a743c1f346588bd0d4c6829a462afacac0c27113b5b88392afdfe9b755222467

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AngryBirdsStarWarsII.exe
Size 2.5MB
Sample260804-wlmkmsef97
SHA256 a743c1f346588bd0d4c6829a462afacac0c27113b5b88392afdfe9b755222467
MD5 3b1d1d55dc65020196a603be6e319c30
SHA1 6ec7a97127cf8c64fa789bfcfa3681418f5288ef
SHA512 5f3c24578d91f001aeda854449388902349475a3809b1342f2557e2b2774df09c44f0ebefc7f2662cf23d6d80e15d1c985b3e3f1f6757fa028ca58767ebde4ed
SSDEEP 49152:rtg9qSx66jC73OWpCtX1KaG0TiFKbWEictbe6ytoZdMXRgZTo/8uwOlf1THRgFES:rtg9qU66jCqWpCtXMaG0Ti8gctbe6ytg
TLSH
T1B8C58D25BB06C172E58B0171C97CABAF546C9FA1072D14C3F2CC2D9E7D746E25A3A21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirdsStarWarsII.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1052	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303400881564242"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
5244	chrome.exe
5244	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	2192	chrome.exe
Token: SeCreatePagefilePrivilege	2192	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe
2192	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2852	2192	chrome.exe	92
PID 2192 wrote to memory of 1052	2192	chrome.exe	93
PID 2192 wrote to memory of 5336	2192	chrome.exe	94
PID 2192 wrote to memory of 5336	2192	chrome.exe	94
PID 2192 wrote to memory of 6108	2192	chrome.exe	95
PID 2192 wrote to memory of 6108	2192	chrome.exe	95
PID 2192 wrote to memory of 908	2192	chrome.exe	97
PID 2192 wrote to memory of 4640	2192	chrome.exe	98
PID 2192 wrote to memory of 908	2192	chrome.exe	97
PID 2192 wrote to memory of 4640	2192	chrome.exe	98
PID 2192 wrote to memory of 3892	2192	chrome.exe	99
PID 2192 wrote to memory of 3892	2192	chrome.exe	99
PID 2192 wrote to memory of 1648	2192	chrome.exe	111
PID 2192 wrote to memory of 1648	2192	chrome.exe	111
PID 2192 wrote to memory of 4244	2192	chrome.exe	101
PID 2192 wrote to memory of 3912	2192	chrome.exe	103
PID 2192 wrote to memory of 1308	2192	chrome.exe	102
PID 2192 wrote to memory of 3912	2192	chrome.exe	103
PID 2192 wrote to memory of 1308	2192	chrome.exe	102
PID 2192 wrote to memory of 3832	2192	chrome.exe	105
PID 2192 wrote to memory of 3832	2192	chrome.exe	105
PID 2192 wrote to memory of 3128	2192	chrome.exe	106
PID 2192 wrote to memory of 3128	2192	chrome.exe	106
PID 2192 wrote to memory of 2428	2192	chrome.exe	107
PID 2192 wrote to memory of 2428	2192	chrome.exe	107
PID 2192 wrote to memory of 4928	2192	chrome.exe	108
PID 2192 wrote to memory of 4928	2192	chrome.exe	108
PID 2192 wrote to memory of 5948	2192	chrome.exe	109
PID 2192 wrote to memory of 5948	2192	chrome.exe	109
PID 2192 wrote to memory of 5996	2192	chrome.exe	110
PID 2192 wrote to memory of 5996	2192	chrome.exe	110
PID 2192 wrote to memory of 1648	2192	chrome.exe	111
PID 2192 wrote to memory of 1648	2192	chrome.exe	111
PID 2192 wrote to memory of 3860	2192	chrome.exe	114
PID 2192 wrote to memory of 3860	2192	chrome.exe	114
PID 2192 wrote to memory of 4984	2192	chrome.exe	115
PID 2192 wrote to memory of 4984	2192	chrome.exe	115
PID 2192 wrote to memory of 1076	2192	chrome.exe	117
PID 2192 wrote to memory of 3552	2192	chrome.exe	116
PID 2192 wrote to memory of 1076	2192	chrome.exe	117
PID 2192 wrote to memory of 3552	2192	chrome.exe	116
PID 2192 wrote to memory of 4556	2192	chrome.exe	119
PID 2192 wrote to memory of 3264	2192	chrome.exe	120
PID 2192 wrote to memory of 2304	2192	chrome.exe	121
PID 2192 wrote to memory of 5244	2192	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\AngryBirdsStarWarsII.exe
"C:\Users\Admin\AppData\Local\Temp\AngryBirdsStarWarsII.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xcc,0x134,0x7ff90156c728,0x7ff90156c734,0x7ff90156c740
