14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
suspend-3.2.1.exe
Size 1.8MB
Sample260731-kk7nmsff37
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Wine	suspend-3.2.1.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Wine	suspend-3.2.1.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
245	2800	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
2348	suspend-3.2.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2800	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299609348064228"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
940	suspend-3.2.1.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
2348	suspend-3.2.1.exe
2348	suspend-3.2.1.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
940	suspend-3.2.1.exe
2348	suspend-3.2.1.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
940	suspend-3.2.1.exe
2348	suspend-3.2.1.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 1756	4564	chrome.exe	112
PID 4564 wrote to memory of 1176	4564	chrome.exe	113
PID 4564 wrote to memory of 1176	4564	chrome.exe	113
PID 4564 wrote to memory of 2800	4564	chrome.exe	114
PID 4564 wrote to memory of 3860	4564	chrome.exe	115
PID 4564 wrote to memory of 3860	4564	chrome.exe	115
PID 4564 wrote to memory of 4816	4564	chrome.exe	117
PID 4564 wrote to memory of 4816	4564	chrome.exe	117
PID 4564 wrote to memory of 1440	4564	chrome.exe	118
PID 4564 wrote to memory of 1440	4564	chrome.exe	118
PID 4564 wrote to memory of 2040	4564	chrome.exe	119
PID 4564 wrote to memory of 2040	4564	chrome.exe	119
PID 4564 wrote to memory of 5148	4564	chrome.exe	121
PID 4564 wrote to memory of 5336	4564	chrome.exe	123
PID 4564 wrote to memory of 5336	4564	chrome.exe	123
PID 4564 wrote to memory of 5652	4564	chrome.exe	125
PID 4564 wrote to memory of 5652	4564	chrome.exe	125
PID 4564 wrote to memory of 1916	4564	chrome.exe	130
PID 4564 wrote to memory of 1916	4564	chrome.exe	130
PID 4564 wrote to memory of 3564	4564	chrome.exe	131
PID 4564 wrote to memory of 3564	4564	chrome.exe	131
PID 4564 wrote to memory of 5812	4564	chrome.exe	132
PID 4564 wrote to memory of 5812	4564	chrome.exe	132
PID 4564 wrote to memory of 5880	4564	chrome.exe	133
PID 4564 wrote to memory of 5180	4564	chrome.exe	134
PID 4564 wrote to memory of 5180	4564	chrome.exe	134
PID 4564 wrote to memory of 5468	4564	chrome.exe	135
PID 4564 wrote to memory of 1104	4564	chrome.exe	136
PID 4564 wrote to memory of 5468	4564	chrome.exe	135
PID 4564 wrote to memory of 1104	4564	chrome.exe	136
PID 4564 wrote to memory of 5888	4564	chrome.exe	137
PID 4564 wrote to memory of 5872	4564	chrome.exe	138
PID 4564 wrote to memory of 5896	4564	chrome.exe	139
PID 4564 wrote to memory of 1064	4564	chrome.exe	148
PID 4564 wrote to memory of 1064	4564	chrome.exe	148
PID 4564 wrote to memory of 5800	4564	chrome.exe	149
PID 4564 wrote to memory of 5800	4564	chrome.exe	149
PID 4564 wrote to memory of 5960	4564	chrome.exe	150
PID 4564 wrote to memory of 5960	4564	chrome.exe	150
PID 4564 wrote to memory of 6140	4564	chrome.exe	151
PID 4564 wrote to memory of 6140	4564	chrome.exe	151
PID 4564 wrote to memory of 5376	4564	chrome.exe	152
PID 4564 wrote to memory of 5376	4564	chrome.exe	152
PID 4564 wrote to memory of 6056	4564	chrome.exe	153
PID 4564 wrote to memory of 6056	4564	chrome.exe	153
PID 4564 wrote to memory of 5164	4564	chrome.exe	154
PID 4564 wrote to memory of 2348	4564	chrome.exe	155

