fff26ee397a3ce9b5310633430e3c2b414938c7b96cbfc49355e0573c1ed4538

Analysis

user interaction
yes
max time kernel
138s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rat_protected.exe
Size 58.0MB
Sample260803-wfqecaxtfz
SHA256 fff26ee397a3ce9b5310633430e3c2b414938c7b96cbfc49355e0573c1ed4538
MD5 506cf98ab34858a6995e46eb80afef81
SHA1 bf4cc4e973dadc024ebcb0dc0171d9b77865fd16
SHA512 5ab2e0a2fbab5e3f94b1163ee73840fe298b92cf686dcefc68b7449c48b99f5abcb4b652c44b3a99aee4da993e8a8f26f9f3adfde5477f8fbd3c34483dd17bf7
SSDEEP 1572864:nturKJjmDZYvJUbpFqefyumpPvXiusnymGC+2Do/fjItAN:ntmKYDZYvJUbpFMumpeStqo/fjICN
TLSH
T14CD733F4BF4157D3FD1EC1B411E0BD07E4A86CA736BFDA294D4AE8208676E09E88D542
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302532255473986"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
4652	Rat_protected.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	Rat_protected.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
780	chrome.exe
780	chrome.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 5896	780	chrome.exe	92
PID 780 wrote to memory of 4536	780	chrome.exe	93
PID 780 wrote to memory of 3040	780	chrome.exe	94
PID 780 wrote to memory of 3040	780	chrome.exe	94
PID 780 wrote to memory of 4400	780	chrome.exe	96
PID 780 wrote to memory of 4400	780	chrome.exe	96
PID 780 wrote to memory of 1796	780	chrome.exe	97
PID 780 wrote to memory of 3232	780	chrome.exe	98
PID 780 wrote to memory of 1796	780	chrome.exe	97
PID 780 wrote to memory of 3232	780	chrome.exe	98
PID 780 wrote to memory of 5768	780	chrome.exe	99
PID 780 wrote to memory of 5768	780	chrome.exe	99
PID 780 wrote to memory of 5276	780	chrome.exe	100
PID 780 wrote to memory of 5276	780	chrome.exe	100
PID 780 wrote to memory of 5824	780	chrome.exe	101
PID 780 wrote to memory of 4180	780	chrome.exe	102
PID 780 wrote to memory of 4180	780	chrome.exe	102
PID 780 wrote to memory of 2400	780	chrome.exe	103
PID 780 wrote to memory of 2400	780	chrome.exe	103
PID 780 wrote to memory of 4328	780	chrome.exe	104
PID 780 wrote to memory of 4328	780	chrome.exe	104
PID 780 wrote to memory of 932	780	chrome.exe	105
PID 780 wrote to memory of 932	780	chrome.exe	105
PID 780 wrote to memory of 2384	780	chrome.exe	106
PID 780 wrote to memory of 2384	780	chrome.exe	106
PID 780 wrote to memory of 3912	780	chrome.exe	107
PID 780 wrote to memory of 3912	780	chrome.exe	107
PID 780 wrote to memory of 3200	780	chrome.exe	108
PID 780 wrote to memory of 3200	780	chrome.exe	108
PID 780 wrote to memory of 4764	780	chrome.exe	109
PID 780 wrote to memory of 4764	780	chrome.exe	109
PID 780 wrote to memory of 4128	780	chrome.exe	110
PID 780 wrote to memory of 4128	780	chrome.exe	110
PID 780 wrote to memory of 2568	780	chrome.exe	113
PID 780 wrote to memory of 2568	780	chrome.exe	113
PID 780 wrote to memory of 5568	780	chrome.exe	114
PID 780 wrote to memory of 5568	780	chrome.exe	114
PID 780 wrote to memory of 2856	780	chrome.exe	115
PID 780 wrote to memory of 4856	780	chrome.exe	116
PID 780 wrote to memory of 2856	780	chrome.exe	115
PID 780 wrote to memory of 4856	780	chrome.exe	116
PID 780 wrote to memory of 4420	780	chrome.exe	117
PID 780 wrote to memory of 4420	780	chrome.exe	117
PID 780 wrote to memory of 2560	780	chrome.exe	118
PID 780 wrote to memory of 3268	780	chrome.exe	119
PID 780 wrote to memory of 5344	780	chrome.exe	120
PID 780 wrote to memory of 4620	780	chrome.exe	121
PID 780 wrote to memory of 4620	780	chrome.exe	121
PID 780 wrote to memory of 5932	780	chrome.exe	122
PID 780 wrote to memory of 5932	780	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\Rat_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Rat_protected.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb369dc728,0x7ffb369dc734,0x7ffb369dc740