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1428,i,7191643372985630864,8067736835289797932,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4828129193221680765,5799411755062876598,262144 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,2683211795765193117,1464771401246291611,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,4424561674216569733,2331302444789731954,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,14965389821582151663,5627372793027296694,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4720,i,3255032376340677041,13928723868075261623,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,8088403871080022123,11270656142434407375,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,4227285256448070640,4453736529433580348,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5528,i,8759449988084237547,17915672672982963838,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,15921203157458961761,4942829033009482954,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,662161580970606756,9650509671045363631,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5728,i,9640595259595445912,4550021767407415693,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6132,i,2422675493520290681,608345765569782521,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6260,i,13631532019540142956,12276714580237073530,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6088,i,12261721676244656574,5624276793947152527,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6504,i,961273006867132163,14643444672133225004,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,835834657236035157,14584336843443337768,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,17271395371198572980,3063762700990827512,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,1302945297139537016,11709610389683964072,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5804,i,9734706772884784823,4553484627197984143,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:9
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5608,i,15350885495400010845,15679367971374809387,2097152 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,1987069269079749378,2529022357625745520,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,17755945131329846421,14329104188823275251,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,14352207033627893633,15401065453874916779,524288 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6828,i,881754351050237842,11479151797094314523,262144 --field-trial-handle=1876,i,5646227353752530565,1191147564150600410,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4610d44177f623fae2afe481fa75819e67dbc10a6adc3b53d626de40376c81b0
MD5 dad92fa9ef1ae8b832c6d21944b5c6be
SHA1 afd3ee06f4b2a58589da127b2c1b950240eae9c1
SHA512 5106b8dd0177eff8104893e4b660c3d51b7b1a9a43342bb0049fecdc863a9c84718a1a08ca523adfd20d17ccfd61f44247853d5f45d44bde3d0f929c2c7b6b1c
TLSH
T1FA516BB3D7D48A6DC81152F49B256E2FDD290A18122C3C62C8E8AE5B57E2972D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a0ee78e2982441bd133279377f6efe0949c1f47670f937b5c6545404ae88c8bc
MD5 8a95f9b4e11a2291bea37fd14ab5f2cc
SHA1 9f8286b2993d4bc7406b90b55ad269fc06c2bd03
SHA512 185d6cbf380fd2db37d3b8e85e5bb90291a0e399b0a0a783a165e4df2eac6442c0aba7d58d1878de6d324428b9eb4c670b2d71fce3f835a8074da0e48e5ba784
SSDEEP 192:RRurb4oVmv7sAPRp2X964Hsb+WNnud0QR2cekkwARVyIsnAUge:RRuPDVSBXUbwc082Mg3e
TLSH
T10B32A53EBD65697B6DCAC219F9657B53D7FA102221902E84F7F8992C10E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9128a58f26d2e40ea2c84d42346379f56f9d2e40a660536206474e1f2818f087
MD5 450710e8b60463c5379da7fe3cfda2ec
SHA1 dec3eaa75a9fd512e6f8076b9f6fadb7aaf1bf00
SHA512 2da16e62512a10147f972d994f938b29e5c09643beeb5c9e852a3ce67481ad52b7124361b1e45db211826045c1b7ba92e7931eae5b77318993b1a14828ec6416
SSDEEP 192:RRurb4o3mv7sePRpZX964Hsb+WNnud0RR2cekkwORVyIsnAUgE:RRuPD3SfXZbwc0D2Mu3E
TLSH
T11F42A53EB964297BADCAC219F9657F53D7F6202221902E84F7FC9A2C14E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 62d447bd3bb6cbdd228cb972d7da21e423f67c8fdc4ab5da72f284cea495cae9