C:\Users\Admin\AppData\Local\Temp\suspend-3.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\suspend-3.2.1.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8d6cac728,0x7ff8d6cac734,0x7ff8d6cac740
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,2245954158030894506,12272903301389457494,262144 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,8297985848032744890,17067637178988125106,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,3903437113568849626,18149289884407296693,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,370400995397383517,15505315006493289584,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3444,i,11101337028935660729,3642224842210540976,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,6100946436222952527,10174569891438506849,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,16725104206758465448,17436144187236732192,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5416,i,12931552881320059649,821155560941903433,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3676,i,6166461099275453250,9636890008105364730,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3596,i,3196673666552630339,222879256142812690,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3968,i,5710973212855678475,5212111443105739994,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3944,i,9344885814363081774,11833871612652706692,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3972,i,5306286854706058482,7101377452069457373,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,9566497389833447574,1850311566282359008,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5900,i,9561637195550912465,5141567662113489733,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5888,i,3928405076849052768,8102175743926726562,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,16021965625310585721,12578291178504786287,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,1597326304289815447,17042665287710073495,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1568 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,12541851161982255006,8745789292599413818,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3516,i,13198240145508049844,12568174268531831747,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6156,i,17841158890577499511,3289453727659124282,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5680,i,16641293040836958973,1522943944395974018,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=1216,i,18132250151967230948,2051953785642601050,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5884,i,12003902454937215784,2198757302044572007,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6588,i,8285171222924077379,17791120703692326724,2097152 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,6388823709323428089,10269796321532179495,524288 --field-trial-handle=1832,i,14244577310267053734,6731635933098637548,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5164
- C:\Users\Admin\Downloads\suspend-3.2.1.exe
  "C:\Users\Admin\Downloads\suspend-3.2.1.exe"
  2⤵
  - Identifies Wine through registry keys
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5240

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\windivertctl.exe
"C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\windivertctl.exe"
1⤵
PID:3956

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\passthru.exe
"C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\passthru.exe"
1⤵
PID:5500

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\WinDivert64.sys
C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\WinDivert64.sys
1⤵
PID:5688

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\netdump.exe
"C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\netdump.exe"
1⤵
PID:4184

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\netfilter.exe
"C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\netfilter.exe"
1⤵
PID:1664

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\flowtrack.exe
"C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\flowtrack.exe"
1⤵
PID:5700

C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\test.exe
"C:\Users\Admin\Downloads\WinDivert-2.2.2-A\WinDivert-2.2.2-A\x64\test.exe"
1⤵
PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 c12eb4843af7b0e35197eb7a94883c1e98f06a2226b5be555c5b0b01b2769099
MD5 6104bc0ff8f70f25d350813e438f36f2
SHA1 9b1f5d8979e214cf2012b3715f1789ed68e42a13
SHA512 20a4f48ed45c62ff99481fe3853a9a2ccc2cff695d33dc34b4d02f142f616e21392de82d051af37c24da3c6d563ae09a5e31f8c4c20d51e9fca88f952a8ecb7f
TLSH
T156D02BD996B678E37E73DF8045EAA978380262B311911A215C18812F5B27535970A511
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 c0ba4d9c02b99a153f7f585de0a35bc109cb4e1fa172cba28bbda66a01e23489
MD5 e174074cc7bcba66b71fa8912d5a1bdc
SHA1 e96266d5485043b8748e7fae36333b816a738166
SHA512 3935b4a778c12718ffc9e17110a8f22ae5dc049f6962177fe59e40927a301acda08d3d88c7457a87e10990313789bb11a049bf48d0a9b643011ee150b31a3ce3
TLSH
T1B4E07D02530C85D27B33C41016B68C767C66800E00C6639564186AC0094927BCA0B41E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 6a61aff33ba7937a26b0934281536b060f54ffb471643277cb2171f6b65c7350
MD5 b270b1378adaa3733a84190e6d454d4f
SHA1 fe47b23b08070e1f67dfca10d08af99d269f435a
SHA512 741ff78730bb58bef512dae5e48fb33e6442416ad5915f7d61f0679725971e187fd3a7e7c59e434088c58003c3403d969ecc8b383e3af879257d13ae5302c1b2
TLSH
T1FB1154C35EA4A0D089F35664CAF8C5367CB970C128EE74C12CC2C492289B72D7B5543F
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 b75c2dc73f6a31388a7cf3653bf8b440faf9d689938814d67190e90acb2c1144
MD5 995170e387bc0ccc97e2c7281d1ff2be
SHA1 c6f062eedd5dc79db1038fef1da746aefde07cbf
SHA512 c5a93bec5932c7b4e485b62146476c46b971b2a4cbee9283140be8bdb2902cf2a2aba918285152f4c51913b2ccdd41e01c83e33f9706077d35dadad08005a286
TLSH
T1D8F0A318347C4024E0BADD74CBE5F1559839F218AC1566BA17E3560C6B45D011D93A3D
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 4b967c130fa3532c9d4a1c13f5e7f89c31fa162e8b24f20497ad5d5618e9127b
MD5 d5625d5f63def4179aa79da6266605db
SHA1 591f355d35f865524a668302abc6465d331e215c
SHA512 63d3bd0981ebfcf3d12c964f75316a48851fd198cfbea83042d5cf76a59faef667e12122d352d017db9839080c545d49e5bcf271fb3d3a3a9f6a0157ad02182c
TLSH
T16EF05C2C0BFC4A6DE176CABE8BD572953905F227380406AD1FA24B4C9A46A419C80438
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 adbc60cee4bb65c0ee638b82f4e5c4234e2ee9d80cfb83c8acb94441a68597ea
MD5 afad3ac14ef0b62fd5ab376f82e6ac1d
SHA1 8d438b10f71dd77e38a6e5e7d3f2b72216110c79
SHA512 079771291c38d5d54516bc31427c6a378562e8d2f537a6abdc957c884e7cd4398adcf81636db7b020551848ea176ce16528b714e81c7220e2d8dc81d98f4d908
TLSH
T1BFF05C282AE2413DE27667740AF4639E5C09F3113405C96126A50B0BEA47F005D11839
MD5 SHA1 SHA512 TLSH