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,5944091830490318505,4477075536526290881,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7668958245525358788,18264769791988762104,262144 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,18269705095382683434,3389947647471916527,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:13
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,14836502206451701471,13039255999802835150,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,1112907601143500897,18097220123143261903,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4760,i,14614746040977742271,3905802170243058973,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,1516656235708895627,3118476440107459028,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,4722677939403691051,12139807441974565687,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,5743874077098021460,17576948275497763802,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5548,i,16628168198073095849,14898806447483352563,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5804,i,14332524649781196031,16978319612368525607,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5988,i,13377443022083432422,15306800982500513837,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5932,i,623878341708957873,4512402332449599917,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,11982594464004920780,6128918443231842743,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6392,i,3142399552052840885,3849286812200771483,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6544,i,16050113112507596971,2617684201774134610,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6680,i,9862958832027923527,15375234510328886445,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6812,i,3111920990979290689,7727783229593740543,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,13641056751628000307,333720625657595941,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6556,i,10523556010651730255,8156173495325273970,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6608,i,17510729525947625681,7211569780741493391,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:9
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6668,i,4383548665356971413,8276186630280933724,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,2567217910088483188,10122045639456414087,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,7896541644106439100,5482760209459306524,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6608,i,14092048301006504002,17409865303566092800,524288 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3380,i,12124064028008270589,4213938442062154740,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6504,i,18146710373546300624,16004113106015550597,2097152 --field-trial-handle=2036,i,888056041621854468,10213813276165388841,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 4200ec2d469eaa55db87bdb2be803cd9cb08f1ef2da4fe002280a20c6ae4eb48
MD5 912c2ef421cb747e088fd1a5a8c55062
SHA1 6fd54826e7c32f7c816ed9f38d0b59921ddd3423
SHA512 a3597a7fadcc264409b49fe4a2c5db8262e90e3b2b858c583fac0c2a8807f90fe8978d07770e51aa4cc6fbd2fb7f3683ced9c4158727c45b73c6da7ccda5afa1
TLSH
T19411BDCFA14A9B98FFD7F2721BB0D84161F04659860DC247CEB105A0726ADB69194727
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b8e9f3959eb80ce1575cef09bd66973ce09713c4700cd2d087c46d47b70268ac
MD5 3f731504e5d328b7c570161054bae83a
SHA1 15de026486a79170c27ecaa4477f62b867b29add
SHA512 abcf4a56983b3c1029c152a8b4bea5cc85552153151da220b117074bdbdc35c6c9943d2e8c51eca32ba29e0c639500d345d4436c6942e5c772ef1815289ca884
