56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

Analysis

user interaction
yes
max time kernel
689s
max time network
667s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/nsDialogs.dll
Size 9KB
Sample260804-kyak3awdpg
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	3948	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303076811669486"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2436	chrome.exe
2436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe
Token: SeShutdownPrivilege	2288	chrome.exe
Token: SeCreatePagefilePrivilege	2288	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe
2288	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 3948	5460	rundll32.exe	90
PID 2288 wrote to memory of 5152	2288	chrome.exe	95
PID 2288 wrote to memory of 2076	2288	chrome.exe	96
PID 2288 wrote to memory of 4212	2288	chrome.exe	97
PID 2288 wrote to memory of 2076	2288	chrome.exe	96
PID 2288 wrote to memory of 6068	2288	chrome.exe	99
PID 2288 wrote to memory of 6068	2288	chrome.exe	99
PID 2288 wrote to memory of 5124	2288	chrome.exe	100
PID 2288 wrote to memory of 5124	2288	chrome.exe	100
PID 2288 wrote to memory of 5940	2288	chrome.exe	101
PID 2288 wrote to memory of 5940	2288	chrome.exe	101
PID 2288 wrote to memory of 4508	2288	chrome.exe	102
PID 2288 wrote to memory of 4508	2288	chrome.exe	102
PID 2288 wrote to memory of 3164	2288	chrome.exe	103
PID 2288 wrote to memory of 3164	2288	chrome.exe	103
PID 2288 wrote to memory of 952	2288	chrome.exe	104
PID 2288 wrote to memory of 5052	2288	chrome.exe	105
PID 2288 wrote to memory of 2096	2288	chrome.exe	106
PID 2288 wrote to memory of 5052	2288	chrome.exe	105
PID 2288 wrote to memory of 2096	2288	chrome.exe	106
PID 2288 wrote to memory of 4696	2288	chrome.exe	109
PID 2288 wrote to memory of 4696	2288	chrome.exe	109
PID 2288 wrote to memory of 2364	2288	chrome.exe	110
PID 2288 wrote to memory of 2364	2288	chrome.exe	110
PID 2288 wrote to memory of 4284	2288	chrome.exe	111
PID 2288 wrote to memory of 4284	2288	chrome.exe	111
PID 2288 wrote to memory of 5604	2288	chrome.exe	112
PID 2288 wrote to memory of 5604	2288	chrome.exe	112
PID 2288 wrote to memory of 5784	2288	chrome.exe	114
PID 2288 wrote to memory of 1668	2288	chrome.exe	113
PID 2288 wrote to memory of 5784	2288	chrome.exe	114
PID 2288 wrote to memory of 1668	2288	chrome.exe	113
PID 2288 wrote to memory of 5324	2288	chrome.exe	116
PID 2288 wrote to memory of 5324	2288	chrome.exe	116
PID 2288 wrote to memory of 1620	2288	chrome.exe	117
PID 2288 wrote to memory of 3840	2288	chrome.exe	118
PID 2288 wrote to memory of 1620	2288	chrome.exe	117
PID 2288 wrote to memory of 3840	2288	chrome.exe	118
PID 2288 wrote to memory of 832	2288	chrome.exe	119
PID 2288 wrote to memory of 832	2288	chrome.exe	119
PID 2288 wrote to memory of 364	2288	chrome.exe	120
PID 2288 wrote to memory of 364	2288	chrome.exe	120
PID 2288 wrote to memory of 3560	2288	chrome.exe	121
PID 2288 wrote to memory of 3560	2288	chrome.exe	121
PID 2288 wrote to memory of 1508	2288	chrome.exe	122
PID 2288 wrote to memory of 1508	2288	chrome.exe	122
PID 2288 wrote to memory of 4312	2288	chrome.exe	123
PID 2288 wrote to memory of 2380	2288	chrome.exe	124
PID 2288 wrote to memory of 6112	2288	chrome.exe	125
PID 2288 wrote to memory of 5780	2288	chrome.exe	126
PID 2288 wrote to memory of 5780	2288	chrome.exe	126
PID 2288 wrote to memory of 2436	2288	chrome.exe	127
PID 2288 wrote to memory of 120	2288	chrome.exe	128