Submit Download

330a514a-b4de-4b50-8557-6f609502666d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\330a514a-b4de-4b50-8557-6f609502666d.tmp
Size 12KB
SHA256 f435834e05ec37aacfc65360299def7e816d1334a9469ec652bed0d5f9aa156c
MD5 ae240360530aaf893e5c3cce6f341fb1
SHA1 f94f250e0ea50da7960e256a47304b6572da6a93
SHA512 38bca950adc36bcabc48d9db8b957f373af33211ae78bfb15dc65b8d878ac8220bc4d96d9db1460a579f72c331519793fe49eed566dce2c5bb34c52a6fbe81be
SSDEEP 192:ARtcBzwH/y/1v72vAPRp2+vS9THsb+WNnYH4jo2SNWXVDVyIsnAUge:ARtmzwfy/FC6XiFwYj2yCle
TLSH
T16542C81FA910293B5CDBD216F9617B2BE7F2103276D42E84E6FC852C14E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1c70c1458ef2af7c5e696f4782d405e2e11271f89e2d857536a20d868f792926
MD5 66d286456dcb798d9206f59ffd7b1e82
SHA1 c1480815ea087c61bb5645f859e819f9955242f4
SHA512 234e0416c5f5aa192520fab26c6605bfe5a4cba3ea57f652e63c599b1d653100821a421ab312dd24bd97fd51b533f0b26126b57a1699ef85fb9e547049dcc472
TLSH
T140E02BBACD61EC3B28FE0B1860664745E614136B3F805A4B7A3C860C8FF0A3B5645C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 42a879a16576a696fd3aafb7f3c7ef70a400d5ba1729aff0cc87d1d5420ec203
MD5 0a8aacf57ad717b1be45a4af73f95da3
SHA1 dfc1be76b670981576ffc64bc94fc51293417df0
SHA512 b82e12c47606ecdb76cf17688dc319519dd4c3996004e45fd2980d03c0212b5f99ba82cd294f4a1931f93e618764de8bee26100ef873963a72f37e4d7c077d6d
TLSH
T19A5180885635E0EDCFB4C53950C7C8A5B9747BE091673FE2CC2BD2F40D7A3964052804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b5c12f9b1822080ba271de684c7642dc146cdfca877bd0d98ee39bcc9ef40cc
MD5 f8db5a41574f73a5080e6abf6b8544ee
SHA1 3da550fff2902d3e2b1952c285fa14497eea5c7d
SHA512 658dd21bf6b2e690708fd30b3d37122c3fce7cb890f1de6723ade48efcba651dbb42516fc6a78dede1c150007a4341f51b30fbc1756fefeafb9d7c32381de413
TLSH
T1B9812A4EF936DCB7CB74C9F3148FC0247878BA9409373EE2481BE9F285B2B864260449
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cd69494d5c7a9e4623c814549b674b33c1402bf028346e1be822f8c534637af2
MD5 c86f3703b02540eeb38133b701599198
SHA1 a4f34d8846e37b6e59490ad5207319f3f1c6f993
SHA512 2c7ee1fad001ba5d384bc5c4f34a133d9411fca1337d6e6ffdc6c476be498185892cd8622bd4a2dd0716896be378ebe1457180f1e3ecf1c61e8f33c8d9a5269b
TLSH
T1593168B7C7D8857D890156F5BB156E1FCE290D14532C3C5AC8D4EE0B53E18B1D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d6fda16b6b5e006e1c219c0d55549c29f24003c0670af9837195c233bd13df19
MD5 f5d741cbca2394319babbc0a49b80950
SHA1 8f33026ac71a73e85064592e4834db16fff43d32
SHA512 1f5ba991b54d43dfda0ab34e9cbc544b1957bb429cef729ace44edf116538263ed19be52bce5788601d997e8e1639acff13eca2ab943ddf59d3aabc402c1fafc
SSDEEP 192:D8ABSmXmioICrU7+LoIwIFInpGrZm9mmmgmBa0mzm/K:D8ABSmXmioICrU7+LoIwIFInpGrZm9mg
TLSH
T155D1ADF7C3E5862D894156F4EB15BE1FCE2A0A14432D3C26C8E4BE5B93E2871E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 63149798fb541ab1005ab899d6f82b6899bc8434bd2985ccc6263825c250c0b0
MD5 b730f1d98270650fbdfa2bc7741edb3a
SHA1 206c630e0ed4e56c1e8e4449122bd361dc1e2b19
SHA512 b5fc225d7662e4ba2019971a0c482c125518b0a074604b519a97c5717fb3d0efb34aad320958eac1d8948f21fc4ec86913634fb301923809a57bfec2ca98f7e5
SSDEEP 192:GRtcBz1H/yA1v72vjPRpjil0nSM9THsb+WNehwsgBGWW6NWXp7DVyIsnAUgE:GRtmz1fyAFCjXfFwd9Wqi7lE
TLSH
T1EF52C85FA410197B5DDBD216F961776BE7F2203276D02E84E6FC8A2C14D79CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2da81762fdcb186d51baf0f003f50cd89237710ea4413b748b15145b1abea6f6
MD5 f7c290c381197116ad6b3e342431b0cf
SHA1 343f9d570b0dcd242d610496893e9c5fd8190a24
SHA512 14c9d1413eeae530ac5ba9ff3fd656bfe985cf8ea3bcce004c3fff456f23e020f1539999ad2f82000cceae122b06c146fc970cf4cb46a52af9b019643ff5f952
SSDEEP 192:ARtcBzEH/y/1v72vAPRp2ilvhS9THsb+WN6iYH4jo2WNWX/7DVyIsnAUgE:ARtmzEfy/FC6XEFwKj2m27lE
TLSH
T19652C85FA910297B5DDAD217F9617B2BE7F2103276D42E84E6FC892C10E79CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c820d12e386111c2d630adae59ab3e934c2077ab3f43e73b8d2c5a98c9986e01
