1fb9a37f6da7f7482b188579717b7308d008a341e7c8e527b52f8665d96a8ead

Analysis

user interaction
yes
max time kernel
899s
max time network
878s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
twister zone/drag game.swf into me.exe
Size 9.9MB
Sample260802-fenlcsdb89
SHA256 1fb9a37f6da7f7482b188579717b7308d008a341e7c8e527b52f8665d96a8ead
MD5 ee097b095fe9098fb05acb318fa117b0
SHA1 a423567d6932a5886eefa671c0ac9b28c04d2f3f
SHA512 3c38d68e058b2f59004914ec8fa41eed96db61a9d6dc243e8e3ae1d895f79171145a44efbd18933a9475b85716eb691f2da1eaf34d3caa2bf8f343d7d46d1286
SSDEEP 196608:lv5Qapru7Dy8D3A7GOGqZcivKbnQgiyIAVlkW8+DxXjKry0s6O3:lhza7DpQCO8QgiyDVlkncko3
TLSH
T130B6CF73AB828176D4A311F2427FA76FA8FCA731032095CB67C4685577B13D1AA3624F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drag game.swf into me.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5068	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	drag game.swf into me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	drag game.swf into me.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301197530484871"	chrome.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a\ = "FlashPlayer.AudioForFlashPlayer"	drag game.swf into me.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe\" %1"	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe,-202"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe\" %1"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe\" %1"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon	drag game.swf into me.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe,-608"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p\ = "FlashPlayer.ProtectedMediaForFlashPlayer"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe\" %1"	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe,-204"	drag game.swf into me.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe\" %1"	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe,-205"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open	drag game.swf into me.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash"	drag game.swf into me.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\twister zone\\drag game.swf into me.exe,-203"	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open	drag game.swf into me.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command	drag game.swf into me.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3668	drag game.swf into me.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4204	1664	chrome.exe	97
PID 1664 wrote to memory of 4368	1664	chrome.exe	98
PID 1664 wrote to memory of 5068	1664	chrome.exe	99
PID 1664 wrote to memory of 4368	1664	chrome.exe	98
PID 1664 wrote to memory of 460	1664	chrome.exe	100
PID 1664 wrote to memory of 460	1664	chrome.exe	100
PID 1664 wrote to memory of 4248	1664	chrome.exe	102
PID 1664 wrote to memory of 4248	1664	chrome.exe	102
PID 1664 wrote to memory of 3540	1664	chrome.exe	103
PID 1664 wrote to memory of 3540	1664	chrome.exe	103
PID 1664 wrote to memory of 5000	1664	chrome.exe	105
PID 1664 wrote to memory of 5000	1664	chrome.exe	105
