83d104c2d43bdef732f484d02e08f5f9e0a0f13faa9693c833828d1a18e6ec91

Analysis

user interaction
yes
max time kernel
899s
max time network
478s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
socialVideoUrl.mov
Size 953KB
Sample260802-2vq73starg
SHA256 83d104c2d43bdef732f484d02e08f5f9e0a0f13faa9693c833828d1a18e6ec91
MD5 1f6adf3a4cb0c710d9b5639d9bab7814
SHA1 7ebfc66376acfb790c70113b7f564f61b066eff9
SHA512 9ceb1a694d1a9b44f39fa21ed28ce1bb0b1f5e46b7311176546243b3cc243b27b985ce81a8649bba187652a54134c87f3a257d9787fa4be0afb7ebaae721a33c
SSDEEP 24576:vhPmMDQ8gVk00ySlO7VGl50Cbl63T8b6X9L2CMqxS/BasV:AuQvlSlOZE0elewuJ2axS/L
TLSH
T1FE25335B87EA5A06FBBC5BB584CB8F212B605C3C729C20AC4B0E21D45F46D536BD67E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
35	api.gofile.io
37	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301848919528312"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2776	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
1656	chrome.exe
1656	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe
2776	vlc.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4152	4316	chrome.exe	90
PID 4316 wrote to memory of 1368	4316	chrome.exe	91
PID 4316 wrote to memory of 4984	4316	chrome.exe	92
PID 4316 wrote to memory of 4984	4316	chrome.exe	92
PID 4316 wrote to memory of 5184	4316	chrome.exe	94
PID 4316 wrote to memory of 5184	4316	chrome.exe	94
PID 4316 wrote to memory of 5732	4316	chrome.exe	95
PID 4316 wrote to memory of 5732	4316	chrome.exe	95
PID 4316 wrote to memory of 3736	4316	chrome.exe	96
PID 4316 wrote to memory of 3736	4316	chrome.exe	96
PID 4316 wrote to memory of 2696	4316	chrome.exe	97
PID 4316 wrote to memory of 2696	4316	chrome.exe	97
PID 4316 wrote to memory of 5100	4316	chrome.exe	98
PID 4316 wrote to memory of 5100	4316	chrome.exe	98
PID 4316 wrote to memory of 1892	4316	chrome.exe	99
PID 4316 wrote to memory of 4292	4316	chrome.exe	100
PID 4316 wrote to memory of 4292	4316	chrome.exe	100
PID 4316 wrote to memory of 1340	4316	chrome.exe	101
PID 4316 wrote to memory of 1340	4316	chrome.exe	101
PID 4316 wrote to memory of 4816	4316	chrome.exe	105
PID 4316 wrote to memory of 4848	4316	chrome.exe	106
PID 4316 wrote to memory of 4816	4316	chrome.exe	105
PID 4316 wrote to memory of 4848	4316	chrome.exe	106
PID 4316 wrote to memory of 2884	4316	chrome.exe	107
PID 4316 wrote to memory of 2884	4316	chrome.exe	107
PID 4316 wrote to memory of 2624	4316	chrome.exe	108
PID 4316 wrote to memory of 2624	4316	chrome.exe	108
PID 4316 wrote to memory of 6084	4316	chrome.exe	109
PID 4316 wrote to memory of 6084	4316	chrome.exe	109
PID 4316 wrote to memory of 4588	4316	chrome.exe	110
PID 4316 wrote to memory of 1152	4316	chrome.exe	111
PID 4316 wrote to memory of 4588	4316	chrome.exe	110
PID 4316 wrote to memory of 6060	4316	chrome.exe	112
PID 4316 wrote to memory of 1152	4316	chrome.exe	111
PID 4316 wrote to memory of 6060	4316	chrome.exe	112
PID 4316 wrote to memory of 2972	4316	chrome.exe	113
PID 4316 wrote to memory of 2972	4316	chrome.exe	113
PID 4316 wrote to memory of 2984	4316	chrome.exe	114
PID 4316 wrote to memory of 5348	4316	chrome.exe	115
PID 4316 wrote to memory of 2984	4316	chrome.exe	114
PID 4316 wrote to memory of 5348	4316	chrome.exe	115
PID 4316 wrote to memory of 2888	4316	chrome.exe	117
PID 4316 wrote to memory of 2888	4316	chrome.exe	117
PID 4316 wrote to memory of 4892	4316	chrome.exe	118
PID 4316 wrote to memory of 4892	4316	chrome.exe	118
PID 4316 wrote to memory of 1604	4316	chrome.exe	119
