78ae45d089ef275bb8ad53d7d69e048996eb3ca61539ce046ac4aff09eb150d0

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kick/install.bat
Size 91B
Sample260809-24vxmaxbka
SHA256 78ae45d089ef275bb8ad53d7d69e048996eb3ca61539ce046ac4aff09eb150d0
MD5 0ce5eca8c5ca48c5246a2b7db68a3c86
SHA1 224e0a2cdb1e74dbfee49ca40990be4a607feefb
SHA512 0ed6e12651de52eac1d862c68baf254bb206dad799818b1a72e65529ecfac2d04bf52194ef0e16c5ba9b398fc905b387147845c7650eae0e0a82657b55b86a49
TLSH
T108B0120F14796070FE098D29C01700935D84E08320158B1360DF80B00D86890D303302
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2504	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307905441679046"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 5668	3308	chrome.exe	91
PID 3308 wrote to memory of 1248	3308	chrome.exe	92
PID 3308 wrote to memory of 1248	3308	chrome.exe	92
PID 3308 wrote to memory of 2504	3308	chrome.exe	93
PID 3308 wrote to memory of 6024	3308	chrome.exe	95
PID 3308 wrote to memory of 6024	3308	chrome.exe	95
PID 3308 wrote to memory of 4736	3308	chrome.exe	96
PID 3308 wrote to memory of 4736	3308	chrome.exe	96
PID 3308 wrote to memory of 1536	3308	chrome.exe	97
PID 3308 wrote to memory of 1536	3308	chrome.exe	97
PID 3308 wrote to memory of 3416	3308	chrome.exe	98
PID 3308 wrote to memory of 3416	3308	chrome.exe	98
PID 3308 wrote to memory of 1784	3308	chrome.exe	99
PID 3308 wrote to memory of 1784	3308	chrome.exe	99
PID 3308 wrote to memory of 2004	3308	chrome.exe	100
PID 3308 wrote to memory of 4088	3308	chrome.exe	102
PID 3308 wrote to memory of 2460	3308	chrome.exe	101
PID 3308 wrote to memory of 4088	3308	chrome.exe	102
PID 3308 wrote to memory of 2460	3308	chrome.exe	101
PID 3308 wrote to memory of 6128	3308	chrome.exe	104
PID 3308 wrote to memory of 6128	3308	chrome.exe	104
PID 3308 wrote to memory of 3192	3308	chrome.exe	105
PID 3308 wrote to memory of 3192	3308	chrome.exe	105
PID 3308 wrote to memory of 5580	3308	chrome.exe	106
PID 3308 wrote to memory of 5580	3308	chrome.exe	106
PID 3308 wrote to memory of 5604	3308	chrome.exe	107
PID 3308 wrote to memory of 5604	3308	chrome.exe	107
PID 3308 wrote to memory of 1216	3308	chrome.exe	108
PID 3308 wrote to memory of 1216	3308	chrome.exe	108
PID 3308 wrote to memory of 360	3308	chrome.exe	109
PID 3308 wrote to memory of 360	3308	chrome.exe	109
PID 3308 wrote to memory of 3540	3308	chrome.exe	110
PID 3308 wrote to memory of 3540	3308	chrome.exe	110
PID 3308 wrote to memory of 5636	3308	chrome.exe	113
PID 3308 wrote to memory of 5636	3308	chrome.exe	113
PID 3308 wrote to memory of 4600	3308	chrome.exe	114
PID 3308 wrote to memory of 4600	3308	chrome.exe	114
PID 3308 wrote to memory of 4588	3308	chrome.exe	115
PID 3308 wrote to memory of 944	3308	chrome.exe	116
PID 3308 wrote to memory of 4588	3308	chrome.exe	115
PID 3308 wrote to memory of 944	3308	chrome.exe	116
PID 3308 wrote to memory of 4148	3308	chrome.exe	117
PID 3308 wrote to memory of 4148	3308	chrome.exe	117
PID 3308 wrote to memory of 5896	3308	chrome.exe	118
PID 3308 wrote to memory of 5896	3308	chrome.exe	118
PID 3308 wrote to memory of 2120	3308	chrome.exe	119
PID 3308 wrote to memory of 2120	3308	chrome.exe	119
PID 3308 wrote to memory of 1272	3308	chrome.exe	122
PID 3308 wrote to memory of 1976	3308	chrome.exe	123
PID 3308 wrote to memory of 5124	3308	chrome.exe	124
PID 3308 wrote to memory of 5964	3308	chrome.exe	125
PID 3308 wrote to memory of 5964	3308	chrome.exe	125
PID 3308 wrote to memory of 3536	3308	chrome.exe	126
PID 3308 wrote to memory of 3536	3308	chrome.exe	126
PID 3308 wrote to memory of 2268	3308	chrome.exe	127

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kick\install.bat"
1⤵
- Executes a command shell one-liner
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa9613c728,0x7ffa9613c734,0x7ffa9613c740
