30eae1fcdebe6bb72b1a15dec394f31c01174164d92df0ea05377cc684438d4f

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image_25ca8c48.png
Size 2.7MB
Sample260730-vxtbwsdn71
SHA256 30eae1fcdebe6bb72b1a15dec394f31c01174164d92df0ea05377cc684438d4f
MD5 572886cacb9e7115ffdf77200e04e93f
SHA1 b24ef82a4400892fc681052b9a932fa6fc8bea88
SHA512 548c69eaf5d1abd0a0c6d8f23ea22001a0c9dbe8f5375f3994f140900a387f849c496f3cae92fa86f26122bf1496e42788bef220a605522738af274f9b018de0
SSDEEP 49152:DqVQj6HoKZhruTxPKYSA4B7zY2/SONE3j42Cm7heIJo4neN:uZduTuVz/DET42CSTnneN
TLSH
T130D512F421CD8D517BA43064E859DC28B2FA054852FCD3F0689FB5A9A5DE73601E8F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5864	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299057705544450"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3156	mspaint.exe
3156	mspaint.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3156	mspaint.exe
3156	mspaint.exe
3156	mspaint.exe
3156	mspaint.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1640	4444	chrome.exe	94
PID 4444 wrote to memory of 2120	4444	chrome.exe	95
PID 4444 wrote to memory of 2120	4444	chrome.exe	95
PID 4444 wrote to memory of 5864	4444	chrome.exe	96
PID 4444 wrote to memory of 4764	4444	chrome.exe	98
PID 4444 wrote to memory of 4764	4444	chrome.exe	98
PID 4444 wrote to memory of 2276	4444	chrome.exe	99
PID 4444 wrote to memory of 5072	4444	chrome.exe	100
PID 4444 wrote to memory of 2276	4444	chrome.exe	99
PID 4444 wrote to memory of 5072	4444	chrome.exe	100
PID 4444 wrote to memory of 4676	4444	chrome.exe	101
PID 4444 wrote to memory of 4676	4444	chrome.exe	101
PID 4444 wrote to memory of 1284	4444	chrome.exe	102
PID 4444 wrote to memory of 1284	4444	chrome.exe	102
PID 4444 wrote to memory of 2320	4444	chrome.exe	103
PID 4444 wrote to memory of 5540	4444	chrome.exe	104
PID 4444 wrote to memory of 5540	4444	chrome.exe	104
PID 4444 wrote to memory of 1460	4444	chrome.exe	105
PID 4444 wrote to memory of 1460	4444	chrome.exe	105
PID 4444 wrote to memory of 4268	4444	chrome.exe	109
PID 4444 wrote to memory of 4268	4444	chrome.exe	109
PID 4444 wrote to memory of 4508	4444	chrome.exe	110
PID 4444 wrote to memory of 4508	4444	chrome.exe	110
PID 4444 wrote to memory of 5752	4444	chrome.exe	111
PID 4444 wrote to memory of 5752	4444	chrome.exe	111
PID 4444 wrote to memory of 5000	4444	chrome.exe	112
PID 4444 wrote to memory of 5000	4444	chrome.exe	112
PID 4444 wrote to memory of 5248	4444	chrome.exe	113
PID 4444 wrote to memory of 5248	4444	chrome.exe	113
PID 4444 wrote to memory of 5256	4444	chrome.exe	114
PID 4444 wrote to memory of 5256	4444	chrome.exe	114
PID 4444 wrote to memory of 3464	4444	chrome.exe	116
PID 4444 wrote to memory of 472	4444	chrome.exe	117
PID 4444 wrote to memory of 3920	4444	chrome.exe	118
PID 4444 wrote to memory of 5236	4444	chrome.exe	119
PID 4444 wrote to memory of 5632	4444	chrome.exe	120
PID 4444 wrote to memory of 5632	4444	chrome.exe	120
PID 4444 wrote to memory of 2932	4444	chrome.exe	121
PID 4444 wrote to memory of 2932	4444	chrome.exe	121
PID 4444 wrote to memory of 488	4444	chrome.exe	122
PID 4444 wrote to memory of 488	4444	chrome.exe	122
PID 4444 wrote to memory of 4992	4444	chrome.exe	123
PID 4444 wrote to memory of 4324	4444	chrome.exe	124
