713d7ef8cb4d9232551cddd2782b35c5d8b66ea6f550c154928557e780d2505d

Resubmissions

06/08/2026, 02:27

260806-cxjtcack8y6

06/08/2026, 02:21

260806-ctcwma1gqe6

06/08/2026, 02:11

260806-cmp8dacj6t3

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
socd_cleaner.exe
Size 152KB
Sample260806-cmp8dacj6t
SHA256 713d7ef8cb4d9232551cddd2782b35c5d8b66ea6f550c154928557e780d2505d
MD5 6d67dac23832cc767751a283ca6ae406
SHA1 7ffcd1ae41ad8837b4e61ed707ec664eb3e07da4
SHA512 d296b8b33e35b1b6b2e468c2b5d3845cf2e7059fe6b3c8379621686bed2f38543eed164e919416e1eb1a8121fd981cea3a2a2387dd0736a5b939d0a67c624d40
SSDEEP 3072:/ecpdahZA721Rz7gKLPGIR2wQxjRbd138O8g:7YA78hc0PDR2XZ
TLSH
T16EE37C57B7A530F9E4778239C8514606E772B8720721DB5F07A8137B6F232A09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304560433115170"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	socd_cleaner.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4176	4520	chrome.exe	92
PID 4520 wrote to memory of 5392	4520	chrome.exe	93
PID 4520 wrote to memory of 3828	4520	chrome.exe	94
PID 4520 wrote to memory of 5392	4520	chrome.exe	93
PID 4520 wrote to memory of 1900	4520	chrome.exe	96
PID 4520 wrote to memory of 1900	4520	chrome.exe	96
PID 4520 wrote to memory of 4504	4520	chrome.exe	98
PID 4520 wrote to memory of 4504	4520	chrome.exe	98
PID 4520 wrote to memory of 1772	4520	chrome.exe	97
PID 4520 wrote to memory of 1772	4520	chrome.exe	97
PID 4520 wrote to memory of 1808	4520	chrome.exe	99
PID 4520 wrote to memory of 1808	4520	chrome.exe	99
PID 4520 wrote to memory of 6072	4520	chrome.exe	100
PID 4520 wrote to memory of 6072	4520	chrome.exe	100
PID 4520 wrote to memory of 4264	4520	chrome.exe	101
PID 4520 wrote to memory of 444	4520	chrome.exe	102
PID 4520 wrote to memory of 444	4520	chrome.exe	102
PID 4520 wrote to memory of 5724	4520	chrome.exe	103
PID 4520 wrote to memory of 5724	4520	chrome.exe	103
PID 4520 wrote to memory of 5980	4520	chrome.exe	106
PID 4520 wrote to memory of 2604	4520	chrome.exe	107
PID 4520 wrote to memory of 5980	4520	chrome.exe	106
PID 4520 wrote to memory of 2604	4520	chrome.exe	107
PID 4520 wrote to memory of 3144	4520	chrome.exe	108
PID 4520 wrote to memory of 3144	4520	chrome.exe	108
PID 4520 wrote to memory of 4344	4520	chrome.exe	109
PID 4520 wrote to memory of 4344	4520	chrome.exe	109
PID 4520 wrote to memory of 3044	4520	chrome.exe	111
PID 4520 wrote to memory of 3720	4520	chrome.exe	110
PID 4520 wrote to memory of 3044	4520	chrome.exe	111
PID 4520 wrote to memory of 3720	4520	chrome.exe	110
PID 4520 wrote to memory of 5136	4520	chrome.exe	113
PID 4520 wrote to memory of 5136	4520	chrome.exe	113
PID 4520 wrote to memory of 5732	4520	chrome.exe	114
PID 4520 wrote to memory of 5732	4520	chrome.exe	114
PID 4520 wrote to memory of 5860	4520	chrome.exe	115
PID 4520 wrote to memory of 5860	4520	chrome.exe	115
PID 4520 wrote to memory of 4632	4520	chrome.exe	116
PID 4520 wrote to memory of 2544	4520	chrome.exe	117
PID 4520 wrote to memory of 4632	4520	chrome.exe	116
PID 4520 wrote to memory of 2544	4520	chrome.exe	117
PID 4520 wrote to memory of 5984	4520	chrome.exe	118
PID 4520 wrote to memory of 3996	4520	chrome.exe	119
PID 4520 wrote to memory of 1200	4520	chrome.exe	120
PID 4520 wrote to memory of 3476	4520	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\socd_cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\socd_cleaner.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb0dabc728,0x7ffb0dabc734,0x7ffb0dabc740