MD5 e2ae2f8d0072c3aaaa2ec7201973118d
SHA1 6538cf2a17efa9ac2af3bb78b55bffd1cc343589
SHA512 69011def2867061db7e1a581cb18cb1976eedcd288baf7113c1941a772084838ebf9eca0d26d6fb8a92eb120d8d3c3f41010a2a509af5f09bf2c6830fe0728ca
SSDEEP 192:GRtcBzEH/yA1v72vjPRpjil0hY9THsb+WN6isgBGWW6NWXp7DVyIsnAUgE:GRtmzEfyAFCjXqFw19Wqi7lE
TLSH
T17852D75FA810193B5CDBD216F9617B2BE7F2103276D42E84E6FC8A2C14D79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 abe9650781e2e8d243c14a44e5e4706fecad39295e165eaecdbd021dd68be401
MD5 af99c50412a1f24502b6e602dc562e02
SHA1 156df19bf721ff805ea406a47e8129bd31f65963
SHA512 c0b608dd538d32a3cf8d950cc1c9866847ac6d5997ad71fbe4a05db8334b0fe046efb94857d596376ba414962a39580db034b572e9bc1236110100d94eae851e
TLSH
T145A0021401551263E00D177C108656D72311597103C54AD14CB5D0C588705928735844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9234f00642e239ddf5715ed07d3bbab512e3d9cde0a6f956e7382538d86b1a9a
MD5 0ddd983c1727b653e9512d6a19148c6c
SHA1 09d5909d49929467c4f70b1daea39e63727db299
SHA512 3db99f64aa6fe9a933de9b5c168f6ec8f5f5a336417a1edd9c60ec46a8f6ade4058bc523a28c216992ffd3bdd6261dcc2ba525f8bb1913077ac58b3ee233e7db
TLSH
T199B0118080A00802EE382B3802CA088332200820A3E28A8300A208828823A832B22A00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 be0ebb911a05793ed1be8190047408be6e4a20f770ca85adcf750cecde6d914f
MD5 6e68263bc47e3614f6a1b0ff537cb783
SHA1 24411221101f032a494aa781af7331d5c2f835bb
SHA512 4c837d49b60698d12326daa1ada6fce7150ae2998ceaec646d6a9fe25db5f0a3d8c6d4faee1ec30174f377d104470ab585fc6ed9fbfe789eeff5da14fe5056f0
TLSH
T11DA0029841C04411CD844272A062098567A6A9696F95D30355DB1448DC6F1C19141920
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a51da.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a51da.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 1143e6ded3c6565bbf1162b2271a5c0e590ba35aa904d678864b4532b0d6054d
MD5 a65b980b216c4c3ef4e9c3f71591cd98
SHA1 8c204420c7cccf95183bf8af990cefc001bef0aa
SHA512 cdb4bae64dce6c09e11e176e0beba354567e2bc0ea3a3df22978fb2fa2eb0261a23676a3cfcfa461d12577211df8b1cc026b3d0d041ab67d4111075d4f5ce50d
SSDEEP 6144:wEBVvNMFEH3+lDP2TF/6HlXqrrkenaW9DLm7Rkm1tYpBeh2BAo8W:9BVvNtX+0h/6HlXSrFbK9oBGcAo8W
TLSH
T1ED34236B6F746D3B87E4F75D704E1F2E2AF05E95CD18AE9640E86A00335E5C74F09828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d62aa6b09d54dc8cb18ac2062b48475f120e66936f7f70c44fed3b09d786584d
MD5 bac78bdf82b07ed5daef58025559b441
SHA1 76b4079233d53fab47ea9708d04b0c2cb9ff980f
SHA512 3af8c348ea9c1e3c5397dbbb367d54a15be1afb1d83e80606f6090a46aaabac82e965c882873e60e4fae26bd4e79f826b3869a77eb5f22f68934e2c6f496f4e5
SSDEEP 3072:cGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:vm7Rkm1tYpBeh2BAom
TLSH
T18AC3123B5E70E9775979A74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 aa7f0495fc193ac3b66a54d20fb91474ddb9a05a927a75f94bcd508b5baa45f6
MD5 499b237459b4049fddfcfb7f8caf0b32
SHA1 2674e854ca7d9256ad8764dc558b5ca3d38a79f4
SHA512 9f9164cbeaf58c4cb96289f36ad03737167899293c256ffc5bce4770403439d5267485d304e832a5d9332bf43acb8c90149a0a2dcdc74ae7200c201077bece3c
SSDEEP 6144:EmBVvNMFEH3+lDP2TF/6HlXqrrkenaW9DLm7Rkm1tYpBeh2BAo8W:FBVvNtX+0h/6HlXSrFbK9oBGcAo8W
TLSH
T1E334237B6E755D3747F5F71D704A1B2D2DF0AAA3CD18AE9980E86E00335E4C69F09828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b104670583b2eb503d4f44168f8134f4739ef4135c5c3fb12ba0c1d81c785336
MD5 07d879b7d9c1a4f3cfa9585b167228fe
SHA1 1e66a402e675b51343c13c0443a2f2c232f9afd3
SHA512 394b356b7b53251f47790ea74fbb537634883b2bd4b46426dd79be1dda027f7b3b884b1c66673f57f9dda1a90acafbe8f39cdcb55916ea6325471c547ced170f
SSDEEP 3072:oZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMH:oYm7Rkm1tYpBeh2BAoH
TLSH
T11EC3123B5D64E83659B9BB5FB08E0A1F1EF14AA6C920DE52C8D85B0433EA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4564_1936982752\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