PID 1664 wrote to memory of 4808	1664	chrome.exe	106
PID 1664 wrote to memory of 4808	1664	chrome.exe	106
PID 1664 wrote to memory of 1924	1664	chrome.exe	107
PID 1664 wrote to memory of 1236	1664	chrome.exe	116
PID 1664 wrote to memory of 1236	1664	chrome.exe	116
PID 1664 wrote to memory of 5096	1664	chrome.exe	117
PID 1664 wrote to memory of 5096	1664	chrome.exe	117
PID 1664 wrote to memory of 2528	1664	chrome.exe	118
PID 1664 wrote to memory of 2528	1664	chrome.exe	118
PID 1664 wrote to memory of 2380	1664	chrome.exe	120
PID 1664 wrote to memory of 2380	1664	chrome.exe	120
PID 1664 wrote to memory of 4588	1664	chrome.exe	119
PID 1664 wrote to memory of 4588	1664	chrome.exe	119
PID 1664 wrote to memory of 1108	1664	chrome.exe	121
PID 1664 wrote to memory of 4916	1664	chrome.exe	122
PID 1664 wrote to memory of 3372	1664	chrome.exe	123
PID 1664 wrote to memory of 540	1664	chrome.exe	124
PID 1664 wrote to memory of 540	1664	chrome.exe	124
PID 1664 wrote to memory of 4124	1664	chrome.exe	125
PID 1664 wrote to memory of 4124	1664	chrome.exe	125
PID 1664 wrote to memory of 4224	1664	chrome.exe	126
PID 1664 wrote to memory of 2412	1664	chrome.exe	127
PID 1664 wrote to memory of 2412	1664	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\twister zone\drag game.swf into me.exe
"C:\Users\Admin\AppData\Local\Temp\twister zone\drag game.swf into me.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff992fc728,0x7fff992fc734,0x7fff992fc740
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,9549586463107465095,1004677459598530474,262144 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10118581809176907311,8665936848091121902,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,9092977391207228758,12592692792152618422,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13942609092353266435,9516555325354155834,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,16951710578808673097,14395538228662160981,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,12494806754255611866,11589692908893629163,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,580635895882410001,17447762847952890282,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,13263327076291425315,6932645042295935082,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,14606860982974649926,2215176896412643694,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,16217175926894715412,4894027019246570888,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,13964232546907520203,5856359481595225673,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,16754416180175814960,13223817381440578111,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5828,i,951441233625793991,13000458709088604587,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,16449417588034905404,5880686335623907566,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,11079354081168792597,9100214458162075860,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,5022801090408013859,14590525225726440764,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5824,i,244353407604114667,18410733526590487572,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3392,i,5161104179279835090,12591087698991223737,2097152 