PID 4316 wrote to memory of 1604	4316	chrome.exe	119
PID 4316 wrote to memory of 6072	4316	chrome.exe	120
PID 4316 wrote to memory of 3356	4316	chrome.exe	121
PID 4316 wrote to memory of 2696	4316	chrome.exe	122
PID 4316 wrote to memory of 4820	4316	chrome.exe	123
PID 4316 wrote to memory of 1656	4316	chrome.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\socialVideoUrl.mov"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9aa3cc728,0x7ff9aa3cc734,0x7ff9aa3cc740
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,16328654444166537659,10197760520084503174,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,5146869752244369962,4299938753215296319,262144 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,11021539093596488827,11720222746831130433,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,2199478570029043454,2619719353615858385,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,16423235608069474870,7270378461992249732,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,4468047869150792143,13922515876606676912,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,17068322926673916507,7007779272707549965,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5948487441115012052,2292124165320607917,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,7018809746071879429,10706984397511504146,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,4469442762614626460,11439724082447549518,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5564,i,9933419425358210448,16167509273895805779,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,10200002942009745333,6742395409428019920,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5928,i,3203297306172366584,11109008173054824338,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5816,i,10965383111664292198,13553738300173378241,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6020,i,70452236095987091,10700704573706717664,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6592,i,15175683988334999308,8601390462004426706,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,2155473668725584162,1519539266797683034,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5824,i,5418112179925158548,4917881944242369769,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,6563037730281408733,15113893520586701841,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5760,i,2224679889058480940,13066157999391086425,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5748,i,15451963447043510087,8368859538151123357,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:9
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5696,i,16829777147453755240,17251114803252249282,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6528,i,10460982934961462769,7316086504079376262,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6732,i,14565836779390419175,7370387351666466139,2097152 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,3193731067461347411,16709188437320875766,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,10242548277649085739,2724983849461468720,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,13858855418163830440,14423477771624865662,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,6823036204689724231,16694838564645338268,524288 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6712,i,6102250215017264275,9599637660903103644,262144 --field-trial-handle=1808,i,8299408539956819601,16243100178213045598,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2560