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,14970565882690931321,4418143732198747523,262144 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1540,i,6326694580803220044,11290703557548579085,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,9593414068507230779,626906288894204978,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,10348862403069913476,12371617421768005485,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,14539632165973222420,7723047502755248801,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,7293531296769256661,7603819969755120761,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,15238003039433425416,17917256913811244509,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,14266593250754505052,686279404592167616,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,9576571546836465155,1339367776643872195,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,14819128991595246474,8410504670689420066,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5496,i,3609552475025412054,1974568870021726343,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5976,i,7153549663037521953,3462196828270789203,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6108,i,13354983776109178716,1877311725665897061,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5656,i,852804841013022139,16607875114684699697,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6132,i,18312542787885881602,5732003333250319736,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5420,i,6757663249440584451,1566656000273077115,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,5221516657737179300,6397083002647923937,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,10368440823835832666,1575261516774402057,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,3749486969153671538,17804528094206305608,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4904,i,17811789082362298650,14146002968207344391,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5808,i,8523009019128730159,12337070314702437346,2097152 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,12776381810378934732,6455036990699935447,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,2781557946727540787,7754118170666558945,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,8772890219136033395,2157155257931244460,524288 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5000,i,8004114233742124072,1879841872149633665,262144 --field-trial-handle=1876,i,14643951015212377847,6106463049496293370,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c38a55a7a8fb5650b2fdf345684cb684b69bdd0455a69fb61fb077d8c9c671fc
MD5 9e36c3033f38a225e6145762fc7a9b92
SHA1 06ea26e77c4f80bde0d1d5150b9185562aa6b722
SHA512 fec0c0f9c0fecb36b028d5e75063a64c1c096009f417de42721e5a88482498b3ca135809c79d2c5261e8e426e72c2dd240a852f2f474ed156d28ed13e404aaba
TLSH
T144519AF3C3D8867D885152E49B217E1ADE2D0A28532D3C62C8D8AE4F57F2873D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c110cc625a5fbdd0833cf6dbc35cbeff6d87245051f5ab352519545898215c77
MD5 ee0a218f6fd4eb297cb9d8757388daaa
SHA1 1ab78239694b0b80f7ef0b0e3807edb45d0b1898
SHA512 e3aeeeb213458b078a98af5532dfaf56b226ac58f43a41fa2a466acd72d9969384bd89c1214167143157121735e5f5f629e0a83f3e06a707fe6e2b02b6ff331b
SSDEEP 192:kRj2+Jokv7BAPRp279gHsb+WNnvs0K32RBSkwkvVyIsnAUge:kRj2TAwXcqw00w2jSEJe
TLSH
T10B32B52EBD25797B6CCAD22EFE657793D7F5102621942E84EAFC892C10E75CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fdf1a813d0ff78367950069dc43a6c68be57fa9e8181e218b0c933d2d2fe74c0
MD5 135ea18a22ccbd2760db159d6d3db21e
SHA1 e9c3b6091ee4a581439f33acaa0192b5e6c96476
SHA512 de68ab2c6f3271613ab3e479a75f2fcb6e3a067b5d4daf5fe18ef6d52d188020ffc69205a349da8a9a06d419fb4daff9bc3dfca16e85bd6f485d35bc7c391c61
