89dd75736c785557181188ae8f6a39976c06195734f3bda461681c512d41be96

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
900s
max time network
889s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spectacle.exe
Size 8.3MB
Sample260810-3jynfsbq91
SHA256 89dd75736c785557181188ae8f6a39976c06195734f3bda461681c512d41be96
MD5 8276e49f7d2878a1f8d7ad9fb68b1c2e
SHA1 88d067872ca477bdd36af34d404981acd76a4586
SHA512 455ce2fcc4b57d75087ad890073b00521f773ecedcfa3584cfdc0799f3e0f9087822bc87281bc7ff583c03a2f1a121f7d18959501c6c661d718ca960a91a09f9
SSDEEP 196608:7M8RGmbheQZuXe0/IPAVC9z1wTvglUy5uVCATDM:TAmbheQZuXe0/C9zMgq4uV1f
TLSH
T1CC961217F3A246DDC6679538C663E717E2B278141732C2CF23B48952AF976D08EBA341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1120	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308784943897691"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
4496	chrome.exe
4496	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeCreatePagefilePrivilege	2140	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 5028	2140	chrome.exe	93
PID 2140 wrote to memory of 1256	2140	chrome.exe	94
PID 2140 wrote to memory of 1256	2140	chrome.exe	94
PID 2140 wrote to memory of 1120	2140	chrome.exe	95
PID 2140 wrote to memory of 1936	2140	chrome.exe	96
PID 2140 wrote to memory of 1936	2140	chrome.exe	96
PID 2140 wrote to memory of 376	2140	chrome.exe	98
PID 2140 wrote to memory of 376	2140	chrome.exe	98
PID 2140 wrote to memory of 1116	2140	chrome.exe	99
PID 2140 wrote to memory of 1116	2140	chrome.exe	99
PID 2140 wrote to memory of 4432	2140	chrome.exe	101
PID 2140 wrote to memory of 4432	2140	chrome.exe	101
PID 2140 wrote to memory of 4496	2140	chrome.exe	102
PID 2140 wrote to memory of 4496	2140	chrome.exe	102
PID 2140 wrote to memory of 1220	2140	chrome.exe	103
PID 2140 wrote to memory of 3868	2140	chrome.exe	112
PID 2140 wrote to memory of 516	2140	chrome.exe	113
PID 2140 wrote to memory of 3880	2140	chrome.exe	114
PID 2140 wrote to memory of 3668	2140	chrome.exe	115
PID 2140 wrote to memory of 3668	2140	chrome.exe	115
PID 2140 wrote to memory of 3544	2140	chrome.exe	117
PID 2140 wrote to memory of 3544	2140	chrome.exe	117
PID 2140 wrote to memory of 2372	2140	chrome.exe	118
PID 2140 wrote to memory of 2372	2140	chrome.exe	118
PID 2140 wrote to memory of 4092	2140	chrome.exe	119
PID 2140 wrote to memory of 4092	2140	chrome.exe	119
PID 2140 wrote to memory of 3216	2140	chrome.exe	120
PID 2140 wrote to memory of 2920	2140	chrome.exe	121
PID 2140 wrote to memory of 3216	2140	chrome.exe	120
PID 2140 wrote to memory of 2920	2140	chrome.exe	121
PID 2140 wrote to memory of 1644	2140	chrome.exe	122
PID 2140 wrote to memory of 1644	2140	chrome.exe	122
PID 2140 wrote to memory of 1400	2140	chrome.exe	123
PID 2140 wrote to memory of 1400	2140	chrome.exe	123
PID 2140 wrote to memory of 3756	2140	chrome.exe	124
PID 2140 wrote to memory of 3756	2140	chrome.exe	124
PID 2140 wrote to memory of 4496	2140	chrome.exe	125
PID 2140 wrote to memory of 1032	2140	chrome.exe	126
PID 2140 wrote to memory of 1032	2140	chrome.exe	126
PID 2140 wrote to memory of 4940	2140	chrome.exe	127
