ef1ae7d2920d894223bbcb15651edf46389d7bb650744bd1cadef8fa50e9612a

Analysis

user interaction
yes
max time kernel
899s
max time network
895s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
juju v2 - da hood.bat
Size 889KB
Sample260810-pmp9latwas
SHA256 ef1ae7d2920d894223bbcb15651edf46389d7bb650744bd1cadef8fa50e9612a
MD5 725427a60069062380e482186aa63357
SHA1 0713caf1ee00d88122ea7abeda75376019f4e51c
SHA512 ccdd209eb5fd4b8ef06e79cd29a514ae62f2bfe8e50cd4a6fb34da171909529ab580126517733e1caa70eee25685faf17c6872b74584eb4aac4b5b5ace984b69
SSDEEP 6144:KcHMQ5EFVkvvSzHw1mFxLLTQdGZhcRBgngugFxL5WPiZovXjB2kcnDZUeLQHsVM9:wLTQdGDcLCgugFPWPSofCDvLQHsLvml
TLSH
T1C6151A78B28F59E74B633158A8BF0740BD3FE533312A2295B5F5412DB55CA8CC0C69BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1456	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308384448649709"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2540	4092	chrome.exe	91
PID 4092 wrote to memory of 1456	4092	chrome.exe	92
PID 4092 wrote to memory of 4964	4092	chrome.exe	93
PID 4092 wrote to memory of 4964	4092	chrome.exe	93
PID 4092 wrote to memory of 3908	4092	chrome.exe	95
PID 4092 wrote to memory of 3908	4092	chrome.exe	95
PID 4092 wrote to memory of 4332	4092	chrome.exe	96
PID 4092 wrote to memory of 5900	4092	chrome.exe	97
PID 4092 wrote to memory of 4332	4092	chrome.exe	96
PID 4092 wrote to memory of 5900	4092	chrome.exe	97
PID 4092 wrote to memory of 4436	4092	chrome.exe	98
PID 4092 wrote to memory of 4436	4092	chrome.exe	98
PID 4092 wrote to memory of 1680	4092	chrome.exe	99
PID 4092 wrote to memory of 1680	4092	chrome.exe	99
PID 4092 wrote to memory of 4208	4092	chrome.exe	100
PID 4092 wrote to memory of 4208	4092	chrome.exe	100
PID 4092 wrote to memory of 4904	4092	chrome.exe	101
PID 4092 wrote to memory of 4656	4092	chrome.exe	102
PID 4092 wrote to memory of 4656	4092	chrome.exe	102
PID 4092 wrote to memory of 1092	4092	chrome.exe	103
PID 4092 wrote to memory of 1092	4092	chrome.exe	103
PID 4092 wrote to memory of 4520	4092	chrome.exe	107
PID 4092 wrote to memory of 4520	4092	chrome.exe	107
PID 4092 wrote to memory of 2016	4092	chrome.exe	108
PID 4092 wrote to memory of 2016	4092	chrome.exe	108
PID 4092 wrote to memory of 3840	4092	chrome.exe	110
PID 4092 wrote to memory of 4304	4092	chrome.exe	109
PID 4092 wrote to memory of 3840	4092	chrome.exe	110
PID 4092 wrote to memory of 4304	4092	chrome.exe	109
PID 4092 wrote to memory of 3596	4092	chrome.exe	111
PID 4092 wrote to memory of 3596	4092	chrome.exe	111
PID 4092 wrote to memory of 1736	4092	chrome.exe	112
PID 4092 wrote to memory of 1736	4092	chrome.exe	112
PID 4092 wrote to memory of 3752	4092	chrome.exe	114
PID 4092 wrote to memory of 3752	4092	chrome.exe	114
PID 4092 wrote to memory of 5564	4092	chrome.exe	115
PID 4092 wrote to memory of 5564	4092	chrome.exe	115
PID 4092 wrote to memory of 5716	4092	chrome.exe	116
PID 4092 wrote to memory of 5716	4092	chrome.exe	116
PID 4092 wrote to memory of 2596	4092	chrome.exe	118
PID 4092 wrote to memory of 5680	4092	chrome.exe	117
PID 4092 wrote to memory of 2596	4092	chrome.exe	118
PID 4092 wrote to memory of 5680	4092	chrome.exe	117
PID 4092 wrote to memory of 1304	4092	chrome.exe	119
PID 4092 wrote to memory of 2776	4092	chrome.exe	120
PID 4092 wrote to memory of 5048	4092	chrome.exe	121
PID 4092 wrote to memory of 6100	4092	chrome.exe	122
PID 4092 wrote to memory of 6100	4092	chrome.exe	122
PID 4092 wrote to memory of 4224	4092	chrome.exe	123
PID 4092 wrote to memory of 4224	4092	chrome.exe	123
PID 4092 wrote to memory of 4520	4092	chrome.exe	124
PID 4092 wrote to memory of 4520	4092	chrome.exe	124
PID 4092 wrote to memory of 3740	4092	chrome.exe	125
PID 4092 wrote to memory of 3740	4092	chrome.exe	125
PID 4092 wrote to memory of 3596	4092	chrome.exe	126
PID 4092 wrote to memory of 3596	4092	chrome.exe	126
PID 4092 wrote to memory of 2460	4092	chrome.exe	127
PID 4092 wrote to memory of 2460	4092	chrome.exe	127
PID 4092 wrote to memory of 1812	4092	chrome.exe	128
PID 4092 wrote to memory of 1812	4092	chrome.exe	128