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28f6132b-69ee-45ef-b888-0622b877c783.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\28f6132b-69ee-45ef-b888-0622b877c783.tmp
Size 11KB
SHA256 ab5c023032e9294e4d73137768eca7d4e81dbcd874fb16eb9c1734a6c3d9b0e4
MD5 5179a3e03ebcecdc22167680abac05cb
SHA1 7140a0e7100c4d06ebff92cd152d47ea820c2d1e
SHA512 0d502006c61b2a0c04c9c3d211b15d84cf4ee756c743817ec9d403bfe063f670380db1dccad04091629b73530ec610f52ec6bbdfac1959b8e296bfba367460f7
SSDEEP 192:nRDUfAHv7LAPRp2Q9NLHsb+WNn9q03222+UkwWVyIsnAUge:nRDUIPqXD3wc0m2+Oe
TLSH
T15832A62EBE10793B6EDAC21AF9257753DBF9102121A02E84E6FC992C15EB5DC3227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c3c7743-3257-47f2-8c9d-4d5ed649452f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4c3c7743-3257-47f2-8c9d-4d5ed649452f.tmp
Size 13KB
SHA256 4f2f57d2d92d830225ed20a78727482d1c4b0e69467b76fbb3a390363ea7519d
MD5 f660aee89a1cc3eb60c1aaa2626d0f5f
SHA1 7947c12734eb96ca65533f96f7b97feca4bd1648
SHA512 ddaf68e909df2cfbe327a3f5d6fc3d09276ce745799714ae2c17d938656871f1d4fc5658c46206a056dc4f15ad68a48b2d013b43fe42585087addac50436f448
SSDEEP 384:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xXODyh+ErU3uwHGAIGHZc0:Z7wX7KxkXqKf/pUZNCgVLH2HfgsGVOuo
TLSH
T197521967648D9A3B0FD8D68DDC17AF4FADF5024766685D2493FA9C0803A87CB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 7a877003a8c9c9a1d2ad64c09251ada5edabc4550278ef7ffd06df217dd43735
MD5 799a07739e9fddc5ab3652b0c0049e7b
SHA1 cba842cfe4b1e09013d64e273a40516ead0838bc
SHA512 8fabb82824781e27ad42a970869d0ce4440f439b432e1809df9f33bdab9a08a6360ebadf28423b2eec7aab82c83499d5155061d1b441d16415f372df04c1f7da
TLSH
T13C01AB128991E396EF136F34E2C4616C7D76332400470DDE248352B7A42B340110836F
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 70624d55f322ed25ec433cdac420f52a096bac26dad858be3cfb93c1f4ce769d
MD5 b6b91d3989d2888604713721f8addff9
SHA1 a5bfd5b15744c1e753f498841a30ec10770428bb
SHA512 a1fcf5d17beb50902318cb08f7ab86ca19017759c70c49ec9ba3f3468da1f87db37fa945d02bce894a98161b6378f46cc559db04cfa87dedaa6ca5ffc3b04b69
TLSH
T163718EF3D3E9966E892156F4DB116F1FCE2D0A18432C3C26C8D4AE5B57E2872D24074E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e2f13bd9f65b2a596f2b869e6da3a90179c82236a5c5992cedf08a8fc7a04ff0
MD5 5b1c90b09f30cb59014b162caa757630
SHA1 a272dbef7383f447803bd03d5ad5a1b5b7a3a5d0
SHA512 7aaa10f91a5fcd3773a01f5e54b9294e270aa0eb485e3fc723335523aa0f81abca9e2ef68ebfb946f2468b847972baffa75e013014e266730d75b977f3499e97
TLSH
T1A3718EF3D3E9966E882556F4DB116F1FCE290A18432C3C66C8D4AE5B57E2872D24074E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 8ed90781cb4e23f32694b06c90d476f94df0d2f57ea28d96e265bb9af2ad8f96
MD5 946497a89cfab8d89406136881f57d03
SHA1 e8bdb6b882ac82ee6ed12136e20078f530f51c0c
SHA512 943b1907418aa4002bfe7938fb78ca88b8a4f3c3f51fd7c1cd12f42a3274716084770ef031b0704c674065c197b95d4dca3e894534c856c96db44c802d4989cd
TLSH
T16B115CE7E67DB457107D986A2E05FC076CBE943252802CB8DE5E829DA0848F71702487
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4f7fc3a6738edf6ba7d5251198da20044b23794c8fc711a9b41a036edfca5cf7
MD5 2835d5106a7a30a8bcd8621115572f18
SHA1 a3f1dd3732d8181f666758b5b2414fd6e71f4f4d
SHA512 a3964f2b3429629726582bf3c74989ff3193ad8f07b44529aaa3243c449979a815b39ac82974b56e4a6d95e8739dfd3853a59ae7fc7a455de737bd89e14405e3
SSDEEP 192:nRDUfwEv7L3PRpX2lk9NLHsb+WNn9q3CJ26222+UkwJVyIsnAUgE:nRDUYgnXf3wck2F2+PE
TLSH