PID 2140 wrote to memory of 4940	2140	chrome.exe	127
PID 2140 wrote to memory of 1580	2140	chrome.exe	128
PID 2140 wrote to memory of 1580	2140	chrome.exe	128
PID 2140 wrote to memory of 3164	2140	chrome.exe	131
PID 2140 wrote to memory of 3164	2140	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\spectacle.exe
"C:\Users\Admin\AppData\Local\Temp\spectacle.exe"
1⤵
PID:3108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff96405c728,0x7ff96405c734,0x7ff96405c740
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,7263639537257008994,1382753866686410184,262144 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13244151557907295245,6625231662097355307,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,16497272063742967347,13154057620917018463,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14703150593721724802,16883856390719571658,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,10745233650621591843,11933026178600612007,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4448,i,9213211972206890814,16656782700698459508,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,2940691912212730077,6423143575803129629,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,10987719181492228418,6291106134831720063,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,10282659629968021788,7811810306406068069,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,13122953853239355784,483714215819251209,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,547981743018026614,8508445543095514741,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5704,i,5456450885409243249,1519751319403586468,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,5104361417587473292,6918396107462883231,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,15503870015806966773,6872613444401497242,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,1058613695665226565,10279795529689132145,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6068,i,13627841808702170185,9464084148783962786,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6084,i,11234324071799669794,12294962082709854965,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:2
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4708,i,15685362308139325957,9874410222733730518,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3420,i,8478873611109586466,2050214689169019617,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5884,i,640611765833546436,1758081945674057323,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5868,i,4075335400931002411,7149251326702589975,262144 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5580,i,6549929915257082835,11681524711787375708,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,6774516011483165908,13597728121911380034,524288 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3496,i,9666243730178426187,1363952205946863377,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5684,i,13153960151551075117,14275520962737442157,2097152 --field-trial-handle=2004,i,4867751519443579329,12002417425951307172,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 855e60826c5876cd663128173249830d0cd9ce06a3fd03c9b62beff8fc7d2bf8