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,17292315013743112071,14285590643142291159,262144 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,11024063205157111572,7773194551967800919,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,16544817016642012462,7004164887975108920,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,12534573284492537245,17106752807994769410,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,6520774055676064783,15495755666422530804,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,1109570123388107427,442420474104148555,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,16737486544283119216,8966548095116679848,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,3015364684378844024,2884984107005440222,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,9160215220715363609,2484694535909222645,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,12551951385574071080,2947110127082934484,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5616,i,9065971679860142456,13596559238445988138,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5580,i,13944402465887676328,3136431298531435034,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6136,i,7610652159889875462,7774154904164220456,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5984,i,14850838387278978822,10314512363707344324,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6400,i,3046610665781107297,17663404554830883358,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6396,i,11431259564663746550,7686942166552411472,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,4375822990178968145,7857677827599656494,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,15468528950599047516,8036755840868934575,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,10045755603754920126,8109663496247646326,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6200,i,10763474803702781295,17873072981663127604,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:9
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6348,i,6932361397787517828,16566822372303217338,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6540,i,14056361569062109249,12211711651109021726,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6672,i,4126466723239419382,7597793060667836745,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3256,i,7156635972454847769,5168794012975846301,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,9798365405287280169,15680650659999475894,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,14019481463970067681,8009883904813261554,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,14814846878219674053,6176990684254104801,524288 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6352,i,7505871839672310984,3279786924568695779,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6632,i,1295010548872584080,16834354173410040891,2097152 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1236,i,17570421803967370885,5882041469877471989,262144 --field-trial-handle=1852,i,11019085989472973742,4184984623853770696,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 34KB
SHA256 2eb4d0e3cb128980fe742a1ba48af930185bcad854fdf95efd360ff37534448b
MD5 64e23fcf925edf0eac35c87a30e32661
SHA1 427432a2550be26ebe18e5ce4b5f512c4e0dfe53
SHA512 c24cffe4abbfff4b14c19b986ee28d0848c3ea55aa5c8c3bfdb3051ef1c3320b553358c837b5593d8eb8a130e4fc912ba06ea5e8488bdb89da5b707021ff2708
SSDEEP 768:dmKUFsNUffprmflN1Txob6UjfDp25r9tJ28nGOxHNwprCRnoWkH6YnOi:MnFixlNFxoGEVQv2AxtPREbP
TLSH
T182F2F11BD0A2DD13BAC45F568B9F0B81A9D19305BDB4DF1622B2A737E3B7B4001E2D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 647069259ccfcb50ca3938f4b4c4c77b8a2d97e8842dcf7220dfa06321acc666
MD5 9299285034381c84a2228a260e4a5aba
SHA1 f51456527222406c27876e5963dea13c0210fc04
SHA512 6f3beba35b8c9e0394b3bf2d248f42c8e869d2093f44b238d566bbc596b892b97e207693c5d8f4a85a457153cd6af1abf25c5341770dda8a38a77b3a5f1d91b0
TLSH
T1ECF0DF4CA0806319CB80F53194D0BD873DF2015A4AA38EF6D3A51DB7A32332AA467534