T11342B62EB910293B6EDAD619F9157B53EBF9102161A02E84F6FC8A2C15EB5DC3227013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d2dcb9369be3d06a233c50efaa6c9d2b9f9e43e0fba4bc86ca60655c9de7bbb0
MD5 7ba01ec593b2b60f8cb8c8c8634dfee1
SHA1 e5796863d9d590061cfd34837f5b7b0bd56fc89d
SHA512 22528af24605cbeeac6fcc451368e5719daca5a74cd58c1e648007f383a505e0dc3d5dc7c26efbd628cc455ef2ff6f090319d0ad7bfbc4cb16af470f4182a0eb
SSDEEP 192:nRDUfwWv7LAPRp22lk9NLHsb+WNn9q3CJ2P222+UkwFVyIsnAUgE:nRDUYiqXY3wck2+2+TE
TLSH
T18C42A52EBD10393B6EDAD61AF9117753EBF9102161902E84F6FC9A2C15EB5DC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 aaa2ed56af797f3b25f3c3e3863428301d1ffc4a16dc687107566a5167209a55
MD5 26ba20ea9dd2ec68e5cdb635015abdc3
SHA1 0f27a8c004ace730c300cba7aadacd6e33d5c323
SHA512 4c75e5e812557c973c7cce72103554c550f6e1adc33ecf5dca2181fc5c012a9af1a803576bf50096d70876b90d64ad11e36716e37560aae2b50ed9bf9b76e306
SSDEEP 192:nRDUfwOv7LAPRp22lk9NLHsb+WNn9q3CJ2u222+UkwWVyIsnAUge:nRDUYqqXY3wck2h2+Oe
TLSH
T19B42952EBE14793B6EDAC21AF9157753EBF9102121902E84FAFC992C15EB5DC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0e09229f691d3fd6230ce41c1c34c5e7a3de0eef859fa647cb938d4930833c43
MD5 72e0d11f03358f1046120fc859dbd9a6
SHA1 766b4b8d016a7dd82bb6b276841f707e90f12a14
SHA512 606601e9e6a79275341894e4a4bfd3c4c9816c25215df22f45401fe8575343b8b949df4856de99486a3e664990c584130a17a88faf8ef074697fd38f6849e73b
TLSH
T120A0021083C50811ED0152B86072065166D248246B52E3D35DD50848CAAF1C14119200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 575b7c5fa202499d8a966731d4980994765a0a5e98a1f7ce379d2abfbc103395
MD5 b8d13e11f043a8945a2324b9ade75fe1
SHA1 200091827dc5f1ed8f4953bf10599cac1e8dd281
SHA512 afceb87ba1d0e682fd85fce2687f1f429f5fb7184bc3c40769e0c0aa68753b7c901dbe9125fb514100a1c071c172d7a691f99008b8096709730ce15b10a845c8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5bf75d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5bf75d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 33ad1606b3bedf9e72e02ad4d979ddd1dfd950867ee691ee491c50e34370485e
MD5 64fa7efa35ddde70054e679e0a70bf6a
SHA1 96df9ebe72f0d78a80d55db78bd463a2b6bc99db
SHA512 522d8b10b84a0ad9dfce120511abbe785932f469cfc3f4058a4d839cd72b2b3aff8b0792c39dee1ebbb6204ea9ed0a1f6f15ce2449819d1a840e06128c343126
SSDEEP 96:hC0d+hDK+UyKovbfaNQY5tSSl8h4otop5s6DeB6nzGyvUgIlG1QzbOQyEfGipg0X:hC0qDHUgvIdKiU21eSasIlTLyEfRpgUp
TLSH
T13EC12875B86CAD732EB2A556F8132E83CEB5607B9A616E50D6CA0F0C11D70EC2343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 042052a6d21ec289ba9ed7375302305ddca7a8bc0798f0d06c54911e87f6a139
MD5 deb66a715f530a50db1c31af9b0f9b16
SHA1 c7697ec73fc19262e7212a81d9efe453ccfa46ef
SHA512 b6f01f0a8a92c08b784af85eed6ad45f02d4335504b47bf8a606574be4a5b9bcdc0f0ad7b4e22231a481389ec75c4a14b2f20cc299a0a2b308a89e34f372f7c8
SSDEEP 3072:SIdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAq:SI8i0Aw9NDv+qw5ZtAq
TLSH
T18BC313356F12CC778BD86466642FDB4F9EC4F82ED685DFE654C47B2E421A8EE202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 90e8f40c9f065911c77bb50490b25030a423dcecff02b895b37998849c667534
MD5 6ee325bc770a08b115183c37a376efbd
SHA1 4abcf6ffa53ceac47ed0b992b62927ca90aca7ba
SHA512 e7e20784eb60c35385d0c28312f415351bdff1764d9e76d51aae76c78de819930fb2d987496f60d0fa4600652e430fb6291f389ad599cdc4a1c0da760a238f4d
SSDEEP 3072:SrxdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAq:Srx8i0Aw9NDv+qw5ZtAq
TLSH
T1E5C312366F138C678FD51829641BAB4F4ED4F82EDA44EEEE78C87B5D421E4ED242B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 246135cac4259222978e6893a878e5fb49ecc0635a16ac2ae53938453f264ef4