MD5 37df4897aab3ddd5c6878d43f77783b0
SHA1 eb9564b11b2154d2ea0c920e87e185af418ad47b
SHA512 10a9cba1ea0c3c43ef048df7a246a65b8b5b73696004b74e344164c5c3339a26bab5623e4fef1fa738512207297caf845300754cda57bc234bfb5645656f034e
TLSH
T11AE02BB9CD61FC2B2CFE172860518745F754135B2A40495B7A3C850C8FF0A3A56C5C1C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2bdb1c5f2d3217a7aefa96b91657dc0683f4ed5a2f089196616b4d114f64c39d
MD5 7733f66c9d2bace5e0f9ca3c02a84301
SHA1 cc293c75341d12008796eef5c1089bdf7a9d41bb
SHA512 11f9a6d3a0c35a081c45c7ad0a9a921d0f5b36bc645bd3b729ee0df19e336b6f26b77efee3f70623cb3958a562ce27294bc43e32481c113f127aa845e965e7ad
TLSH
T11F6179F7C3E4867D851266E49B257E1FCD3D0A28122C3C6689D8EE5B53E2876D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fde2e165723fb119f5f6d404e69c6a3aa3a6526441a91c871661f6e138cbc79d
MD5 00bd78175155cdf18aa2dc0d3ab1547d
SHA1 3336801c7ed564a90ee8543928a8907318dfff9d
SHA512 57d1b9341021dfd6f3ad1b2a696e8afc62871d258b37f26173459a748394a7f37dce9e5c833a46022013c1f7b564a79828663c6c54d08c6536d05ffad654d538
TLSH
T1D95178F7C3E8867D841166E4DB216E1FCD3E0A18122C3C66C9D8EE5B53E2876D21139E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77868070656c3d945afc12dfbadebb63442776a671032f25393b24bc31e7c903
MD5 cbd1a55f5dba6c9a247376eb2b7625c1
SHA1 7e8f5d859f39ccb8e7b7cfd3be6397f740ad0f7b
SHA512 263f8798ac1b5db9221982c74264e64f157b4d702ecfd45a6f2232132cdb2b15d90dbcef7f61650a68bfb98838390854413d58dd1273146de85ec8eefa1baebf
TLSH
T19F517BF7C3E4867D881166E4DB216E1FCD3D0A18122C3C62C9D8EE5B53E28B6D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3b3cabcf12858783243a68036c191b4da36cb04c9c75f88d1b32b6aa29360609
MD5 9ce6e489d2d452e42d319b95bbbfe13c
SHA1 e09674f90020efb10e17f08935257b7c2f9416ad
SHA512 b84dc58d99b5bfc51fb995b9f04a9af606fcd7058d13cc2a65304951d629675eeeb6c546e071a6125fe59c58e0641467176ae25f785b8e64240be964979205a0
TLSH
T10C517BB3D3E4967D841166E49B256E1FCD3D0A28122C3C62C9D4EE4B53E2476D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6aa5ab790c03fc2f295c8a187c211393879951f7e96ee0c9903c5c8c11a2ff77
MD5 00ac5d3a247baf1eb17bcb2c493a2097
SHA1 579cfc77d98f9eb4159574983d954177a9e05d47
SHA512 f093378cd24ab34b3c8b7f5ba2005597c11242a594fa2887a6c3024b6c71ddfbcab000d74f01c98c4fce1b7a9c25d3a751729d17070a8713f1e322c367114213
TLSH
T1EC519CF793E48A7DC51196F4DA21AE1FCD390A24122C3C6289D4AE1B93E2973D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 988cb1093610eb44cb4799b896531ab3dc02ffae7e0869a49f11308f7d217ab4
MD5 09210309ee1883b047f944b42e37d455
SHA1 56a3d8d04e0b0e637c8907ae42a7533ee68c7903
SHA512 5058a24d068220457dfc84d6cdb7bf547d04fa9a140d9bced74189e33dccec9fb06ed42dc1c94b595a5661b9fa7209c8d25de0a7d102c2d37ef7622060397717
TLSH
T1C0F059EB977D706710F945EB1E00BD5B6576A435064058E4CFAAC2AC90809B31F124AB
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d6f1aca17c2a6539605bea7ef1cb418d0cedac10af3e48dbf53c8e903f9f3440
MD5 3a5098a7925c559e7916cebdcee00942
SHA1 6652cb1805f67cdeb51651c63c009469c3e5686a
SHA512 537022f005e5cb4b110b3347f74a3c664417e677debfd9c17bba196f9530ce76f0ec6c9894bb36d10ca2e130967cd2dcc377a60152a7f0f3b30fd578615d674c