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 c37e4e998f65f82e3b4ec27b20906f966f07624f890056af858b1db15aa04ada
MD5 c42a911f6c49768d6f00bde1f9074181
SHA1 0bf8dca3d09eea0789642e32d24cb04218befea6
SHA512 77128a55348d9e56158f179fcc47fa912b12144c702cbdcec3f9df53c429af732c035a0e3ad99f98f2003aae22018ad6730d2792bca4e97c7a1ed6ff77e302c8
TLSH
T1D6B0127D7580A54DCB40253218C10D842900097412110B1241E50BDBA43B3B31557454
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ce32eab0ff3dfed0801f9b90b4b78da494717a39fc8675280689234a10b1b290
MD5 bc1d57f701b6d105cbf825df3f3996f1
SHA1 b62200ae7316043dc847b47c4e9ec1dd05b13859
SHA512 3a3de90d9173028e71774e6e17a5b17804050eba62c84501b0d4ef2848703ee789a6ede2cbe08460ae8e099f2809752fbc8686d49650610a336006e81202fb8b
SSDEEP 48:YALlhKSqSq59hpHfuHfQHwS6HfTXYfoKs/Rs64s6fsoosrKsQHpsVRHHsX+s70Hg:DoSh+zmIULIAd6Jb6ESF0MQWUUiA+ItP
TLSH
T1D9C1AAF7C7E8867D891252F49B102E2BCE6D092857283C76C9E8BE4B53E1571D25074F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8baea998403deefeca8334b1de648ccb4f9530823fc93b7dca93e5462b70bea7
MD5 adeda3a2939f79d79902a90ee2abce72
SHA1 d160e62c2fcebef50644cfd4a775eeabb6e573df
SHA512 4e9f810ee9557fa26b046458326c0704025d756c977efd4658de0554be7fe11a752b7e702f915939559480c23b279716a755cf890ac95f2f1661beb655c6c701
SSDEEP 192:CRa1b4riv7sAPRp2RyW964Hsb+WNnAHN8r2x7ylkwJadyQVyIsnAUge:CRadOuBXubwoi2apagUe
TLSH
T15D42C53EAA646ABB6CCBC319F9117B53D7F9102261943E94E7F8A92C10E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2c09224504faf1c15593a033c0cb8075b08b45834b410f670e665a8694ae5c00
MD5 1fe03cac65b75a84948cda2b7500cceb
SHA1 8ddab6edafedc0c154e2ee10a09d56f781374ffc
SHA512 fa5b51fa768005db5435d48aad516437fa64a8f97f24e49a117879ac05a3e2a481b676372e6a3075c8144a08f9a368473dbb275f84a63dddfed61d8c288a87ae
SSDEEP 192:CRa1b4rBv7sbPRpj+AOu/yS964Hsb+WNnAHNzwY3M7ylkwJadnQVyIsnAUgE:CRadORYXVbwo6YRpa9UE
TLSH
T18A52D63AAA642ABBACCBC219F911BB53D7F9102260D42E94F7FC992C10E75CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3075435cce03b691fe62bf3714fe6ed8ecee571882acf1a56f5d99aa2bf2c0f8
MD5 4dffc25af5d3787e8f7eccaad6d58f90
SHA1 777bd1c4b5bd96da8358f01c376fab0fbffe75d6
SHA512 adab214283643a242dcc11fe2b34b98d662dfc85f739ac4eb29879ca9675631630e8b28931752aa0c06f588d1b160dccf93615165f79ae653ec03471eeefdf6c
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU31FHGj7Rq52:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAONg
TLSH
T1F5520967648D9A3F0FC8DA8CD8237F4FADF501576568092496FA9C0803E5BCA124A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ace11da035dfb41ca7039220d50da2311c7e8046\cc948759-62b8-4fda-b41a-9eb99400d22c\index-dir\the-real-index
Size 72B
SHA256 6e7a087d5f170873e1267923159933f38a06056064fc6ea2c9a561c14b712ea5
MD5 2a34e5515b44f5fe77998fa3d94dd6dc
SHA1 38efb423e145a2c7d95ae07bcef91139bddcc1b2
SHA512 2a4c9c6d3c2c6515de9cd54f4d9f104a340215c8efd9390c0bfd97fe6f8932d4a3e1611f220776bc44d6cef299f8ca664e9cee43e4b607024034ca286eaf5302
TLSH
T1D0A002242154800AD61467B0A04621D063A748204B16524241E084888B517A0C98322B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8e76.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ace11da035dfb41ca7039220d50da2311c7e8046\cc948759-62b8-4fda-b41a-9eb99400d22c\index-dir\the-real-index~RFe5a8e76.TMP
Size 48B
SHA256 67229fa9e08d61a019865df2a99646e3fe1cce1eb1d60a19e7cd6ba90d7006c3
MD5 ab0a9f6ce741b8fd4170ca2b15a20ff5
SHA1 0799bee70cae76d44f26454c8017f318ebb484e8
SHA512 5cb3aa55a5326e4d28788e242e50751279c18a0a11830647b947eaed5eab81e2ad4a5d778e4ffa2353ed1dd0459dfed7b5ec2d113552048d2b23f6f0a19f6bcc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ace11da035dfb41ca7039220d50da2311c7e8046\index.txt
Size 127B
SHA256 293ed2c249eaabdfe4fb0d71baca7e7e6ce8701aed165311777183772cd222e2
MD5 1ca66096707a786f589eee5f65541159
SHA1 59d9cf975079d17fd17098f95b86625f4b8cdeb5
SHA512 d21064934b78b1428161fc09aee830ec75804e5502e04e49a95683b1c7e9d45daa1d831fa074b7fd05d74913a2a18ce7bdd020012d82eae1f28899f002da12d1
TLSH
T194B09B77418451306B5793F01824AD5CA3D788DD44E88425D9744D441D5C4189146765
