6d830453b0a5bfbc8f8d4c5ea17f6b6360a3b86a4596bdde0580ee157af7b217ace60805cad360f13283f5d37a4bf5987cff6d606c7
TLSH
T1CFB0121050010015D940C1F16031326323352D4C9812338594DE8010AC1728550A060C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ce72.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59ce72.TMP
Size 72B
SHA256 2bb2d17118e168e446d3024512bc22b18b025ef5fcc3c46bc37c883432aee533
MD5 9c610186759fdb8d441ea0f7d7035f6b
SHA1 9ca196de9e956ede2b879a5f77fffeb1a384eb06
SHA512 1f700fcfd1fe6056132a791a5350ed9451c9b30e8bb226f7a5ce69f3b1e37840aa6c222144e8f9b43c93d2c6bf40f5e82c34525336f29b11703aaaaef80db494
TLSH
T19EA0022452404111C5115A70A0E1128172B3D95CB566060385A714A9EC693804543900
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e5f5817f28ebd1093e4207b0bdacddfcaf4f30c4bdf69cd663a092c3e23f40dd
MD5 83d5cd8f2149f34f9bce87aa8d82b9c2
SHA1 92f92f257c0e63d1dba509db06f750399e5d7e41
SHA512 04f0d1e60c0c2c4db87340b177ddc3b60fc6485837b6d6c588cbc117b39eacda65cb567a94526d1677167876196fcccd1cb39bfde13ec2729a4178965a877c10
SSDEEP 3072:+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Zm7Rkm1tYpBeh2BAom
TLSH
T186C3123B5E70E9775979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 334b87d4db78c44bcac3fff70160772330d6a6ebb622e32da580689f00470850
MD5 c7bb03435130fa8fa968963d76faa642
SHA1 47ef5f252c4912535641b198800537509f889c28
SHA512 badb1c4d7347374088384419f95e2bc6a56c0a7eb318ef4cfd07b785adcb80be59f354de8d2a8b6e850f2deb2af4026c29cb7a046fb0f93f30bf45817a19a560
SSDEEP 6144:ZuBUb9VgUEcb4/MsIT+CvZB9m7Rkm1tYpBeh2BAoc:Nb9VgJ/OTZBU9oBGcAoc
TLSH
T1553412325C21BC7714FD932FF08E1E2F2FF1CAB689D0999689D69B0027E9BD11645970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 fd53da91ca7fb3852abb2753f7e9a26a94e68c4afcaf1c01b076d6db70c58dba
MD5 e932da7c82a5feee38ed2817af5d3716
SHA1 827f4302635444f3984418582f2c0019ce09d977
SHA512 25dcb633c1eb3fbad8d326db183e25a7a919411cab8bce4d35e10f3ddaf0894ac290ba86a6fb8ae593e5e47b61b4826c80809aa97424c1030ac894645719c5b9
SSDEEP 6144:Y2BUb9VgUEcb4/MsIT+CvZB9m7Rkm1tYpBeh2BAoc:Mb9VgJ/OTZBU9oBGcAoc
TLSH
T1C93412325C21BCB714FD932FF08E1E2F2FF1CAB689D0999689D69B0027E9BD11645970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

BCA85667.emf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCA85667.emf
Size 6.1MB
SHA256 12b4ade43a311d368acdd5ec1791601cc0d021fb66141e730e9439911534d916
MD5 4b71fed2ae1e5328522f9b2fe4c32334
SHA1 cbce5969230bc65b4cf8d3cf750a1d11d7fbba2a
SHA512 81adb52a5266d8c39763730f8cae7799632b1369bb3db2c74943ea4475ed7099929b09f2298b892c21f25724432e1dafb8fdf2baccedb09a1f6dd437a8e77dbc
SSDEEP 6144:scaebasCC7+Ce3Or6PDa4ueenz9yW9FLYctxBUwPyDg2tKqkOubcOk4BXYzS+s5J:P4RksWxTbW86s+MVs+MK
TLSH
T1A556E9D9BA40A310D5AF92309AFA89F71B31FDA5DE610F0A711C737E787221139A139D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4796_1579387165\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

fbe32427-995c-4a41-8461-e5b1d456a41f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4796_1579387165\fbe32427-995c-4a41-8461-e5b1d456a41f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 3KB
SHA256 0b1b43d326b97644dbff3c13826cfbf4780d4974ae2704e0f5cb1f915b6f9438
MD5 ee8ae2ae14eb5785e40b49585f39985e
SHA1 884a144f61b465dfbd8f488e3d0086f858a2fa82
SHA512 8204bad965c8d383d3eb0c81795121a8253c7b84dc2a5f4fc72263e62cdbc70e11d772418eb5b960a6bddca8b6eaf1ea15997927eac88addbd9b4c4ca2b0903b
TLSH
T1566133420EDB1F17D060827A7E2E6B23E7703D13C704E25EA584359F6DF1A404A6EB6B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-0-0x00007FFBE0C50000-0x00007FFBE0C60000-memory.dmp

Download

memory/1196-18-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-15-0x00007FFBDE400000-0x00007FFBDE410000-memory.dmp

Download

memory/1196-14-0x00007FFBDE400000-0x00007FFBDE410000-memory.dmp

Download

memory/1196-5-0x00007FFBE0C50000-0x00007FFBE0C60000-memory.dmp

Download

memory/1196-8-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-10-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-13-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-12-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-11-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-9-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-7-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-6-0x00007FFC20BD0000-0x00007FFC20DC5000-memory.dmp

Download

memory/1196-1-0x00007FFBE0C50000-0x00007FFBE0C60000-memory.dmp

Download

memory/1196-3-0x00007FFC20C6D000-0x00007FFC20C6E000-memory.dmp

Download

memory/1196-4-0x00007FFBE0C50000-0x00007FFBE0C60000-memory.dmp

Download

memory/1196-2-0x00007FFBE0C50000-0x00007FFBE0C60000-memory.dmp

Download