SSDEEP 384:z+R5ZCq3Z8QbCgjC6XKF/5Cc0/7xJlf2yGBME:R+LoXF/YDxr2B
TLSH
T15842C62EAD20297B9CDBD21AF9257B17E7F5103525D42E84E6FC8A3C14E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 eb526149ea03454853b545ce21a0ebfa97ac320faac641e55e39d367c86ca20a
MD5 97901213c06656d447e4d4951ecfd83b
SHA1 7794e1e30be77c7d9b8830cec667cfb6906d4962
SHA512 ce83966008d8a6330fbe93e4f457bbccf9195140b6a9da4c6944d9990355ca094153361af467dffc341212e3431cfef9812616521db9d531adc6c9ac4c338e89
SSDEEP 192:z+R5Z+q3ZHcQ9CuRbv72vAPRp299THsb+WNn5YNc0/iN12yGkw7RWoVyIsnAUge:z+R5Z+q3Z8Q9CuRjC6XuFw5Cc0/if2yf
TLSH
T1F942B42EAD20657B5CEAD21AF9257B57E7F5103525D42E84EAFC8A3C04E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b983158b1b1a15c2bd29825ebc8cb2041d46dc52116e3e06c7c58c284bfca5aa
MD5 b313571950b1e688c537b19d6102ff71
SHA1 9631d1c3462881e44e3307aa6118d4117a9017b3
SHA512 2e9a01ea770b1425d599406e45ee7206049be8865f4fbb53e415ef44187ef6e8f78bffce1f6e69ebba83a8f7cf49e101a654e9ead908e6ae6a81b623c988e3bd
SSDEEP 384:z+R5ZCq3Z8QbCgjCFXQF/5Cc0/isxJqf2yGlME:R+LoGF/Yqsxa2d
TLSH
T17442C62EAD10297B9CDBD21AF9657B57E7F5103525D42E84E6FC8A3C04E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3068cc2c36cdacd2673fd6995892683b0ac71f47399107f5ca1e3fda384bbd99
MD5 514c48f08d614c69c0e48b0305aba31c
SHA1 2a0996aab4a0cf75ac8bd1dfdc41a6a26132aab5
SHA512 09fd7cbd9baaffd8ea894ec41069fc674686c29a9d7d55696318ae7094e9044a76c6433c35ac9f9af2e243235afde8a0c1ce5e9e5d362d60578ac62de99e5841
SSDEEP 192:z+R5Z+q3ZHcQbCIbv72vAPRp299THsb+WNn5YNc0/iN12yGkw7RWoVyIsnAUge:z+R5Z+q3Z8QbCIjC6XuFw5Cc0/if2yGU
TLSH
T1FA42B52EAD20657B5CEBD21AF9257B57E7F5103525D42E84EAFC8A3C04E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e5eb62038354ab57c78cb3cefce52a91175417c457df62916b5f86e563302c28
MD5 2b2c108c9cd9038b7cbc0249d3048552
SHA1 7c50517cf050297c8a549c50ecf8f5251d5a862b
SHA512 1fa3d28ab0ab374215c4431611441c8b76a75ec868bb7f8523c4219bf42236f88dad3535c7969fc4dd646f96ddfb456efc258ba9ec71808addfc289b6686a019
SSDEEP 384:z+R5ZCq3ZVQbCgjCFXQF35Cc0/isxJqf2yGlME:R+GoGF3Yqsxa2d
TLSH
T19F42B62EAD10697B9CDBD21AF9257B57E7F5103525D42E84EAFC8A3C04E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 62426297152d17afa086d034dfc470f1ff5b363f6a69b6d55609b9bff238ce87
MD5 a9a1dca049dd610f2f6aebefb0a4ce39
SHA1 87780a0a7fc498a74f56223e1150aad9503d4f5e
SHA512 ee1b8532bb02ffd666005c865e73257f32988205f4709cfb09de1a7c19fdc5379095856b913084dd139353cd361fa7517d7aa86feba06786a280c77a9bad1a28
SSDEEP 384:z+R5ZCq3Z8QbCRjC6XuFP5Cc0/7xJlf2yGBME:R+L/RFPYDxr2B
TLSH
T16F42B62EAD10657B5CDBD21AF9257B17E7F5103525D42E84E6FC8A3C14E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 a2ab5e166c70d49115c02f92a11e450ec78c9eb2f66dc736da2227f74a3cebd1
MD5 354565e7afce9c0a879e79faeeaa04d2
SHA1 671e2953d69a80d543f03e40dec4dce54f7840cc
SHA512 8686f2666faaa861e12bd9ee598b264595628e9a9e18c3d20953060f36200edac063d7b10c8f31b9dc5731c490ca12fd5a24078f2ee398e129176dbe519be290
TLSH
T189B0122044000497CA6043F15091005073751C1C29870305AAEE4812C91B2CC3512209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a68fc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a68fc.TMP
Size 72B