MD5 c6d1ee94a4f7bc6a347be23182024651
SHA1 50965e11ae84008574f11e3fd0588cecea2a11bc
SHA512 2a960a9f1569e5beb8cd1eb49be1e40f64dde6689870c5133e81458b02b7b7982fd8759fb732ac930e3cef08f2165f5859a56c0831f9604b85485fda5a10abdf
SSDEEP 3072:SSgdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAq:SSg8i0Aw9NDv+qw5ZtAq
TLSH
T15EC312366F128C678FD51869641BAB0F4ED4FC2EDA44EEEA78C87B5D421F4ED242B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ce46fbf8224a69843c295f4df6ce06d7aa9708a6c93acdb3d866b57c1ee1a496
MD5 c790c0f913bb2ded1842e8b35d956309
SHA1 777f2961c66c1e9ebe71779447edc93fcee514f7
SHA512 d91b7adfcf3e562e096835b8038541a7816dbc16e58660dde918263ec6b99068761c05daedea4c941d1be93254f5133a83435756dbcbf5e70c9530c782bc129d
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5sqDeB6WGyvUU+GisbL/Mmv4a:BC0qDHUgvIdaDUDxeCI+RsbL/N
TLSH
T19BA11931A46D4D776A76D949F8662E43CEB4607BEA31BE44D9DE0E0C11EB0EC2303613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 343141f750056f0c1bd048ca2ceb49780a91c5903bcfe6218fe29f86140e1d87
MD5 a73cbefbf0d8a70d191f7d56c71a0a6c
SHA1 8f2ff0c5b8ba936cbfaf8fa1d5d617420f547127
SHA512 25cead9de8a14f17975b9969b6edc9dd7859d96f09b4af17800591cea6556428ab8b5e3019d096357f0c23a3ac2ed4f62093389e9aee54f9ad30df24bc776e06
SSDEEP 96:hbJ0d+hDK+UyKovbfaNQY5tSSl8h4otop5s6DeB6nzGyvUgIlG1QzbOQyEfGipgW:ht0qDHUgvIdKiU21eSasIlTLyEfRpgUp
TLSH
T193C12875B86CAD732DB2E556F8132A43CEB5607B9A616E60D6DA0F0C11D71EC2343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4316_1719863343\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2776-15-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-40-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-39-0x00007FF9B17E0000-0x00007FF9B1814000-memory.dmp

Download

memory/2776-38-0x00007FF6F8740000-0x00007FF6F8838000-memory.dmp

Download

memory/2776-31-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-30-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-29-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-28-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-21-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-22-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-23-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-20-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-16-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-19-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-18-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-17-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-0-0x00007FF9A353D000-0x00007FF9A353F000-memory.dmp

Download

memory/2776-13-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-14-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-11-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-12-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-10-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-9-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-7-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-8-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-6-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-5-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-4-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-3-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-2-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download

memory/2776-1-0x00007FF9A3290000-0x00007FF9A3546000-memory.dmp

Download