dd23e3d8e865b180f5443becfe9220c3bfd0b704988c77e15c3d36c7b7f1b992

Analysis

user interaction
yes
max time kernel
330s
max time network
325s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-08-07 135852.png
Size 147KB
Sample260808-cwrska1vb1
SHA256 dd23e3d8e865b180f5443becfe9220c3bfd0b704988c77e15c3d36c7b7f1b992
MD5 662ba831c9b7bfddd4fbe9af1e907aee
SHA1 f01e8deec57da3d2749d2d2ef217aa06521afb7c
SHA512 1134414c1b2fb94c0edfea4862b6e20a8037ff242b1e65b8a20158d46f70fc2d3fe1be0e617784c83e24d94ec667d54ac6ddf5fa1802eeecfdef76db689ccdea
SSDEEP 3072:v+vC2xqriU2HLnc4IgG8WDq2gI5LXzx724lnuScd2yojs+VMFJXn:0CXri1XI/q2gkLX9q4lnu7toVVWJX
TLSH
T151E3E02ED80668F5CFA911F544DE8B9837B34D7015A30B8623E8295DBDEF361AF066C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2116	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306295897805439"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1140	mspaint.exe
1140	mspaint.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
5752	chrome.exe
5752	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe
Token: SeShutdownPrivilege	620	chrome.exe
Token: SeCreatePagefilePrivilege	620	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe
620	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1140	mspaint.exe
1140	mspaint.exe
1140	mspaint.exe
1140	mspaint.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2324	620	chrome.exe	94
PID 620 wrote to memory of 6400	620	chrome.exe	95
PID 620 wrote to memory of 6400	620	chrome.exe	95
PID 620 wrote to memory of 2116	620	chrome.exe	96
PID 620 wrote to memory of 4728	620	chrome.exe	98
PID 620 wrote to memory of 4728	620	chrome.exe	98
PID 620 wrote to memory of 6848	620	chrome.exe	99
PID 620 wrote to memory of 6848	620	chrome.exe	99
PID 620 wrote to memory of 2832	620	chrome.exe	100
PID 620 wrote to memory of 2832	620	chrome.exe	100
PID 620 wrote to memory of 7116	620	chrome.exe	101
PID 620 wrote to memory of 7116	620	chrome.exe	101
PID 620 wrote to memory of 3068	620	chrome.exe	102
PID 620 wrote to memory of 3068	620	chrome.exe	102
PID 620 wrote to memory of 4336	620	chrome.exe	103
PID 620 wrote to memory of 1288	620	chrome.exe	104
PID 620 wrote to memory of 1288	620	chrome.exe	104
PID 620 wrote to memory of 1416	620	chrome.exe	120
PID 620 wrote to memory of 1416	620	chrome.exe	120
PID 620 wrote to memory of 7132	620	chrome.exe	109
PID 620 wrote to memory of 4688	620	chrome.exe	110
PID 620 wrote to memory of 7132	620	chrome.exe	109
PID 620 wrote to memory of 4688	620	chrome.exe	110
PID 620 wrote to memory of 3208	620	chrome.exe	111
PID 620 wrote to memory of 3208	620	chrome.exe	111
PID 620 wrote to memory of 5696	620	chrome.exe	112
PID 620 wrote to memory of 1928	620	chrome.exe	113
PID 620 wrote to memory of 5696	620	chrome.exe	112
PID 620 wrote to memory of 1928	620	chrome.exe	113
PID 620 wrote to memory of 4348	620	chrome.exe	114
PID 620 wrote to memory of 4348	620	chrome.exe	114
PID 620 wrote to memory of 6244	620	chrome.exe	115
PID 620 wrote to memory of 6244	620	chrome.exe	115
PID 620 wrote to memory of 2888	620	chrome.exe	116
PID 620 wrote to memory of 2888	620	chrome.exe	116
PID 620 wrote to memory of 2672	620	chrome.exe	117
PID 620 wrote to memory of 2672	620	chrome.exe	117
PID 620 wrote to memory of 5616	620	chrome.exe	118
PID 620 wrote to memory of 5636	620	chrome.exe	119
PID 620 wrote to memory of 5616	620	chrome.exe	118
PID 620 wrote to memory of 5636	620	chrome.exe	119
PID 620 wrote to memory of 1416	620	chrome.exe	120
PID 620 wrote to memory of 1416	620	chrome.exe	120
PID 620 wrote to memory of 4500	620	chrome.exe	122
PID 620 wrote to memory of 3528	620	chrome.exe	123
PID 620 wrote to memory of 5344	620	chrome.exe	124
PID 620 wrote to memory of 5752	620	chrome.exe	125
PID 620 wrote to memory of 4216	620	chrome.exe	126