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1212,i,12716793202768963971,9851154562040221851,262144 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,8148928757750928900,9670578507656953603,524288 --field-trial-handle=2020,i,3350151073244514469,246392189536013699,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fa924000a6d1f4a4272ac90dee4002c588ca3b35cee5e64c2407a601983ef22f
MD5 9400ce0ed546439943284870d9c0e529
SHA1 35eb175125c1383bd144b4f5c722472ddbc485c0
SHA512 2f1de3bfc1656bc6b8ff2763b8990afef6fd814e572ffc5443f058bcb21cfe84fc7c741d4f1febc08ba9c04da3769f6635e64f54fa2142d558612b22cda19eb5
TLSH
T1C2E0ABB9C960EC2B28FE0B5860504706F200035F2680484B3B3D950C8FF0E3E4645C0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 9edbcc8765ad6d3c4098fc4e10e55079e3ae315ed0f311d41814124e662cd500
MD5 bad652d8436e9eb185e979e91ceab614
SHA1 8dabf0adc9945b3a78286e7b533d2463ac572265
SHA512 d96ee699efbe5595604135fc87839f70fcee557242251c53d354e88b51005fd193d9432742db052041f7e985456cbdd92c275e51e30c3b8163c3453c35738eb2
TLSH
T158F0261492E993A0FF695AB13C834D73BE15170D80C12B578C9D8C940B262E54D5F990
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c534ef08e01a6451626167ee1dea0033865ce8dad1217dbd92065bbb1892e6a6
MD5 49ebde021d4dd20816c108fe93ed27e5
SHA1 8ee838c01985bc84dc3acae7dd95fd0e5b6f94e6
SHA512 3de58d5971f2ec598112945f4f103599379b620b38757c7f50241bd84e9ec51053babe58ac22b048521aef75a5f81fbbff7b93400bf26ab72a2e1d17c489ae42
SSDEEP 96:D8dndIHO6JYRIKJbPTNvKMK0aPZrbdfPvNPpE:D8dndIHO6JYRIKJbPTNvKMK0aPZvdfPo
TLSH
T1AFC18EB7C3D8862DC95556F4E7217F2FCE2A0A18421C3C26C8D9AF5B93E2872D25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4258a163e1c42295cea559a69e855a2a1e3652a9cb5452f159c804f769fbb180
MD5 b6655e18a4afd71857bae943dba5a383
SHA1 097b1fe75ea69576492fb2e2f4db8dad6ecbaec0
SHA512 750da23c9ddbfe02888cc43d5f61b9af53e6e70f923732283e3cabaf28a108e64ce90bcd9ae75509282f75352456fb5a87444aaecbd1ccb3de3d392a0e0358b2
SSDEEP 96:D0uwFtxlJJ5JPIKJEdZuqMU0aPZrbqfPiNPiGSjh1K:D0uwFtxlJJ5JPIKJEdZuqMU0aPZvqfPm
TLSH
T1F4B1ACF7C3E4862DC95156F4DB15AF2FCE2A0628032C3C66C9D4AE1B93E2472E25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 298652a0c013451c7622493eb8c99a95a26af0a3737530e6014feab0c311028d
MD5 745eed07ea5f4b8aaa52c9d0b871f8f3
SHA1 94ec75e4807c8768b0cb23e7877d5d553675d3b1
SHA512 087cbc3591de71d6cbd087ce98cc1aedc38ee835ece0a41f8932fa7d50f935af297d1181d433175cbc8d5699c15158ce255910b12b698fb86f2898f6554def7a
SSDEEP 96:D0uFtxlJJ5JEvIKJEdZuqMU0aPZrbqfPiNPiNSjh9JK:D0uFtxlJJ5JEvIKJEdZuqMU0aPZvqfPH
TLSH
T1DFB19BF783E4862DC91156F4DB15AF2FCE2A0628032C3C7289D4AE1B93E2472E25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9c5ddd49db263cb3c2165cc8e11882638f6f753971e57a4d4975fd1c9aaf1c93
MD5 ed22b2211fc298d037dbb256f6a5128d
SHA1 37617ac42a83e1703cb53dbdc0ffd1733077bb8a
SHA512 db422cdb3545129d4ea0eefac6a4284ec090f2afce4ec98836a86028c857398974283f5c217435f85b8cb08ba490e78c092ebc9a86f654fe048a0698c67b494e
TLSH
T1A5518AF3D7E4866D895152F4EA216E2FCE2E0A19021C3C2288D4AF5B53E2972D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 30484348588b67c3003c594f26bf19f1ff9627a6fb7a1039cc7d33b065b66bac