PID 4444 wrote to memory of 4992	4444	chrome.exe	123
PID 4444 wrote to memory of 4324	4444	chrome.exe	124

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image_25ca8c48.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc6616c728,0x7ffc6616c734,0x7ffc6616c740
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,14211149096131606665,2977037488236071988,262144 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,13129195042896133006,7275909491477411989,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,516148457632417548,4389317468646102021,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,921971740992458518,9864616542778906133,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,6353197015390578,14116090561052693284,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,18255425416741038874,17754539794508742225,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,8735865107146598825,14140713911935894416,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,10060114145212855377,15911570049797241245,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5436,i,16516480144130272631,11534607310690637118,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5496,i,13986044957369040374,8338723578689853057,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5544,i,14467254059738019653,7040184953292896798,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5564,i,5577448182793225249,16733429975592451669,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5104,i,2121635713785297409,5504351809166737506,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5736,i,10701168378871748752,17060197128368226606,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6136,i,963383244553381765,10952185020136499092,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6168,i,7033445249519609346,14321748981630060263,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,3856011199984365266,3876810325566747177,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,1203800654915700892,4048862247159042147,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,9775573838708730343,4153905290082687759,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5852,i,11870407038815815612,12834783701204901543,262144 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,16867485422372451483,4747058174160428685,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,8752570351653803984,9153609690806206627,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,7329772847252726562,10100750816776977350,524288 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6280,i,14287523035669273222,6484735096373537857,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4748,i,143059737663631143,15856107396531342370,2097152 --field-trial-handle=1804,i,17419087418335825306,2426347989662977957,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:9
  2⤵
  PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7dd17bb7749ff8814488cb7208cf6b568738620f3b168b4154445ad303daf097
MD5 073f2369e33f7e5598f57b90e43d90eb
SHA1 80664bd31abbe7bd4aa160fb9d66f029d8b30d78
SHA512 137c002809e0486fcd3906cf79314a0a50642638218a97a8d586030dc8cc9f241d4106d5099c2f05c2f84b21e24dd4c86b1dfff2ad2ab604bfa0f23dc1d318b1
TLSH