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a8ea5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ace11da035dfb41ca7039220d50da2311c7e8046\index.txt~RFe5a8ea5.TMP
Size 133B
SHA256 cbcbc73e1c8992ce73415ff9e76d924f45b8cc42aab0566c3f04da2c0301e1fc
MD5 ae6ed77ed22fb12065a52e057d24a4a2
SHA1 fe3248be52d6affde3dfe85d531c0586ccb052e3
SHA512 2d3c8e5ddfa1f2a803cb7f00e19184338d760556f34033008e1f278d2f6e39ca1c62d530ea232e223d35774d7eb5d49e7759be393c958c5e77ff0b82da40d00d
TLSH
T142C02B3F41840130B74352F01830AD8CA3F78CDC04D88038C4207D001D3C418C209721
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e30f24bfb4f0582b301f63e37d7fc069f1f5146d83c82e94d38c9438e93cb435
MD5 42a76619e4cc6a7e0b15d4d32424f6fa
SHA1 85ab5ed30d4026154905173a36d214d24198e4f5
SHA512 c07bd245d9530c5843dba3954cfb80864076c5e2ff18507151410f7a56076800834de2833159e64b8b23fd3d0a4a26c92b61baebea6e31aa8a8dc214d34c410b
TLSH
T1D1B0121980476580C990C7701244145522915F31C0028742CFE095D9AC431F10320510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 78f592703579b46a07288a8d5eeb72bcf7da95069796d8ed481f0f69488f48fa
MD5 1b4a9f102e66cd7766700ff942c9bec0
SHA1 292ca340f150efb449cbd0138190925d6d215131
SHA512 fa835993b0ed00ad9d540b1b2fce56a30d46a068a2c18f2a0b27cae3bf1648042144bf78f453c3d84ce400207cef6ff696626fc5e252135cf95d43311d06b0ff
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 afbac0849c6f01b620f6ec8b40b667c1c5848f27a8c917d350b03f16db593822
MD5 a6e04212a1606a6ba4a0421de7ac91b7
SHA1 3453d61d8a39142b14a933045d66141ac891e14e
SHA512 7f9700ab3210ec1cd3e686aa8da9893d45a167a099da4df655e17e839a039dec0d7f8b14c9becaa2a0c9b36c6f12910cfedefd99dd6fffbe7eac372b89456c28
TLSH
T1BAA0021C41C04859DF544670A171064223614C195951871374A60856AC5B9C04101D00
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 cce79630f7cd2975907a6018370aca3125558e1c9be789ae5004a84943f2acbb
MD5 a33623a0b46e0b6dd59acade899c9922
SHA1 1a32ab3981e8c5e1d6f8670e79a1627937b80b05
SHA512 1b63a5ee19d4719c9a44556d9cf840915fd723a3c4298d0f65fe4289130f185ae86d6c284788ed5786fc3e84cd94856bbdc4fd277019acbecfbf9474d0395ed3
SSDEEP 3072:X3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8G7:6X4NwhgqKR4ILo59R57lOYo8+
TLSH
T177C312F0E53717EC5C7999FE30143AA1CFF1E18DA2D8B5418AD57A6D310E898530993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 ad151a38c2ec02e6b8271e69d8c58a710b0e19340b5f7bc3c054632facbcf51a
MD5 50dbe7dd39456036030546fd42dc4c1c
SHA1 1706cb4a1f177386517474a410a1079aeff70f51
SHA512 dfb21612960336fee879aca6da085718df09f0a5b484328ef48992bed92e30b5549bbb21d793b091cde6000ff783d291f76f9e491385883cafeb57302a0cf416
SSDEEP 3072:K3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8G7:BX4NwhgqKR4ILo59R57lOYo8+
TLSH
T1C1C312F0E53717EC5C7999FE30143AA1CFF1E18DA2D8B5418AD579AD310E898530993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6a536edccbdcd41ffdfcbc55b73632d76c5d48c5ac1619918458ef23daa26b2b
MD5 2e6137558e578b17b2d34481fd145d73
SHA1 7fa26ae8f86271117878f96d87f871e04a251ac7
SHA512 8e53f19bb1d8a942735a81baa986dc869efbd346437d4abddca58eda46db83dbeac830cc128faaef72bd334d3668a4306f707b5f25564965a4b6f513f8702997
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5aQCDJB6/dGyv95Sohbb2Jv4a:gC0LA/TE57cDUDePUweSohbKl
TLSH
T1FFA1E871B4A95AB75DB9D584F5827E83CF68A117A9227E80D8DD5F0C10E70EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 ee61f28e806dc7828632af292fa3e77d279c1e94e9d9d26fbd42cf8321a0d1c0
MD5 37d0c7382a403157ab8e18b96889b073
SHA1 f31b3801196454caf6baa221140be4c2bc2e7403
SHA512 247e28426e2d4d36545caffc16bcfa9f868ae9d21561790ab3e3e3aefcac71e86f7b77ae52ac334032e9fc8812178fcc4c00fab3e9e7d8a55f8b10a8adbc86a8
SSDEEP 3072:33uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8G7:aX4NwhgqKR4ILo59R57lOYo8+
TLSH
T1E0C312F1E53727DC5C7A9DFA30003EA18EE1E18EABDCB50589957E9D310E498930993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_101776174\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download