PID 4092 wrote to memory of 2016	4092	chrome.exe	129
PID 4092 wrote to memory of 2396	4092	chrome.exe	130
PID 4092 wrote to memory of 2396	4092	chrome.exe	130

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\juju v2 - da hood.bat"
1⤵
- Executes a command shell one-liner
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc14c7c728,0x7ffc14c7c734,0x7ffc14c7c740
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,138216291458422413,15138535569607228295,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,129239018241089650,96969177974847287,262144 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,12207460182396087923,2596158006671807434,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,7064199859095310270,11322368905533790653,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,15724420836172873524,16356936380504754711,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,459716577924743489,11691138394347481326,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,13008891901412078290,3210811185926168325,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5392,i,17076340265788142031,15439438419277700200,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,11532390012989544278,8953433603668070235,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3392,i,4990261879768482957,17047127731209682396,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3416,i,7356802169432979906,5260688111940259145,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5676,i,9644495400503913652,7087577983512588089,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3556,i,484003739139523994,11866591842979117643,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3264,i,13339209433275554767,9249066650161976972,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3464,i,6948447173875668464,4842610038744716861,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3928,i,7596166684972630130,7228879642365248938,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6060,i,14961765664972602623,4896848957243761283,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,16150646155134001881,16403757210565662877,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,7010086700769021192,429224248867391581,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,14779673028902518303,3122232388905536442,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6124,i,8822288833191296443,17807413846887563588,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5996,i,17353892795989983560,18173801111428977927,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:9
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,4409550891443644417,273748316025812842,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,6294927132773205823,15248276061802737337,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,9404950768890557302,2513920404604846484,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3508,i,11721892495433604944,16838231238035394544,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3524,i,8687151148562776340,3235525320002261824,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5680,i,11052624921709382414,6650556336484498431,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6168,i,7549110805109874070,960149321875031219,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5764,i,11373809303799154798,15703060183495515508,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6420,i,16347100795214713235,8602537130615463868,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6816,i,322159714881128382,9221662903014685462,2097152 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3424,i,8183941670841193033,3987909624242136043,262144 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:10
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,3846345102755192275,14840305992238793056,524288 --field-trial-handle=1932,i,930831115186971028,15311577112811396415,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:2396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5664