MD5 be7659e48d43cec44188b61c828173bc
SHA1 866f6ec7699157f8078017c69826441e25e1676e
SHA512 46ef6134d2cb7cc7ca6810e0c340f3304e82254861529fed511fd5ea075521d28e17dbe90140e47f6e49639c70bcac5f5f553b061fb98a6c63ec7b5fbdad5436
SSDEEP 96:D8dndIHO6JYRIKJbPZvKMK0aPZrbdfPvNPpa1W:D8dndIHO6JYRIKJbPZvKMK0aPZvdfPvj
TLSH
T1D1C1AEB7C3D8862DC95156F4E7217F2FCE2A0A18421C3C26C8D9AF5B93E2872D25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e5573cd801c3220968478992cace59876ef38313b2b17afde11c9e3108bf32df
MD5 818e8f6dc6248c869de32cf393c06bea
SHA1 613cadfba7cf3757d5a1a3da03ef39b823162885
SHA512 afd256ae486b5a9f1119486e1ad4e409ec8e6158ace6b955ea86798df9c3a3b67ac22ae7354853e2e2683c3b261fa8cec353bcc2594133cc6780b6170343d848
TLSH
T181F059B7A3AD747B147E15AB2D04BC1724B9A43A45412CE0CF9B826CE0808F30B06493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e882df90745ad243f5895cf70f3a0017135e406333a5b036e309ce439c05e397
MD5 9df0dbdfef728ae2191b41c4ba917af1
SHA1 e46d4d704828a99ef65be981f3e3ae01b2bdf89c
SHA512 f74b32d88242f9e949ed89bd6ed62ea52430b48e1116378c2613601e9b4462eaae6ca20c844f5282a0c457b92e759fcd2e90197e8789db8ccbe3c4f567596c1c
SSDEEP 192:TRyKHj/Zv72vAPRp299THsb+WNnZn0pz8kw0ah4VyIsnAUge:TRyKD/5C6XuFwZ0GUaKe
TLSH
T15E42C42EAA20653BACDFD219FA257763E7F5103135D42E84EAFC892C01E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4073185da5a195eeb73ce7fcc11c9c63f136d6acf301fde44ac7b9eab62fdb77
MD5 0ae9789b084afff8c660a5c3c8dc85bf
SHA1 2a64d0d4bb24127c140c0c093a12fec749c5efb7
SHA512 294276b559cb1b76767943010cbbf8669faa8e47d58b1173d999bf487f5bd757fd92457f8f83a30acfaf3ac6df7d96b7508824df2385e1d9f26bfa46b51afeda
SSDEEP 192:TRCcBzKHj6pv72vHPRpD+uA9THsb+WNnZn4P82dSz8kw0ahFVyIsnAUgE:TRCmzKD6pCnXGFwZz2dXUaVE
TLSH
T12352E82FA920693BADDFD619F9217767E7F5103225D42E84EAFC892C11E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 636abe2f44d97c16d59fb2753e2fd09d6601f1b3e58f0ec109f6f8fd9a3da731
MD5 0125c0b4425f37f76331addbd64bfb52
SHA1 db94c7800edb8e9c769a54a6eb24dbedf72367d0
SHA512 5e4aa76e2b64aa5a6b0baef4a44da318529503b6874788adde0a01b1278b29e30c9854e9221f77426456d14df78f324654510f4089352b0385597682615a1422
SSDEEP 192:TRyKHjsiv72vAPRp299THsb+WNnZn0idz8kw0ahXVyIsnAUgE:TRyKDsuC6XuFwZ0iaUabE
TLSH
T1D542C62EAA20653BACDFD219FA257757E7F5103235D42E84EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c8bbefa868666658fc7817621b6c1ddd88f7f8f434a11ffa078bd1d28346f73f
MD5 f1f299c2c157c4a473813da57a2b51dc
SHA1 1535c4aaf187414b646cc9b2ed9ac7564b9a8ef2
SHA512 ab8725451012cdba04b6c569eb3699f24cdf2aa735e2f4ed7f4f1eea9bfa036d61c85255cebc27d3efa3f58158136ebb3eb4cc97f39423a3582fe20db77f5f81
SSDEEP 192:TRyKHj3pv72vHPRpD99THsb+WNnZn0TSz8kw0ahFVyIsnAUgE:TRyKD3pCnXpFwZ0TXUaVE
TLSH
T1AA42D82EA920693BACDFD619FA257B53E7F5103125D42E84EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0c1ba858094fbe5f6674415fb1300cb90d4ec13c2db6d6bb649a231e0cba351b
MD5 dcf570aba7da23f595c9fdc0609e387e
SHA1 4e8217e536bc9899b2563dc73d002b2c983e1c25
SHA512 471764e0b75d6e075498cb44583680d4acb2a622bed11fbca225638f7e8dd0d56732229ab89230b24c6508f9fce8955c704c155c0b907821e67cbc768e02b898