SSDEEP 192:kRj2+JoZv7BrPRpH79gHsb+WNnvs0+32RBSkwk8VyIsnAUgE:kRj2T55Xbqw00s2jSEYE
TLSH
T12E42C62EBD15693BACCAD22DFE657B53D7F5202621A42E84E7FC892C10E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c29af73fbd8dd54813dcf94643ab3166f3bfbabea6bfc13a400feeed2f05d694
MD5 c837a8afa11d0e8dc6aa07db1576ec53
SHA1 72ba1e919c2ee003fec9c078f951dd06b3c8fae5
SHA512 cb057bb96d938fb352272e1525cc8a0f948039d69b9ebdcf4cf5d41b04c5d4eb0d54debbf646776cf5da27268b0e13f3374a088002458c92e76b745dd270ebaa
SSDEEP 192:kRj2+JoZv7BAPRp279gHsb+WNnvs0Z32RBSkwkeVyIsnAUgE:kRj2T5wXcqw00J2jSEWE
TLSH
T1A132B52EBD25797BACCAD22EFE657793E7F5102621942E84E6FC892C10E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 57654a8dc6dd2af22ca8e2df95d2f43ccc0f929a203af8ee1728c2ae45fa2c28
MD5 e08e9932a25582422bedeb3113c503a5
SHA1 76d8449b9fa16c656c366426c9ecc92687690cc0
SHA512 aa282601f7261f941335abeec4b3035c41a5599987f8b7108cdeaf53ea6dc421391e3bb618baca68442385383ad24bbf19b636f84f013cd8956724e22e117728
TLSH
T14CA00213C5C08595DE008270A0A619453651D89419A2470B79F209448C5F1C05505254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a44da.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a44da.TMP
Size 48B
SHA256 1c93b83ac5f963e86fc6da309df0ae09e592647c02f4f4d456cb496dccf15bdc
MD5 9298c46e43484a680c9da6d0f5858830
SHA1 2e83e9f94e2dfbbb0b8275041a66ea7b64ec3b85
SHA512 f7bd97f08a2cf23e4f4c38e90b1cd38e69419bd07c17f14b559b0772480200eec1a129bca5aa2c136b0465b0cf4fda4e2dfbb8a87ebe103ab71a928d6c82d20c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 3193c06b6b703c2ca0228e1245b0b8885764e0673996351d9a98a84cd2053911
MD5 70bc344a639b3569600c38a6c40addce
SHA1 e66ada67c87ab7fa1bc37341bab0955b7d2ffa4d
SHA512 e804ecb08273121c33e6718c0e5b0d2ce8672112d62eaa875312d306cb0b7fda75faa05555699e56ea8ccc53868d13e7f510b4b3ecf70c3c98b059f1bf8b7748
SSDEEP 3072:SBQcHIEJLSuoarx9OjuHuBeqkcpw3ciUmerUj:z9EbXvHuBzkcph+
TLSH
T15CC312A05EF5FA663595FEFC302F4D055B01AA170E587490BF104D9E09DAFED62CE8A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 65eeef4a44c9502e29f2b9132586e8602b8f893fcfdb12e55b880bf9db2cdeda
MD5 926b60ee57740a680036f64c5c49356d
SHA1 624ab1ac2835e30f7d06b577c9950f58a5cc5011
SHA512 e292fe4e08c86a8564cb922af8130145aba63bc2067d1d569d6ff4c07b4b4c40102460136cf42a71ead3859ddaed0759ff6f3902fe9b600919a1c925723a32c6
SSDEEP 3072:tBQcHIEJLSuoarx9OjuHuBeqkcpw3ciUmerUj:Q9EbXvHuBzkcph+
TLSH
T11AC312A05EF5F9653591FEFC302F4D055B01AA170E487490BF104D9E09DAFED62CE8A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 aeae7424392da9785b95576ec46be35f209a38e66cd24af0ae6899b815b6965a
MD5 4d08fb64974cc9dfe55e8b86963d8b35
SHA1 dd4421f3cc88e93552c736560e1faa7aaa804c3c
SHA512 2ff12badb7f5d0a150deda812a616c733c884e1cc0c3eba07c9d1a2ec80584c8582d437f63f0d917e70b8ca2663ee4f14c0c4d8a31a925ad8bf355c4c69f512d
SSDEEP 3072:S5QcHIEJLSuoarx9OjuHuBeqkcpw3ciUmerUj:D9EbXvHuBzkcph+
TLSH
T106C312B15DF5F9A625A2EDEC302F4D054F01E6270F587994BE104D8E08CABED66CE8B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e259d0b177f5fedcc18367e715a6237ec5dc113615d422036f79c11d0e1e8073
MD5 df8eb9b930ff722356b4b43bb8fdb157
SHA1 eb26f9207981bbead409dc4fafd05e199b5fb2f1
SHA512 f977f6dd60191a5235ff5badc769ae0363b05630a917ce890d40796c80140b6eff2b121e2d76c8a2f681b5a0c13b93786f994baf7b7464660d9295fe8ffbb26f
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5g6D/B6gGyvXNQSrbfyYv4a:RC0G4DkG/FZ9kGDUD7JMAQSrbfX
TLSH
T13DA1F671A86D8EB79972C448F5923A43CEA4A0AFA651AF54DEDC0E0C11FB1ED1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_1999425495\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download