PID 2288 wrote to memory of 120	2288	chrome.exe	128

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 596
    3⤵
    - Program crash
    PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3948 -ip 3948
1⤵
PID:1860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe4dd8c728,0x7ffe4dd8c734,0x7ffe4dd8c740
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,10335331743358943939,917631114752774845,262144 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,10911586373205927430,17062974047674279035,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,7462941390794097986,15061034568829002718,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,2134751532387778553,743302050089442725,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,12529610722827354378,6170656524322765437,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,16435040644400543965,6222833826117204523,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,11810922043063358786,17862566390386979729,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,7348888145735451797,9222925559741568262,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,8371212278379680139,8395451480054667135,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,6476568843029946900,17253857692848953651,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,15107809569735345348,9054029763736726963,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,10643516723305811097,12033223319981616912,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5608,i,6138382381579758375,13658958220863684696,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6124,i,7961505059810136931,12635047227296791067,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,4745581586527372739,945808207263527284,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6020,i,7224120470714882074,26090376351124066,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6364,i,17748722642060956787,476873083150463871,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,6947669827548835365,13154868258913927821,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6088,i,3080495996626477159,13670322490029419,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6296,i,13547804357649399296,12118663976883600835,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6320,i,17796387835774428887,3597554225151717463,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:9
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5604,i,10298824129477103552,9951112497259572919,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3640,i,11887615706665931804,17975558432685333048,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,12065246169298240746,15229175047117268470,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,8244466369016540125,11092360532772343335,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,2459062548454517496,5751359975322914679,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6072,i,2392996250429987221,11226017365420469165,2097152 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6136,i,4832908539011368529,16730127629723852851,262144 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,133002383079851866,13439240972528630437,524288 --field-trial-handle=1912,i,3210547068266377158,5754895835664718551,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5004

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 e5c1687c9a9eac5b2f1635a1a04d5e91e1aaee55cdcd3d104d948d5511513dac