SHA256 997e998a448973fe74a006803edf9477a1f70a0f86d666e471644b0f649b29df
MD5 205ce142d5c802d964f742b60d841007
SHA1 0858e8907707cb1db73dff78c42db82cb0e1bbc7
SHA512 840f55a8e4428460d6edd22a75e1749cdd22256ae3351316b42126bf6544e42e49b771fadd8adb71f539c88fc29973b8136647209e9589b87fd17afcdf43ab30
TLSH
T173A0022183481411CD014370B2E5428132F3883839D70A5B88B31466CD5D3C85653666
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4789b4203ce2a743c5f9b2d40baa78b0d47acddb073c306fbae9187483172fe9
MD5 dca4762bbeb259f24f4f2a27d18344a6
SHA1 93f316ebd42d291f37a623afc4df794fb3bf833e
SHA512 17c5042d599d93bd23bf3ebee45ffa755dca4ecc25aecd57cb879bfd770b4ebbc613e58d7a806170b73298ec3af38f32dd96b5cd7d2454203dba02756b27389a
SSDEEP 6144:NZvrvT2ZBFuht5m09H3o03m7Rkm1tYpBeh2BAos:zvH4Fuht5m0F3ot9oBGcAos
TLSH
T1453413272D387EBA99BCFB0E744F0B2F2FB11EE59474DA5251D0560123AF68C0658CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f959512ec73ec559e42f3e4798ffda8a8dc74bd56e2b5a6b1226d3612cd668b9
MD5 aa44bf0926ece1d49e69fe6dd1466b8d
SHA1 158ccbbfd81b0330603828481d069669da02ed4c
SHA512 650e544ceb89abeecc460c473582cb855e613c171bf09a4acaeddd71366c27093bc6d53594d26f084b2b483d93f6e0bbef6372a652b5985957e07624e3b6ad61
SSDEEP 6144:nwvrvT2ZBFuht5m09H3o03m7Rkm1tYpBeh2BAos:wvH4Fuht5m0F3ot9oBGcAos
TLSH
T12A3412372C387ABA98BCFB0E704E072F2FF11EE6D864DA5554D0560123AF68C1659CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 9f6a6505a08242d596fa6811714715936f485d4dd15c012c3bb042d20737e941
MD5 bedfb0d30d96d9aa3e6fdd59236d7fe2
SHA1 6d198977dfd31c62d07e8baad8f7f144648b488b
SHA512 f3e492848c5edf00d81756687c90ab681278f2007bb940ccd13a5aa3894346391daf82dfa1fae53541f006905ad1f68cb18819a37906a55567ddecb857fbcdbe
SSDEEP 6144:TwvrvT2ZBFuht5m09H3o03m7Rkm1tYpBeh2BAos:svH4Fuht5m0F3ot9oBGcAos
TLSH
T1553412372C387ABA98BCFB0E704E072F2FF11EE6D864DA5554D0560123AF68C1659CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 59c4ce70a6c595e69255d2926d7941ce20689f42029159f1028e1ea12b7e81c1
MD5 72e8705773ce7c1644f3a989d3b20ebf
SHA1 c5776b6b896cbef86fad37ea432ab0aa442c50f0
SHA512 1b39d525992dc761b871cdbed28a5521b7158bf667670f7fcf7817855ce8da788893b298e3ff09bf4b10a2f3eacd3855ee9ea37a119332202979b0e46ceacd0e
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Fm7Rkm1tYpBeh2BAom
TLSH
T110C3123B5E70E9775979AB4EB08E0B1F1EF14AA2C930DA42C8D85A0437F97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5e8136b1ef5f88c594fadf1e8a55e9bdeec6f0bad7d08b0d488d9e2b0a0902fd
MD5 2baaefbd5ae5669b93d2b2aa9002babd
SHA1 dbc30181bbbbe962e722ad6c2ee9838f90d5ca31
SHA512 970a2f45209fd36bc60a8b0ff6938269ccb0dc34319b8ff2d29a5d4ccf86df0f72e4920c209055e54e680e3f78bdab933291717f37e54320bae9b6423f336a3f
SSDEEP 6144:WZvrvT2ZBFuht5m09H3o03m7Rkm1tYpBeh2BAos:+vH4Fuht5m0F3ot9oBGcAos
TLSH
T1473412272D387EBA99BCFB0E744F0B2F2FB11EE59474DA5251D0560123AF68C0658CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2140_1640847990\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

bcdae36f-e8e2-4f60-bd8b-bb6bcadf3ad0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2140_1640847990\bcdae36f-e8e2-4f60-bd8b-bb6bcadf3ad0.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download