SSDEEP 192:TRyKHj3Zv72vAPRp299THsb+WNnZn0pz8kw0ah4VyIsnAUge:TRyKD35C6XuFwZ0GUaKe
TLSH
T17942C42EAA20653BACDFD219FA257767E7F5103135D42E84EAFC892C05E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 61c2b532a6f0cece91e7324843594f3abc1c7ae27646d1c23a752245f75b3d47
MD5 3d8f6d114bb9705a635c986d5920a854
SHA1 1ed4c5da5fea05a6e0c60b7a49f6c8d60a901082
SHA512 3ce825a5f49f5d810570d7b929765c6e2671422de65b6f12b740e53230b57dec0cd141e78c92bec3e56cb3ed5ee6211be114a0ef56d87a8f61fc864078305dda
SSDEEP 192:TRyKHj7pv72vHPRpD99THsb+WNnZn0TSz8kw0ahFVyIsnAUgE:TRyKD7pCnXpFwZ0TXUaVE
TLSH
T14242D82EAD20693BACDFD619FA257B53E7F5103125D42E84EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4606be7a34f053722c9db6f0780978af1171c84c465a1282a22939ed3ee9398c
MD5 63fdbf159a53388edf08e8ee821e9e9d
SHA1 7631a4e6e0da66acf04e48d3df67e3e59fa7f972
SHA512 707199a150ba923726406ca59efa9956e984229fc820ca778e2601b63724766fdb5b612763a434d5d08670509ec73b86c6460b04123ae179b87eb7e330182f2e
SSDEEP 192:TRCcBzKjj6Lv72vHPRpD+uA9THsb+WNnZn4wMYmSz8kw0ahFVyIsnAUgE:TRCmzKv6zCnXGFwZwYmXUaVE
TLSH
T18152D86FA920693BACDFD219FA217767E7F5103125D42E84EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 625ee9379ddf05e29a51a98ae8136a792436c43ef8d7c218f2c083dbdbd7e5d0
MD5 e5631b4eb0f4a7bbcc7ffda171b0d192
SHA1 dad65d4983330f892810c4c52ba2823e4322ea96
SHA512 dce7e2f02ff9b58f80438c3d4653b6c68948f926c2f4effc94f2b30d22744ca76ca72f3159b733b0a12dfd0e099d1de65fa499a1293ccc84e5950f4df8f98ead
SSDEEP 192:TRyKHjMpv72vHPRpD99THsb+WNnZn0TSz8kw0ahFVyIsnAUgE:TRyKDMpCnXpFwZ0TXUaVE
TLSH
T17F42D82EA920693BACDFD619FA257B53E7F5103125D42E84EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1562f19323f3c1815b68e64e98490b0c260cf631606ef1fa3fe40d9b064a5c49
MD5 c789cacb00679133fcbc1e722e68013b
SHA1 e4af1fbaca8d2cc9cd93d95c90e4063c38d8ef6c
SHA512 67fa8242795e137b9c7106f2116cdc49928cccb5213fdb12a46b57c714172c4072f7ff89d243e7f54c8b18c42840789968f9ec5f6400a9ea1e072dc3e0dc2d83
SSDEEP 192:TRyKHj3Pv72vAPRp299THsb+WNnZn0idz8kw0ahXVyIsnAUgE:TRyKD3HC6XuFwZ0iaUabE
TLSH
T11F42C62EAA20653BACDFD219FA257757E7F5103235D42E84EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 775431f06591e24e365157994b63278c68001d97122dc9f961488d60b98b207b
MD5 80686e8a3a18381e00f40bb77364365d
SHA1 d1cd96afcce2e3a27aa82d98a4af651f5aa6c685
SHA512 afa110f1d7fe217add1870198eb64cd82ff44a627c006c9240e335e3ed4036cb0f0d8f73090fa4cd515f32a5eb4d0a615e58b8a6962af95939668a7aa1ffa0df
TLSH
T1C7B02200803E000AC02A03300EC00AA83B320E3203C2CE2B88E0B2A0C022B8303BB202
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 019f47a689a3f73ab05f7e9cf785d50d0dda6a1eeaf504314198e2aa6d232a52
MD5 c2e5f54710995b5555206e924741ce0b
SHA1 6bcd91c68494c46ff681ae273b5e32bf611d1224
SHA512 1ea39f22e14df3b11b900dde59f0b992f5a37f99fe4fac01e78dc14181adf4a9ff7e0a83856b28c5b20ffd6154b63e07c36d98579a87011c3829af9202e07ae7
TLSH
T126B01220C44040B2E90447F260B22AD0B77D6C7055821707248F48748D1E1D45001205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b089.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59b089.TMP
Size 72B
SHA256 b63e72bcfcd35e7abe0d996d015225db9621f8e3458f04804b12d023495cd2d0