MD5 0778f8e1e227386b1aad02af1839ccf7
SHA1 9fc3dfce0955ae1a45777a82ec9fa9a183bbb138
SHA512 02cf5119864993a6491fb5b5567344090d80b32ad1474c78075aecfe27933648a95c4be541479ff76ed65ecdf713ab56a760eb742f3c4ded06fbf0721c529524
TLSH
T14401546C78B481AADF904075ACA24D4F1C20C37F8F310E27492C1DBF60316F8A646016
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 082eaaca05f8d4d5d2524be8a1cac779a73897db6c0b8012ed726eff6fe94133
MD5 d22709696f59ccd181f6fad2a4a3ceb4
SHA1 b8bbce559a6694e54765f2634c2e551eb954e98c
SHA512 2921a5118845a3b97eb13dc901703cb3b839e2d081f13db0a19c7336c2677f9f002b33394b0cf2910dd2da6837a4d554c3a2bd987fd267fc43fc522b10b60be0
SSDEEP 192:DzTXJ3n1EYJv7gcVfVmvWTWVaPxvlfPuNPeCISIakzK:DzTXJ3n1EYJv7gcVfVmvWTWVaJNfGNmO
TLSH
T1D9E1AEF7C3D8D62D884516F4EB256F2FCE2D0A28421D3C26C8D9AE5B93F1871D25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 06bb32b16460f3d5c92dcde863eb969732eec8d61159c8dcee2b6c912ac70114
MD5 787e3cde79b920367c01d364017b4a0f
SHA1 8fbccf522adb4d653a505dd6d29b8bbe6d917e10
SHA512 01cf9f6a1537cf61281e5841907a16fee8fd7f3a41c04efeb0a9efaf53f236d2bbb916fad49edaca73403b3e81eb25a0bde22c77b1939987e773da15d0d0fd8e
SSDEEP 192:DTOhJ3n1EYJvJKqgcaEVmvWTWVaPxvlfPuNPZISIakzHCHjhflnC:DTOhJ3n1EYJvJKqgcaEVmvWTWVaJNfGc
TLSH
T1E0F19CF7C3D8D62DC85156F4AB256F2FCD2D0A28422C3C26C8D9AE1B93E2472D25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 6ac800c6454a6f7dc6e98b1b8235705d690229e3b1ea144697ac2e4d156ad22b
MD5 79e84d3c0dcfe40684a179bad3f66cce
SHA1 b1ad5cd2294a7fe057648421e80a41ae6d71f257
SHA512 5edf16334fd671c71f3249da9fd8ffc93ea567553a8ee281d5d26afdac2f43a33045873ad368163856f9ccc5c1567ecc08b887ec9c7048e397e1b464483d8b88
TLSH
T10DF059ABA7AA756700B9867A1D18BC05697AB43402415DF5DF5A822CF0824E31B02017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b607dc4c1fa61eb94476e55eb0e56718ca8b1300d2c98dfcc274fce21dc7ed9
MD5 d433f06e61b020e7bf78e344e603ff47
SHA1 c199fab5ef1d54ca7698adf33022e984baef8d21
SHA512 957df8210437381184360acb99085a28e96379ed4d767db142f67cf8d4dc2e8154263c8b137cf0180885e47af31ecdd46d3505cde29ca5d42bae174f2db43457
SSDEEP 192:URRcBzKb4+cv7sAPRp2EfG964Hsb+WNnXs4AHeT82a4kwZVrVyIsnAUgE:URRmzYjIBXsbwc/eQ2jrtE
TLSH
T18A42A53EF968697B6CCAC219F9217B63D7F6102261942E84F7F8A92C11E79CC3217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 da42bfbf46a7aa2bce6a837778d3d6b0ebfd517577420e5e93ece7be9c0806a0
MD5 8b8e56c39cc09dc385450e8dc6c8a203
SHA1 4bec98be0ebf0969d90f6d466646b2f7f1b34a8a
SHA512 f4f8eafc087332cc0b499de155c0c587942035455d31e00dc68559da8fd6a919fea23ee098fbb3af707ef65749105d4a9c1046375acb97168d41088012724906
SSDEEP 192:URRcBzKb4Ujcv7sDPRpDEfG964Hsb+WNnXs4AHeP582a4kwZprVyIsnAUgE:URRmzYdjIEXNbwc/eO2jvtE
TLSH
T14442A52EF968697B6CCAC219F9217B63D7F6202261902E84F7FCA92C10E75CD3217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 23b1d7134589ccd90870528c186ecabe1e079ecdb4d0629b7c0c1e26b23e944b
MD5 3068403a2bc557b425f29639a14aa723
SHA1 aaacc51d73109812fd1e64434bd69169ead92bb4
SHA512 59e045446889856694de8b984c6631910c8939b37d9fac5e192bb191e999f1a87da066e70c73f9ce96551322ee7535b69dfc7c6428d2b245eef2db18cb117b91
SSDEEP 192:URRcBzKb4PKv7sDPRpDEfG964Hsb+WNnXs4AHeP582a4kwZprVyIsnAUgE:URRmzYOGEXNbwc/eO2jvtE
TLSH
T16742A52EF968697B6CCAC219F9217B63D7F6202261902E84F7FCA92C11E75CD3217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a9ee771a8876ee27efbfb5fe4c8fa99f7936ba71999cc312eaa1ecb8aa9ede3a
MD5 6a6ba02cda3becbbf44d8a1bf4adae87
SHA1 1de53cff6e11303cc2ed7d95d851509f9452a888