T10FF0F9B5C925AC3719FD1B5920940B46E751136B2B41445F363D560C8FB0A3B454681C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 24f7a16c5c2d5a67ea0eec8abff830423b1266180715b56f3c8dd51bce4e98a3
MD5 63d6354e729b8964bc806a9faadeded6
SHA1 fb9abad1228bfdb98c6849603e38d8884aff8172
SHA512 b4245021c137cf596e1bf7cc16679a03abd216d8ea9832b2a4d7fe44224aa18401399c380aab6678b08518290a8cc0c801290dcd85874e29dca711c34137070f
TLSH
T1C25169F3D3D89A7D881156E4DB21BE2FCD2D0A18521C3C66C8D8AE4B53E2972D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a0984f95b37d1ec9dc168074541b3ae6c6c08e595d7b07eaf78b98dae48edf86
MD5 ec5f8fed667d2490deccb7a165f12fe5
SHA1 0b100a92dc57a266d48f6f193171470d8afe530e
SHA512 2f58a1faf7f3ec38a2c4088efb59c6f7bad05dbf274c0813b6a5fd5a278cc04210081cfccc694bab5c265c7a3171f56f7b739ccac9ae2589c24ebe3bf2fd9299
SSDEEP 192:AOR1Qulqg/LGv7xAPRp2W9SHsb+WNnyJ0u9ykkwiVyIsnAUge:AOR1QulzLyIXFEwY00bCe
TLSH
T17C32C62EB910693B6CCBC22BF9257B53D7F6102575942E84E7FC8A2C24D76CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 783ac1bf95705e6b901a0f2eb091bf625ddbf756f3acc65d65581db444f98854
MD5 72cc38e8f49fd6a208511fc2d0533bbb
SHA1 d05ae51db54a2491314276468c83c4eaf75f4324
SHA512 fd00f7fc1c380c1af1266598cce06fecf7867ead5e2666ff0bfc97c11358cac685abcf90ac1b14bfec488d97f5eaa64bdb8c952d16e4e056ca4fcea35d9c524c
SSDEEP 192:AOR1Qulqg/Y3v7CQiPRp4W9SHsb+WNnVKtY9ykkwNVyIsnAUgE:AOR1QuljYfO/XfEwktKb7E
TLSH
T1A942C62EA910693B6DDBC22BF9257B53D7F5102575902E84E7FC8A2C24E76CC631B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f05805c7f45c0708c86fd21030550e7ce216a2ee68faa620e6817ad1e6c0a03e
MD5 2ecdbed74e4c6d58df07de27e886abd0
SHA1 1ce44aa05e611fc628258a83ce8f9e0f7d746a02
SHA512 5e6d4a61e4fc6bb5184ff68dda77f9bda787b1bcf27817a1b92ab79b2c9ec7a44da1664ad4f22d8f6715bc2608675d86e91293f0e3537932ae68b4d557853876
SSDEEP 192:AOR1Qulqg/bv7xAPRp2W9SHsb+WNnyJ0A9ykkwhVyIsnAUgE:AOR1QulzjIXFEwY0ibnE
TLSH
T1E432C62EB910693B6DCBC22AF9257B53D7F6102675942E84E7FC8A2C24E76CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e679535c23428aa45f3913dad4e827a29a29cd0ecce8ff4b74beb988b5ad0ec7
MD5 b05cd79cbb41a14f2189456d8a563024
SHA1 c86ecb4aef06223c58af3656df85d84e0bb06c19
SHA512 f0228aac6b92c82e7797049dc8af923d74d1b9259d0691e1a596023136ab7525ee203daf4fd84d637e1a935e3cabd04fb45ceb6df5e4cd815c546723bc310327
SSDEEP 192:AOR1Qulqg/ZNv7CQiPRp4W9SHsb+WNnVKtY9ykkwNVyIsnAUgE:AOR1QuljZtO/XfEwktKb7E
TLSH
T19842C62EA910693B6CDBC22BF9257B53D7F5102575942E84E7FC8A2C24E76CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b266ef73009eb717640e5f35377652952f1cbbd1175594d821bbda31d7fce49
MD5 ac87a3d361269f49ca2b02f6e4a75db8
SHA1 7efc08404b39c07934a30ad284ea4f85b67de08f
SHA512 941040e968b06b1f8de60763b3cfca91383d361f137057bfab3aef7e23782bdfd0001419cc5da00bf9abd2c9ebd6914e21fa7d64c10d6f927fc51c60d802c874
SSDEEP 192:AOR1Qulqg/56v7tiPRp4W9SHsb+WNnyJ079ykkwNVyIsnAUgE:AOR1Qulz5WqXfEwY0Zb7E
TLSH
T11242B52EA910693B6DDBC62AF925BB53D7F5102571942E84E7FC8A2C24E76CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e63b1b62b805a0f6f60e6f60bc219126af976c0c7cb7ad6183f12cb86d1c0ca0
MD5 a9240e84d205ca66e78062c6d6d975e0
SHA1 5c764435c048bfaa83c9a7edf92aa24d3460447b
SHA512 2c0fe6cef76e493590b9e87dd2a7e7267f0bc3533eca1e115b6b23fd13e53b5a4084ee85feb7992c0b440fb8d0268e4c5703a7963594bbe11215c0aa72b8be4f