MD5 c639e1ed32ab99c64b6ce2efd51024c1
SHA1 ea0f6fa047bb125b89b9f0ab42ccf5d296296330
SHA512 7e4e56f7b9e5c80d7c8e71e4d27c4993a9982552368b21fe9696d3b00a7c291db23a5cb3d0a51ec167559a3bc2603af8ec05350deb2274e0106b5a795b19f075
TLSH
T10EA0023483446071D5154BF060B1034BB2799CD97EB60F0F699A4675AE9D6905542540
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 ca9d7c37d35bd4cee00c9b673127745c935fa6d3b925531dc51d104188694239
MD5 3983540144babd10f718c9dda0ae1ebe
SHA1 8bf25a44fe6fbcf978db1455744a882e994b5ffd
SHA512 1b3b149767fdf5c8f0104a51335d548187d09fbe3544ad8f03ba5c3c00e506c991756e02d81f5985e0af878d2f4621c4ce14aa977e3e0f21faa56ed869bc4de2
SSDEEP 6144:abaDuqWhGX9NwJUwcim7Rkm1tYpBeh2BAoqX:ga6DWKuwcN9oBGcAoo
TLSH
T1373412369FE4AC76A9FD534DF18E062F5EF2CE6B8920D896D8C42A04B2C76D80D45874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 6d43d888d0d35b7cd68227f71f1eb2e5c05b124c7fed5d35d515dc4a5804e0b5
MD5 371cf0ee31c82c3ff75155bbf7ca1460
SHA1 fff4984bf6a128bc36bb7b7d6fd8830537c0aad3
SHA512 4dea5c226b8aa29e439091a3710d9c30122ecf4a78ea0199282b4dc7fbf2c3384a9c7f85ba759158ca01dd54d7b9fad66d8cbd605b8c13dd42ac8ba0b929cef0
SSDEEP 6144:+baDuqWhGX9NwJUwcim7Rkm1tYpBeh2BAoqX:ka6DWKuwcN9oBGcAoo
TLSH
T1EA3412369FE4BC76A9FD534DF18E062F5EF2CD6B8920D896D8C42A04B2CB6D80D45874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a2ce5da3f94f16450fba90d830cd1a0a6b2e003d0ae7c4e2dca0704b0077d1fa
MD5 5902781d9572bdec635028c5f9de6feb
SHA1 2c6ad526157791baaf951d3b8563c18f58d61710
SHA512 828cf733ac91cfaa4cf97e3233611a451ea041e9ad6f78b2f23f6739d886a0b5035db762816c399321e42f457b334a9cffd29de3072f1d3659f05dbf0e9b6997
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Fm7Rkm1tYpBeh2BAom
TLSH
T177C3123B5E70E97759B9A74EB08E0B1F1EF14AA2C930DA52C8D86A0437F97CC0A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 2587e5b8e40df5d199e84dfbecc59ccd924961323cbdc825538f25a774d1f79f
MD5 65facb2c098b492a3b26dc771c4075fc
SHA1 6c5a11ac62a032057f5ea345b6af25d0af0da32d
SHA512 53426e16c1395d3dfbac336e4790540a8e72395cf2bbd9a5dd1a9189920893bfd518055c4682495689710d472bb55b1d99e516e578343b7207f7e6b6cb14ab4e
SSDEEP 6144:J/aDuqWhGX9NwJUwcim7Rkm1tYpBeh2BAoqX:Ja6DWKuwcN9oBGcAoo
TLSH
T1A63423379FE4BC7AA9ED535DF1CE052F5EF2CD2A8920D496D8C42A04B6C76E80C45878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 8b6c448f45dade95fb1c96d6f7c395dcd4a5701c9c09ad76a34ff535b83e7909
MD5 8edae2f37d996fb4c2bbc685e1b9c4f7
SHA1 e594a219cb0c1d32c4d150aa7694c8fb79823fd9
SHA512 e95f66b67094418183553f9993f84c2a4f7b22f84951759f71a9ced5ad2581b041dda3cb3f2a69b19d23a74900de23157e61eed2010b84d3ff3b8f7160e17c74
SSDEEP 6144:e/aDuqWhGX9NwJUwcim7Rkm1tYpBeh2BAoqX:wa6DWKuwcN9oBGcAoo
TLSH
T1253423379FE4BC3AA9ED535DF1CE052F5EF2CD2A8920D496D8C46A04B6C76E80C45878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_614199982\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

a1a20376-6f5f-4ae9-9306-5bd09e441bd9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_614199982\a1a20376-6f5f-4ae9-9306-5bd09e441bd9.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3668-0-0x0000000003220000-0x0000000003221000-memory.dmp

Download