MD5 f0e13875f3ffd56cb44265655d20dd4a
SHA1 b752ef8a03fb194f88d26e5086a6af105aeb1584
SHA512 c67f81885782eda7916a711194c289dc229fcdcc99ef9e0e7fce2f8de2863436415cace0448e1954e7af1e5a18ac53b0e8dead7433540b6491383a1b3c7c08b9
SSDEEP 192:RRurb4o3mv7sAPRp2X964Hsb+WNnud0CR2cekkw0RVyIsnAUgE:RRuPD3SBXUbwc0e2MU3E
TLSH
T13032943EB965697BADCAC219F9657F53E7F6102221902E84E7F89A2C10E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 af6a4a94cd33ad135fc55346ccaa4085fccf62ab3fef3e01c82118a6e010c379
MD5 d7732d7a102ddc1bad7022a00b8f250b
SHA1 d315efcace3afb20aee32cc77856197296295722
SHA512 ce91c19f1d0186854b13876feb32d3f485be4e0b59d04d77609433b60b9020a1bd9e9b4d658066d6c4bd1a4bf666c0eba100fab729bf26a2c90965dca56489bc
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU39hHGj7RqtwO:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAONZ
TLSH
T1D4521967648D9A3F0FC8DA9CD8277F4FADF501476568092497FA9C0803E5BCA124A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8da40dfc3f2f526ab13dc79af2c44ee8630e16ace41553de8e4a4a02aa635114
MD5 c143987c508b4f693711994ce491fe9f
SHA1 3077f48f9aeedadd1eb36930b0a5efc7831702a0
SHA512 d255142c0b4eac2534150500b59163e4031832f779eee120af8d1aaeb70d9b14dcaa0e2d95c259f186b0312ec797a536777adcde8d82e60be8bf36ffff431caa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d1f5e2a926792d97f147ae167f973e6728e6da0ef96cdd6396f0112ed6cf940d
MD5 a4880332dcb2e9b2abf5d1e25dbe6ada
SHA1 e568aa6ce1e3b57dd695ee70cc461881c6cf3eb1
SHA512 0d07fb3b542311b8dcf6f2a54fabde956b4f4d4e3eb1166824e0c0023f26bb3103be3da153dd17200a73f8fa4c78cd92176a641412b614f4ed82d63595ef3e65
TLSH
T144A0021561C494A1CE5C8370B071195336E2D8541762674B54D70954E8EF1E04201E39
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5d88f732fa05d2d8138322ae7e4fd122550c3a77ba35aa3ef91ccfe876162a2d
MD5 c19aaab2468d1b1a5a751da1e5d7c87e
SHA1 b2f7cc15114a0c9ca26c1d21111ee037df68d620
SHA512 0028698883b3959f5a814f37a66611683945fb8f1a6803ae5ca0cbb3d29e64671c4695696002112461bd51cbeafc00715ce70be8a65c0ed40c2263e5d15e8e60
SSDEEP 1536:3u6HfMcu4aCdng+yyexv5Vl4Bhr6Mq5SoTcwG85KcIJY49rTga+pFGxFXUFVaWmJ:+vcucgpxv52FDTBrqpFGFEiBJ
TLSH
T19CC312726C3D19AA2AF48DFFA0472C971F9ADB57A10827DCCEE53F670534B05051B21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 99321d84009203b3f0ab3892524ca2e96b59832aa3e2438027e16fb1a84f7a0a
MD5 fb9bff3f1fdbe1ef3f40bb141ec5e823
SHA1 cc71958d53dd8c5ddebdb3c80d652dccfde6e14c
SHA512 3e41f1c6d8633c5e061d055a6d014410f558c691d317be5e71e8c67b21db57027fb3a9e45a31c829ec14f94fabaa6c70e8418d8f7a04df7100c4163be488aae1
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5RCDuB6/dGyv95SKhbb2Jv4a:gC0LA/TE57cDUD+OUweSKhbKl
TLSH
T1E4A1F871B4A95EB75DB5C584F5827E83CF68A117A9226F80D8DD1F0C11E71EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 e9df456c4c4c2141f3a4616a5ade8a34cd3e71f54e8f62683ed55f0b3748ffdd
MD5 d681886d63911c2441976621a31c1c3e
SHA1 877226347f12ab13caa4aa9f577fa9f174711dca
SHA512 f6658766572c2b55e0fc51604a931807a49d2837ab50af535b36fac42bb6de0656c1135e5b4e718b6b3658079039b9f847a9f81f1b43f7b21a4eb4b26228c9b4
SSDEEP 1536:wurHfMcu4aCdng+yyexv5Vl4Bhr6Mq5SoTcwG85KcIJY49rTga+pFGxFXUFVaWmJ:T4cucgpxv52FDTBrqpFGFEiBJ
TLSH
T171C31241AC3E1A6A66F8CABFE05B2C9B175B9B56E01D17D8CEF53A671530B00052F31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 59609f947f41c77484e3090614c532d957104cbf9c259ae14b15e60b18e89676
MD5 bcfc8239bcc920c021750c43ad270b39
SHA1 2e87d9d63e71e174a9d9f60056dd0ba087aae73d
SHA512 43f5ddca6bb00b9551cdc567c05ceb6a763ab6e7eed91af5a3c0c40441e35bc0a18359c4d7f41f935e83cf8c8d0b01965db53381ce2e1d13e76fd933f5769620
SSDEEP 1536:3urHfMcu4aCdng+yyexv5Vl4Bhr6Mq5SoTcwG85KcIJY49rTga+pFGxFXUFVaWmJ:+4cucgpxv52FDTBrqpFGFEiBJ
TLSH
T1DDC31241AC3E1A6A66F8CABFE05B2C9B175B9B56E01D17D8CEF53B671530B00051F31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2192_201505325\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download