SSDEEP 192:De9UympQ6GopgJGaA+0wQAIAEI9IWvaPTCCIwfmR1v6fPYv1NPqE:De9UympQ6GopgJGaA+0wQAIAEI9IWvaY
TLSH
T197F1BFF7C3E8D62DC94516F49B256F1FCD2D0A28422D3D36C8D8AE1B93E18B1E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 9d173a801f41b6fdb28fce5fcc0db831f9ca3033cb05c30bc2e3e14b0dd6e0f8
MD5 15b4f08dde8b739013c7b8b60ada12ce
SHA1 058ba09412759873dd37cbfc8526a96f2250d2d5
SHA512 d8af6d6d2e16e02cdaf2d505eed42a7e46e0163d428866d9c27c11026be4d20c2dad88334bef62798ba6c8dcaba353ec19e870de08855731a7fa4db960b27818
TLSH
T130F059E7A63D70A355795E6E7E00BC097CB5A43106816CF0CF9E422CE0C55F71B16443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 71e452b763360e56beaa170d33c35a3815845640e86ceb0b54b5dd65f27ef6e2
MD5 47fe509cc7b71bdbab12fd296addcb7c
SHA1 d8d8b26facc955a702f4a03634bd3a6610d8f9ea
SHA512 726d1433ecd2874b04db1d722de0c1b4e28a2f0db87be6f74b6477770ff253f419277f7220028b5fcd2b4bac691b33d946171230c9b7dad51e75c6ac0bd223c6
SSDEEP 192:pRx5YRUIv7LAPRp2b9rHsb+WNnn7dxqpIkwheVyIsnAUge:pRx5/UKXw5w7dXBWe
TLSH
T13C32C62EAD15787B5DCBC22AF961B793E7F6102121E42E84E7FC892C14E75CC621B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 05c0674b9b2f64c2b2e46ba5ef74b940faf75e35dea092dc8ad74255e0514fa9
MD5 2758f08b77c055a8229552e71fe04859
SHA1 4472eb399dd6ea252dd11574b5125fcc106ba7a6
SHA512 3e4b10701c143e23cb720609a73af2019c38285cc39e5513761a4e9f41d0668b374995d186c24f1c7904fb435fbee864991f4fd2e8b160bcf1a322d25106584a
SSDEEP 192:pRCcBz5YR7DIv7LAPRp2Y/K9rHsb+WNnn77C+2xqpIkwXeVyIsnAUgE:pRCmz5oUKXA5w772X3WE
TLSH
T18B42D72EA925797B5DDBC21AF921B796E3F6102120D42F84E7FC8D6C10E75CCA21B50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7a86a0328a0ba99df43a6df3653a01572c782a2eb2ce8ce5a5227f01082cf218
MD5 3ab5b7a75621513a78d6ffbf965a9faf
SHA1 771ac066e55249a87654f4d33803cf21681833df
SHA512 9a8b5316215b2faa4e0c681e0e25fcae2474e81ef2992ec788e4583f8b8981d4209ddaaa40c5d9fa4de7d1c7b6e47fcb0541ce37f9e47fed52782b598437933b
SSDEEP 192:pRy5YR7DIv7LAPRp2b9rHsb+WNnn7d4qpIkwheVyIsnAUgE:pRy5oUKXw5w7dIBWE
TLSH
T16432D72EA915787B5DDBC21AF961BB93E3F6102121D42F84E7FC896C10E75CC621B50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee1aa442403e23fc3cca96c3b220d8c1ce1ce0a581f1a50a905f3aeae4db973d
MD5 ea4ce1755fe07e6b540245f78f3c488f
SHA1 ea3111a5c88fcb15293c33a49252e667854937ca
SHA512 005339b35e118d05f445acc4c205e2326d3934b7ce2a2cbae15457c92396e73aaf0cbbe0187a8a28c985260f4d76eff8632f8c42a789c9a402d85aec92794336
SSDEEP 192:pRNcBh5YR7DIv7LtPRp1YjM9rHsb+WN/An77S+YAqpIkwNDPyIsnAUgE:pRNmh5oUdXV5wc7YAt3E
TLSH
T11A52C72EA825797B5DDAC229F951BB96E3F6102121D42F84E7FC8D3C10E75CCA21B50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 14ac4b7946a5685022031c5b0c6528e5fa93fbd833080953f98fd9d7f24e76ce
MD5 bd49a1fa1c777ba4b9484dfbb72f5599
SHA1 23beb307d44bc90e8507f7dde7cb151e0cec08d0
SHA512 8d3151de35e34009823683e3caef68d88e5ac68299f075ed10b8ecbf42216a0a279829797570d4dfa6c3421a718ce0293f2dd267ecc11ed522ff0f2f1f9a2011
SSDEEP 384:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsXODzi+ErU3g8HGm2oTn:vVzm7KxkXqKf/pUZNCgVLH2Hfgsr+OXj
TLSH
T109520867644D9A7B0FD8D64CDC12BF8FADF5014662A40D2892FB6C0903D57CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 820a1001bc59bd8e1abd2abeb90a159c88b0838f4ab4f2d78c7887854c35661a
MD5 026144f1b7b1dabda2f0e07e19b0febb
SHA1 0cdce68e694c9398cecae980d3a6c07b58b3a53a
SHA512 bf027f34dac326c2c9f304c33929346d0e17383d9dcbb23475472ee7bc3ebe69c9f4d508055da5d0bd3fda4c107023496db3710ef12d6be3366c5dacae6abf5b
TLSH
T11DB02230B000CF0ACF0B03B000C0F8C032F22C0802E3C203A0E0A880E0032C0A2200C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 83d3244ac14497ef6cc3ca9e4967cccbc0bef15747f2d34c85eb88fdf1a4b45a