PID 620 wrote to memory of 4216	620	chrome.exe	126

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-08-07 135852.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:6616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8560dc728,0x7ff8560dc734,0x7ff8560dc740
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,11859987539171029198,14554116170239692698,262144 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:6400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,15157052479038587697,17485643861185654876,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,1836635051808402645,5372745943357496771,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,13451098014386509547,10075864474650227750,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,13851078930996357385,5560175399424989018,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,9396064288696858544,969495610631399478,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,13475907640872519703,14338830643057987093,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,11052246832939359737,3796277030972319405,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,11142060234422217854,8037181948924392483,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,6179834106371946171,13379526074540578649,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,12297595428585809828,1804500117365692773,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:7132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5484,i,1446323076962351812,11712616753158053537,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,2255796664703775469,12003787823960564756,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5584,i,7585577471270368287,15493624098525933991,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,2018982354678775706,14364905039395801689,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6108,i,6212966819412970494,12719159694534103474,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5976,i,17807022656441919541,12020962684561778957,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:6244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6192,i,9904652320646736598,8888010006885734699,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,17129592887624218876,17909094978883521440,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4892,i,15107641634247723425,8485379680942711107,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4768,i,14456949794633564381,16076801424992737450,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6124,i,10925316403499235765,12000900476168850333,2097152 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,1148407383132048878,48070181050923056,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,8705194474412815775,4666964476041962138,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,12685369944336405436,6312538669163860655,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5572,i,9574331591542711010,6428011706818336634,262144 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=900,i,3538923172578309999,7778331536071122529,524288 --field-trial-handle=1912,i,17546985769229535424,2626877430508187704,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

685f5f19-8dc6-43a4-9085-e0791368142b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\685f5f19-8dc6-43a4-9085-e0791368142b.tmp
Size 126KB
SHA256 515cd13238f7438d711b0bcb4d18f2740effc41da21dd8397962a6c2464ed276
MD5 83d5151adb459e5c8c0830a6efcf02e7
SHA1 4e1693dc3b80ef5cf9ab88fa5bfa77504b5a6f4f
SHA512 9a520139bbec75b3afb1720da389669a1b1b5c9f6589175b5071bb6fce50092ac496bcccaef504c819c5ff669ff14ba5a518d2e6b74330bbba24a4c706416e37
SSDEEP 1536:MENlP/OL3jOP19VW7yHtWpASKWvO/OO1sSvlfgSI+JFVc/imNU1vMyF8eb360k8u:vlHJW8DS0vsgjIgDcCxMONb3HkcOZh