SSDEEP 192:AOR1Qulqg/03v7CQiPRp4W9SHsb+WNnVKtY9ykkwNVyIsnAUgE:AOR1Qulj0fO/XfEwktKb7E
TLSH
T18342C62EA910693B6DCBC22BF9257B53D7F5102575942E84E7FC8A2C24E76CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e4b26880474f9822f2b7bf7e8e6058f6bced82f94f5397060b4ca30c62b71426
MD5 74cde4756f08cd5cce01c4f90a20b8a8
SHA1 4aa1154905d2efbfd1f8f92961ebe18ac8bb0a30
SHA512 5486ae578660c4e7d877d242bce7513106aea6ff5ee392da218da60961e2ec283a0c130e0af3efde6e84476dadc36155f26329a0d41a9fe24a5ec5633acf4979
SSDEEP 192:AOR1Qulqg/Cv7uiPRp4W9SHsb+WNnVKtY9ykkwNVyIsnAUgE:AOR1QulzOlXfEwktKb7E
TLSH
T15742D62EB910693B6DDBC22AF925BB53D7F5102571A02E84E7FC8A2C24E76CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7c4ab6db4616772f3ad9e4419f8c592340b21abd0f27207a5acd10d4f20045ee
MD5 fbb2244c01450479d140ae20f7dc706b
SHA1 fa506082d7a20a69e05e43e658fbbd86bdf8d9d7
SHA512 b4b0dc489a38c3c31ef03e4a98f9cb75246d23b1fe61367155a0c7bba72f593851160ffc30a1e95344be719259a138f6fef92089e9a808f98c66cc6a4f6c61da
SSDEEP 192:AOR1Qulqg/+3v7CQiPRp4W9SHsb+WNnVKtY9ykkwNVyIsnAUgE:AOR1Qulj+fO/XfEwktKb7E
TLSH
T15442C62EA910693B6DDBC22BF9257B53D7F5102575902E84E7FC8A2C24E76CC631B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 585970edbaebd7e105bc13a32bb72982eb36878e9a6399c60fc461746f83efaa
MD5 6d610cc5c62fcfe8d6e2d6791b7a4437
SHA1 bf98a79c38ff66ac9b4829cec486dd138c22d970
SHA512 bfe7745a8810a93d441ec3b3a47b27fe037d59d9a7d8bd5569e5e1bafe5910b8161ae735bbc59522a12248c642db4a239a1037552d8aa0ce92660fa0b78e55b7
SSDEEP 3072:wXKZxSJPZzrI/gH55PunzT/sBaCIjIpH25tgsgh/:wXKcPZzrI/qLULsBaCI0pH25tE
TLSH
T1C2D3023AFDAE4E1B9262D2972041711B1EF52DF7E449BC61F68D2E47410EA786B0FE04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 6feb29409167b3b36dbc56e0e23928f90ab8698f06c9bcdba5fa1ceade385780
MD5 d248e39af578ebe4d678b801037286fc
SHA1 63f7b14a7e36e1f8dd6f199ac976e7f13878e08d
SHA512 8e084adbfeb9b0a8ca0088df47c0730e88c181cabf310092bbd52d027afff0dbaabd9dfddabf055c0fcdfb627ac60208ca1c761c5faaccc2f48b1d201f0355a5
SSDEEP 3072:SXKZxSJPZzrI/gH55PunzT/sBaCIjIpH25tgsgh/:SXKcPZzrI/qLULsBaCI0pH25tE
TLSH
T1E2C3023EFAEE9F179252D2932456720B2E751CF7E446BC72F6892E074109A39670FE04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f6a104a58ea21f71e9be04743f979e41067c29c0435c096f7b70c4e81ccf2531
MD5 2c577f2e5fe2829cae6f0d2bde9b2bcc
SHA1 64a94dd114737c34de8619cf92826b0df9cb9065
SHA512 da4e8d15b2fd60ae9addc0dc1429aa1ca6d1e42dd178dd55e6d4d3f0f241835c56788f98cd652105059f6b0a0a46045fe2606355fbe71a3e4dde2af719ff36a8
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5iA9DBB6EGyvP/e+0bZPEOLv4a:MC08UR5rYv3eDUDiy3gae+0bZsOP
TLSH
T1CDA11977A46A8D7BA976C48571062B43CEB5B07FE521AE94E9DD1F0C01EB0EC1301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 3d89b31dfd70b4e76f4ef14151268c26cb8762e046e64286f2e1f81e0bcdafb5
MD5 af3ec66bed0d4078aa01b6e3add2e5c6
SHA1 9eacab45e631770dac115015255bc56654372dc6
SHA512 1185029517810f71d8e8a77d1f13552b0053b269f905e78da3c8d28ce6f47f8c0318038bfdea75ed6856051e0319d46bca6048bfd942e67dd037e1c08f435f7f
SSDEEP 3072:XXKZxSJPZzrI/gH55PunzT/sBaCIjIpH25tgsgh/:XXKcPZzrI/qLULsBaCI0pH25tE
TLSH
T17FC3023AFAEE9F179252D2932456720B2E751CF7E446BC72F6892E074109A39670FF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4444_1923720974\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download