SHA512 dd826abb3868cabb0c9711eb88f505ee3d35c17f347c3836edd33f5b5e497075a5bc7aec18ceb5d91794a69db054cce1de2ccc8d3ad159e6ea6c0ea1333b2774
SSDEEP 192:URRcBzKb4m5v7sDPRpDEfG964Hsb+WNnXs4AHeP582a4kwZprVyIsnAUgE:URRmzYDZEXNbwc/eO2jvtE
TLSH
T14342A52EF968697B6CCAC219F9217B63D7F6202261902E84F7FCA92C10E75CD3217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 680b560dacc37c8be1bf5d364f89f4648e0e4e1bc32ba77b1eeb7a5ad846722a
MD5 f6132352156eaf657cabf23b3d3d3a22
SHA1 e68bffde3854b26a6f90a555d1d84fa34bc82530
SHA512 e019ac2681f4a65ad6e7b8c4307c17a0035ac506ab76c57c06616f53254e1c04ca4e31ac8a2a1da55418c87133a8450969c8368921c8dd5f672bc186a038e1c6
SSDEEP 192:URRcBzKbbmyv7sDPRpDEf9D964Hsb+WNQrXsCkr+AHez582a4kwZprVyIsnAUgE:URRmzYyeEXCbwN9FeK2jvtE
TLSH
T14952B72EF974697B6CCAC219F9217B66D3F6202261902E94F7FCA92C10E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6a4fab97c58c82da284f411ce0b2e2e4186ab149c4b9cb2bf9d04e7cd712552e
MD5 b53db45f5d80f579195e36642cbce2f2
SHA1 cdab123c0b889da780c470b661356da403a13aba
SHA512 34314d047d55e7815f2da9b99c0f462b6a97947b5c0acfae389a77f509f478939b9c3342305a8238aceb5453b0e42b0943857cf1f84ee91c5727bf7573d7c6a4
SSDEEP 192:URRcBzKb4mAv7sDPRpDEf9D964Hsb+WNQrXsCkr+AHez582a4kwZprVyIsnAUgE:URRmzYDcEXCbwN9FeK2jvtE
TLSH
T13E52B72EF97429775CCAC219F9217B66D7F6202261902E94F7FCA92C10E76CD3217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1222b948935a9cfe6d47e1cf52d37775dbf0b70af7e088b5b406ebdabb83c9fc
MD5 e4005bc102aa33e366a7a409cb0cee23
SHA1 80b7dc5bbe6a5540afbb2bbec0062a3193eb1053
SHA512 2d6e37aec53542bae3c853b7c4c228fd3700cfd6b55e4654abd23fd924c7d81d334e8dbd912c5de9bb5eee00f6a3308adcec9936ad4d45cbfc6eab940df55a66
SSDEEP 192:URRcBzKb4+kv7sAPRp2EfG964Hsb+WNnXs49a2C82a4kwZRrVyIsnAUge:URRmzYjABXsbwcj2H2jnte
TLSH
T17B42A53EF968697B6CCAC219F9217B63D7F6202261942E94E7FCA92C10E75CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 4afee44b0c93eb0652478eb16e3a66a59270d78763e4bce6029c7f0ec436a265
MD5 3010b0a8e3079300744a72f302916372
SHA1 4a7b09f123039d55446933def4bf23c600125233
SHA512 7d8e4314a159484250fb907fe64dfc4e35dfc225b9deadcdf9318776dc100dd2339bb37bb1c95019fe56f54fe436ebcdfbe90e7740fd9c28a9e683e6b77ce2a8
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3n0HGj7RqQAf:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAONK
TLSH
T168520867648D9A3F0FC8DA9CDC237F4FADF501576568092496FAAC0803E5BCA114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f93ec595c295f27e5ad7f6c4402340873c9f9e16e81df24561c06bb83d2fb213
MD5 3f98dcef4729fd77208685996d5e0bbc
SHA1 597944fac28b80cbba56a4abbb3524f1b34a61e3
SHA512 fb9599cd5c90fb96604780b155d8eb3f00778e38da3fb39dc301fb343f47a4519d9c8817f183ea7bb10538eab45aa3f1fc399132ebdfba77e447060fe05e5504
TLSH
T11DB0223838A308A3CF0203F820C2C2A3B030EC20A3B3C20230B80288C082A202AE8C00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b70ea739c2519596b270f1ffcce9621f72b891b7e340f539f725452a98247adf
MD5 60f70ea97c33bda6d99ad657f0143f2b
SHA1 1724e78a1c54b42d586fc4ff0dce2b0cd8a07947
SHA512 919ddb90d2494a0330028a600ce28f786852e3cdaa902ca6651038a2a6cda18bf655db4d86ec2458e64a40be398fdd9199b35c152faeddd07c98ed278daa14f2
TLSH
T1C9A00258C1D00533FE708274A1710582BB5298556B778743D6994485895F2C45116195
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4f4a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a4f4a.TMP
Size 48B
SHA256 95fd414ea0389697817e57b31023aa5bd9148a3e3d45a065079432af37d78714
MD5 5aff6a7c286a94b9ed0632ff57bfb687