fe08d952-892b-4f69-bb94-db72f02ec54f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4564_1936982752\fe08d952-892b-4f69-bb94-db72f02ec54f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 418341.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 418341.crdownload
Size 1.8MB
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert-2.2.2-A.zip.crdownload

Path C:\Users\Admin\Downloads\WinDivert-2.2.2-A.zip.crdownload
Size 395KB
SHA256 63cb41763bb4b20f600b6de04e991a9c2be73279e317d4d82f237b150c5f3f15
MD5 61198c660fd46657ea6d1657515b3505
SHA1 074f75d98f8d2fd2ce71e3cf5257b09182f59d36
SHA512 92eb2ef98ced175d44de1cdb7c52f2ebc534b6a997926baeb83bfe94cba9287b438f796aff11f6163918bcdbc25bcd4e3383715f139f690d207ce219f846a345
SSDEEP 6144:N2Czi+P7UvMGB3Bm71SLRhuxQlLOyjbUzeDCKP7Uv1Zdd6IpRwOe24PeKMdV:NIS7o3G4jceH7oCIbwjrGKI
TLSH
T1658412640C717AC7C6CF0EF9CEE9B695960659838F4150BF9F4A83C8D2DECA87630A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-980-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3956-584-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3956-583-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4184-962-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5500-594-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5504-984-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5700-982-0x0000000000400000-0x000000000040C000-memory.dmp

Download