TLSH
T1F1C312B1F8382F9344659F2E3B00262AAFB0E0736D9DED425D51538E0A5B4CEBB68553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 a13f3db8778e251d7d3eff33f735561758a327d05362a69e21f001926bd8d137
MD5 b7c2eb4f5950328ba00434b98a5947a2
SHA1 a17089c4f58e55ccdc28accb6e79be4ef4af68d7
SHA512 ad14dae286b69ba6def3c1e1aaac7a7f1d0721d5c0fd72f0a0a95afc8bc66ef28a4d5817c1754cf5e581d9777a6787f83a003443e1358c4fe16bf469a1cce36f
TLSH
T120C09B5491740128C79C85F11556086325581E60418551D7C191CB8E6C922641475500
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6302987a5efafef171a01440fa70b2435f85ef4cf9da86cb1297bea6a98daaeb
MD5 528126d1e1992c2576c710fb63d10442
SHA1 ae048a169e98d53db68ac23fe09fde2bd7dccd17
SHA512 2ee5bed8dd2e500aaae4ef8f56a1fb3ae2969160c661e744381df3afd2a85277c901f08972fed1035c583fd0f1efa8fa7964cf2683837ff6fa1dd61c5ea18693
TLSH
T170816CB7C3D8C66DC85156F49B25AF1FCD2D0A18422C3C66C8D8AE5B57E2872D35138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8527ad9184cd2aaec804a677b939fbd6dde92ab7c98322a5dab09d84b65534e6
MD5 af0b13ba4b9bd1ec135da1c85ca2d49d
SHA1 99261e60e2f6a08ce15bc85afd4e93eee12b3d99
SHA512 f97fc9b2b1f04607fd0eb4b750727d710b41caeb364d9ca44e36ce1d149e41800e621a2c6baf8a1eff98d80aa816cb69af3c6d47ea655999fede0b765945eeb4
SSDEEP 48:YALlhKqeqVqAhfh/hjsJSXLsJR6foKsUJfRsUfsWoshKsLqzsetsW/cst+ssqs2E:DorqBNp3+6tJfrTRZ+3pi8E
TLSH
T1CA917DB7C3D8C66DC85156F49B25AF1FCD2D0A28422C3C66C8D8AE5B97E2472D21138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1da95630fafb5f8b4cc0739c82acc5a357bcd77d8ec1b9f0b4dd3b36e79ffa4c
MD5 639e3862af68a6534699e3406ea2d1b8
SHA1 2cb2cb0a3741c8f141f83e713de4e6177f5870bd
SHA512 f29d8dd7b89ff725729bd42c6e6f27150abd4bb9fc9bf3d8568f814505a1b62ca88336e13286453cdb07bfc7eea796fd9eb5dc1a937ef1e10f90b30b18a3a018
SSDEEP 48:YALlhKqeqVqAhfhSsJSXLsJR6foKsUJfRsUfsWoshKsLqzsetsW/csjKqsw+sqla:DorqBNs+6tJfrTRZ+33KmIE
TLSH
T1B5917DB7C3D8C66DC85156F49B25AF1FCD2D0A18422C3C66C8D8AE5B97E2872D35138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 93dc1978311d2c039fa09a95f1dac2f55a46076d487e7c9b9c77b1772ea6931d
MD5 211a67f1cfbc61383d1184a571a5f49b
SHA1 135d17a71e904447174ce12fe1382decf657bbfd
SHA512 931b9ef106df68324641fd44d5b847803cfc19baf78a2ff9034e5bc10d844a92de01248e31c127ede0f4f1dec08f1b0fed21737901892c92503789b4f0fb7c1b
SSDEEP 192:4RfkRj0v7F8APRp2c9CHsb+WNnzV0YQTkw5HVyIsnAUge:4Rfk5w59Xfkwp0BTZhe
TLSH
T1E242A52ABE10697BACDBC61AF9617B53E7F6102171D42E84EBFC8A2C14E75CC2127017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 750529804e77e4c0cb666aec75a56da482fbe297c1df749b6ecd02b942ea340e
MD5 143c316998f09ea2030bae295f8fbb52
SHA1 23647636b2a7725ec83a259e869b5d63f42c1380
SHA512 d5163054ae974ae1532f3da730ff3bbf749162d17b5660efdf7a36228fec2bad50a8c1a26ea4342e52e0861a7118f7479da12a0eb975037cab4627d245525f32
SSDEEP 192:4RfkRj6wv7F8APRpiBsQ9CHsb+WNnzV4gk4ypQTkw5EVyIsnAUgE:4Rfk56s5xX+kwp84yiTZAE
TLSH
T1A742C66ABE10297BADDBC61AF9517B53E7F5102272D42E84E7FC8A2C14E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 968a4e2c25398f3134e8ecee18c1c04355ed92d14a24ab819e49db152f10d817
MD5 2e31300ba56ae2d1096828e647dc1d25
SHA1 d2e3cda259e277b81c9d3c55415fe290e3803600
SHA512 4c67d6c92418c1d3148c0563d91b6934a92e2a55c17195b9f54fbe74def0323af0207c7dc58179bc6378cdc5a4aeb20bc088e393a18e060404a60dd4e5e28080
SSDEEP 192:4Rfkij2v7F8APRpiBsQ9CHsb+WNnzV4xZmQQTkw5EVyIsnAUgE:4RfkEC5xX+kwpEm5TZAE
TLSH
T19542D72ABE10697BACDBC619F9517B53E7F5102162D42E84EBFC8E2C14E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 075d6a28f9f7978efff43371160be2c51c5f1595a082faef3f7d9e218f2380cd
MD5 f488b28d41c104000b8341a2e18f9551
SHA1 8a4d7778cf79163639c0d4231cae7dfd80aef0ab
SHA512 cb89f2a5f0c5526a6bd0a65f15a4e203ff0096f47997473574de20d53f465ef1880401034418fe2b1dbb8b1f8c59042887350c2653aae68999bfc8ef6d02b395