SHA1 5848fb0b1ce6b10ab4a7e9cac3d8e45d453fa3cf
SHA512 d590070598fee093577663ebf28acc367622bc5f7ec4e0cf7bd6aeb57f27c3cdcda9e96bab3a2f616f3d7946703882b907cf0d81ea5535a924b5a69aa694caea
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dca1a586-0e6d-420b-af17-ff4e399dd53b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dca1a586-0e6d-420b-af17-ff4e399dd53b.tmp
Size 11KB
SHA256 0d50ca3b250047897b1ca721f3f1d024a44284ae998a14e97a52748b4966d668
MD5 caa6e6bf9417415a06a4b9f8530f8390
SHA1 5afc5ba412d78541d655dc8a1b20bfcbb7785539
SHA512 c3da41798765ec6a9c8d11d6584898a03c434671948781acab29193fbfcd0fab25737613ef229ce34139029795e9c0bdf1b2209931a1b433e4fa2f9040cbfada
SSDEEP 192:URtKb4+kv7sAPRp2X964Hsb+WNnXs0M82a4kwZRrVyIsnAUge:URtYjABXUbwc0Z2jnte
TLSH
T16732943EB968697B6CCAC219F9217B53D7FA202261942E84E7F8A92C14E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 ba3691313fe5ddf7bdff72fb0062cf3ec45c464b6960a3c6e86f4ecea684fea4
MD5 401886696a2f8811149bd73baa2c9acf
SHA1 f4e08f69fa023bcd813def6a483cf9aeae6d08b3
SHA512 098f168af2ecf826382f65d6831c8159ac7e4dbc2b077bc693999f57ab40fe9d520de5a41358fc0a139003e6b7907196765e9502223e12fa35dd6ad50e7fada4
SSDEEP 3072:zFUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUP:JecyezIAG8tUj01e
TLSH
T18CC312317C61EDB7C67404A0A25A7F87EC99A5878A49B7D8CFD42B6E184734E1A87033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 b91109959613c4535145784305b4901429bb061eaa9ee1041ab0d95fe54bb8ae
MD5 73c84b82a60375f99796d5762b596730
SHA1 89fb0b7b671a5011e0f3d8a2ba1e9e39d62fac2b
SHA512 7d674f9cd8e6a7d2b5fd52f33c9ea830d61edcc536c576993f2a813c877f26aab7ff60be9c2e08860ab96108c9de148b0d34ec69bb0da99aa3187827e9e32d44
SSDEEP 3072:0FUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUP:secyezIAG8tUj01e
TLSH
T1D3C312307862ED77C2B80170E36EBE47ED695581868973D5CBD52B6D198734E1A8B033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5ed723c635ff10d5828a35726ad5ecdbad3f2d3154a22fab0878c094a5224d21
MD5 f81cd762571306185ba7eff0053a312e
SHA1 996d8c5803a79efec7e7b7d5e44978eed43cee18
SHA512 01b26b0e89ea6c3cdd406200403b682a7c0c2216b0d17ad132570b346f04263f9bcf0e3e40b27e4421665c24e26e52fef4c144abc7e2e43d2a3a0c6d0f0c8383
SSDEEP 3072:7FUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUP:BecyezIAG8tUj01e
TLSH
T189C312317C61EDB7C67404A0A25A7F87EC99A5878E49B7D8CFD42B6E184734E1A87033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0526dac4e72247e9f3f48a0e01efb8ccff49896ce5f58ee5ee4e5ca3253b673e
MD5 d16928c152a5c8f0a16d896121073de5
SHA1 b756998076e519318c5b8da9678a94a1c711e759
SHA512 2f23b1ad3a8ed81cb0b0f19bdbbe8e302705df354aa4541e32d0dd95935cd2caf1b71b158f7aea08b49a7a4ebcf340eeb7d1c0f68d6b2dac20fb3f66791c71a0
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5jCDGB6/dGyv95SChbb2Jv4a:gC0LA/TE57cDUDIWUweSChbKl
TLSH
T1F4A1F971B4B95EB75D79C544F4827E83CF68A117A9216E80D8DD2F0C10E70E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 36e05dd343c33c6647a5ee55801f3c65d8617298e96848c5e4166d9c0d1a356d
MD5 c85592281fbd25e61763aaa7a0aeee2e
SHA1 09ea754c81e9d00043287f564f0ecb0b1d3dd8b5
SHA512 6d95e00231ee0bc2836d91c5a513ab1d37f2d3c3da2eb121f8b3789a2f1d804c0cc3f8b4b13f692d1ee8ac1cd002f8a8d7c4c402493bf471f166201e96279bd9
SSDEEP 3072:bFUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUP:hecyezIAG8tUj01e
TLSH
T10DC312307862ED77C2B80170F36EBE47ED699585868A73D5CBD42B6D198734E1A8B033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2288_1353350242\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download