MD5 17d7092ccd5f48ea99e9836b3728cec1
SHA1 90619c52e5d3ff72fe984abfdaf2e9bdf0b94b1e
SHA512 8903b4b6812ed1fb491bccdc3b0659cd4bb505a85f444fd8943bd51879c68482b181799ba26a1975d1eb56028d5956b8b674446c76edcd49304e1fdcded91a91
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9a2cda699e42c6002c65cda03071bd78ce12b800e370066a341e3de5c45274ee
MD5 a8ec470b8509efabff07f11415c64aa1
SHA1 4bf5358e08d4be0e1a35d7e9676dde41ab209904
SHA512 47a0f8e8c5fae12771aa203c14bd73e48a1ce2a82f296562254c26bf118cfbd7140916be76c48e1bfb24d0594b2c97ab3c0a903816b0ab5e385dfca0df16f4c5
TLSH
T1C6A0021142C85811CD109BB47071054627518B247695934355E60658A87F6C45751A50
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b3fb5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b3fb5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 aee050f0ce51be079f229e63952538176cf6df5792205282ff93edcc2c7e122a
MD5 e9b56cf11e6d3d9bffc7aa6c742096ff
SHA1 b62250a05a789a578519cdce7f7ce60dd49de777
SHA512 6c0dbb0ceb5f3db641646bee7e4cfddeee38d54b1e454515dc9c90866e0acbff9e02bb9b74b8ba3a24136b582497e2311bf290c25c6fab7b220155dd3c7d3d33
SSDEEP 3072:rkBLZIxOefVjoS8PcXoKOHxbD58TpRjEDN:rkxZAOefVjoS0QoKQ58EN
TLSH
T1DEC312D4452A1FF2244CC815AD1DB7DBAEB06D94C09CB6B4F7EEA20D1BABCDC160B124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a753a0e0cef3ce8d85c776d2be6a721721285200fc5cb900fe8fe6ce5ecd34ed
MD5 45f6607ddbf2f3e4a182c57cd7a4637a
SHA1 aa5d7ccae17c3a4d20e684972fc2449df70ddf7f
SHA512 1ba8b280db549a7f368be811b5d5b18ca20747eb482abc1bbd670ae5507f68c00844bcd62f15db5199f7d588fb5fd6fedcfc4c00e49f08f2333ed9efedd461ef
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5WFAD/B6xGyv4YR5gQObETev4a:TC0cTkJaRZi/CF2lIDUDK2JZIR5gQObV
TLSH
T18BA14C3264699CB76876D98AB4427A83CFB9722B7950AF84DADD1E0C14FB0AC0342137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 e5ad192c43903a07224beaafb219e59195d45c573165750f04074057c1b8d854
MD5 f30b1df821508b8a50e571b717fe5a24
SHA1 755904b7b0e5a2aa22c096e56fda35c352e71d31
SHA512 5d1df71fd9c46586c137885ded75e547f36d200c288d6415d7da89c498752174841ab8dc418efb7be81806da0dafb72982941b115e9c47285188993352b9c48d
SSDEEP 6144:rDEUCbUEr6Ka7+dCFDqMYxZAOefVjoS0QoKQ58EN:G5B2+MFDmZefVjoS0jK48EN
TLSH
T136342399096B1F91291DD027683D7689BEB0AFC3808CB7B8F0EE754ED3979AC1D0B410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f50b8d4a-5cf9-4742-a672-70845437c557.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f50b8d4a-5cf9-4742-a672-70845437c557.tmp
Size 124KB
SHA256 0d401b0309c85fef822696aedeac77cb4805cb13b7ea196769ea1c645411983d
MD5 173d946e651a6c007c12ba2bd882ac74
SHA1 6e7dd8fa24b49155ebbe988b85556fbcb470bffc
SHA512 bb5270428cc832a2353e7ae0e86a60916269de16951cbee9077dfdb3bf843a1e19c10f5fbd268800d3c33b7c48466a82a4f0859484741b1866194a602506f1ce
SSDEEP 3072:MkBLZIxOefVjoS8PcXoKOHxbD58TpRjEDN:MkxZAOefVjoS0QoKQ58EN
TLSH
T1A5C312D5452A1FF2244CC815AD1DB7DBAEB06D90C09CB6B4F7EEA20D1BABCDC160B124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir780_1645642896\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4652-8-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-6-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-5-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-7-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-4-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-3-0x0000000000A00000-0x00000000043F4000-memory.dmp

Download

memory/4652-0-0x00007FFB35C2F000-0x00007FFB35C30000-memory.dmp

Download

memory/4652-9-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-2-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4652-1-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download