SSDEEP 192:4RfkRjdv7F8APRpiBsQ9CHsb+WNnzV4yW4gvQTkw5EVyIsnAUgE:4Rfk5d5xX+kwpQ4g4TZAE
TLSH
T19942D76ABE10297BACDBC619F9617B57E7F5102262D42E84E7FC8A2C14E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 ff3bf5a98a7e01e7b2c0ed00a8994648c6b6336b3c272c62a10d9dbd2fa704d4
MD5 89c6640ba9e946aec80b236e39c9ce75
SHA1 3328a2e76ffaa9f3b97d133c37ffd3a839ac560a
SHA512 faef512c4af493d1bd48a75c4640177ca0798ec3bdb9b873f4677be8cd312c31c3834fdf780e7f275e23bead4b98156ec2cc76b32bfec83329702f4cba7a1225
SSDEEP 384:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmXODdc+ErU36uHGh1X4GfdkP:BLbC7KxkXqKf/pUZNCgVLH2HfgsPsOZh
TLSH
T1D352F867648D9A3F4FD8DA8CDC166F4FACB5025666A80D2493FB5C0803957CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 85697aab717a23fbd685895b5b4a4fa921a3241559d3de8690476bbb8c76416f
MD5 bd55e68aa71b8714935595a5dc15b9ad
SHA1 8f624b034c06dcfc7f6789279301f102360044ec
SHA512 47865ba5ffefa92dc2fdeedc25d5912b2de910b6a3baa05574a23a74cfa01cb0d8cabb7dd1b5249e6ac4d00f4c110d7676bf6f50feea2b052a459874707c50ee
TLSH
T131A0021281C04852CF044675A072394266738C676651C35354D50C4CCA9B1C0D121142
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c8a5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59c8a5.TMP
Size 48B
SHA256 ed5330d7a0f7b483ecfbf85ee067576714b197dfa1dc183ed0d034a20b417444
MD5 b507d15de023af29e0903b2978910e09
SHA1 c28efc90a786ed1add915d5fd1a0eb55b6d5b240
SHA512 529614b9183e7ef8cf52390be9ff17065b77c44977c7ce956a0ac564c4939c142c6abb4a1f1fbcccecd2f0b0ced3b27523d957bf1af7335fcf56d56a1c9fa21f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0fc1274a9b409844c4ab90c9a7e1c1951073cbe8e67b13929af9edc5afc3dd95
MD5 6d3a7d1e089281c26e7be2841be8a2c4
SHA1 abb6fe99d3e3c45a4ca3ead7d4fa9dce021b08a4
SHA512 e826a1b9465f86b109097344ac7e9745c9cec374b5b175c4feb67826ecd671f73e90f4ff9059013f1c848e44c7e5940770747cf809bfa70fca4f693f13f8e2b9
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok57VDaB6xGyv1T5AkqbKv4a:MkC01N2c6AGDDUDJK1U5NqbU
TLSH
T130A10932582D9C7788B2C949B5522E43DEB8712BF921AF94E6ED5B0C11B70EC1381617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 6edc0eff56f1c027204e048cb8af1bd199caa8e63d353dbe773cdd97a121b3af
MD5 7724eda52d7afae93f7445c315f34583
SHA1 b94577932111b7e30da1a3cfa89d082573961aea
SHA512 1d5e14f6302f6f52a23aeae1e69de9ed41b3136139c696750369736864cd6c8051bd3e79faf881f14551c8e8488668b17939651de170b8cddffe864f91b4ca73
SSDEEP 1536:hnP/OL3jOP19VW7yHtWpASKWvO/OO1sSvlfgSI+JFVc/imNU1vMyF8eb360k8GU4:ZHJW8DS0vsgjIgDcCxMONb3HkcOZh
TLSH
T144C31292F8383FA38485DF3F3B04252BBF60E0726DDD99825D52939E0E5B4CA6758453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 74e6fd358a199033cbe35a7e8599ae0802ebfb7926dc9c91561bfa98fa8c22eb
MD5 65a5e8e10478fbe4b0b361b2e0c4200f
SHA1 b179388f68f7ba4bf9a365a1e1f349df747d404e
SHA512 55a05ca711f5fbd872c091ab84bb7b9873a807195623dbd01d813a162fa06be61f464b79d7c2e6a3a27a1f2d28b5c713dbb6be534705540b44eb35a51c13df3f
SSDEEP 1536:onP/OL3jOP19VW7yHtWpASKWvO/OO1sSvlfgSI+JFVc/imNU1vMyF8eb360k8GU4:kHJW8DS0vsgjIgDcCxMONb3HkcOZh
TLSH
T1C3C31292F8343FA38485EF3F3B04252BBF60E0726DDD99825D52839E0E5B4CA6758453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5d393e1da8633b90bef745e80ef4d7f8b12bd8214b3b8942a9211869fd7da9c7
MD5 9e15f1b5f77640f238b2fb309375f631
SHA1 86c37c3586ce3eb9c5c82ee18bed232b12479704
SHA512 bc0ed1df743589dbf177c42bf451c834371b2801e5386185b1ce44bf1a0721de271837bc5e5d792408cfb81441b5cae08f50031ef5bee70ce74c6f3d26989b2d
SSDEEP 1536:oENlP/OL3jOP19VW7yHtWpASKWvO/OO1sSvlfgSI+JFVc/imNU1vMyF8eb360k8u:DlHJW8DS0vsgjIgDcCxMONb3HkcOZh
TLSH
T18DC312B1F8382F9344659F2E3B00262BAFB0E0736D9DED425D51538E0A5B4CEBB68553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir620_1424331828\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download