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 c4b1d4d89e2d16601d32f3841b9c66b8d0a643cd6a4a686ce664a58a833d4064
MD5 5a3445fd356f444bb07e31c24af1d1c6
SHA1 47fca156d68503309c5c981b5ec80f6f08d69a18
SHA512 ce1a52f496008482596caa701b612f8290a68d7175d50209cd3dd602c7612549a04b3b7c04cfdad3bb6996b1a0d01b22409d7dc1fba9bdbb94b69cff335a1a4b
TLSH
T1EFC09218A0443409CB9E82B10673498062606A1048D2A5A392D5198BD51B369A623701
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a6e730083d6bd4d8c2423f98feea96b0def4ffa6e782efd18bf6f244e2795d2d
MD5 82f867f216e3598ba9ccb2d79fb34aa2
SHA1 8abbd953227e5374f5eda9717d59a3a0c215ffad
SHA512 bae987b21d4265ec9c25d98de3b067a349a19cbb14112f00d61e447376ce71e4726e2848667edc02572822dce009506c8b3563567625af205168678c004ed991
TLSH
T15551940995D0A010CFA45B7708A3DC71493B29FF0E7E2B5F26C46E222D932FB6B1294D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 382d7aade141bef24be4b48370c219aed4ab32d9829db8eea4e05d63ebe71c60
MD5 c027cf2a064e31b53a3e869a52bd5325
SHA1 4ef6e5c4961f532b09b3e89cde95c3dce43244b4
SHA512 a41a64d91d852d78f4246a3c48f08aebf2c80f3b7c77239bbe6b4aba3bad6d9c14cdc71cffd6835e264a3953d7252a41c69f8fd6c40da5e9c5a0989dea3e2ca5
SSDEEP 192:Df8KxTACIPWITw9nysvKF++TICIOIp1NPg2aPihGHuASg9f+nHViwQtcjhnjDg:Df8KxTALeITw9nlvKF++TICIOIfNY2aF
TLSH
T1CD128BF7C3E8C63D890156F4AB156E1FCE590A24532C3867C9D8BE1B93E28B1E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 4a7c596a344cc441be1b5c29bb132ef6164a0d92658e1ab3a52a8ced31973df9
MD5 6f32d9333c6039b01bc3a35ed28d0873
SHA1 25cac5c07bcfc60ffeb0eff13b0030ed20618a03
SHA512 0dfb605b8702466684e1ffa1149f885a6e8db0216380efb7a8972c63886b5bbf01cb0dc44e894bd44467f66259c99f070309e55ee2f50f5ed09c05ab3a732aaa
SSDEEP 192:Df8KxT8ITw9nysvvMKF++TICIOIp1NPg2aPihuqNnHA:Df8KxT8ITw9nlvvMKF++TICIOIfNY2aZ
TLSH
T1D4E18CF7C3D8C53D890156F4AB156F2ECE190A28532C3867C8D8BE1B93E28B1E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e4651c8028aede76de52ec8ccccbd932e2692a2e4eea795d522bd7e7584bcc0a
MD5 78951ede5661afa3b480b5d2a278df2a
SHA1 19cd888b8b90a0cbc32cb542f9d870b9f9dfc367
SHA512 a84270e77983627c6170283128e3292c7f7de05dc741e6911767a02fca6f27bcee8203f594f5d12005933d818f405bb561cc4256fecabd3d59dbaa749d924d4e
SSDEEP 192:Df8KxTACIP+x9pITw9nysvKF++TICIOIp1NPg2aPihGHuASg9fAHViwQYjhnuRpC:Df8KxTALWx9pITw9nlvKF++TICIOIfNf
TLSH
T10B228BF7C3E8C63D891156F4AB156E1ECE190A24532C3867C9D8BE1B93E28B1E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ccff1cb1eac917269e20142f631615a69cd0ea5b5ac39f8889a9d7f2a3855055
MD5 1b7a23112e2972b203bcce7243843010
SHA1 14bc9994bbeeacca2aa44dfe237970a11131ad9a
SHA512 4f1f54f3a82e54ba628f656bfb76f7a482df7ad59b53c97a41f3809cd43698b6e9e1bef6adb1b462b9e34d14302d36e783839e6f27297b085cd4a3d82076bd39
SSDEEP 192:DAumWtqWIV+EspITw9nystKFk+TICIOIp1NPi2aPihGHuASg9fXHxuNQYjhnaRpb:DAumWtqnQEspITw9nltKFk+TICIOIfNe
TLSH
T125129DF783E5C63D890156F4EB15AE1FCE590624032C3876C9D4BE1B93E28B2E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 bc5736e9871961da7d5ebd2c1d3873c2479f0283a9233caa4284a8f68816d864
MD5 5698205f32abf52f4f60e87c7b3d72ba
SHA1 bb9664c8f644229e17fd3cd10462a22315ff93bd
SHA512 38c0e981146a572bec427d88c2aed58fcaed8d122b7e2c76248d9fe361be6e5bd96f4023e7c579b0796bc704054aa1e5e762114537e578e3ef56fb769448adc6
SSDEEP 192:Df8KxTACIP+xFITw9nysvKF++TICIOIp1NPg2aPihGHuASg9f+nHViwQtcjhnuR/:Df8KxTALWxFITw9nlvKF++TICIOIfNYF
TLSH
T128228BF7C3E8C63D891156F4AB156E1ECE190A24532C3867C9D8BE1B93E28B1E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 bfe79f29d4112b9b7055909127affb2c886cf9c464320245d48c8a548891cd49
MD5 fa9a6404ed42a623d2f9fde9c1bff048
SHA1 eefbf59b19b1060f8c7da6bfc186b9df5cc2d3e2
SHA512 adc5145e3071da0510868329aa1a4e34509e0ed7f396ff0502e2b08f9163c04cde5730074eb664898b1daeaadcc2d38c6d204d618df6fa3df694ba32123c8234
TLSH
T15A4148A7D67FB46B1068597E2E44BC1A9DB7A83505517CF4DFAB806CB1C2AF30713062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c1bb468d71f99f81e26b7a8c1dd785b1a84313616d7094e44e73c6e9d9f1983a
MD5 1dc6fb4728cb32a54a687519e8c49981
SHA1 ae4fb1a7c7821bc0cb785159622b6b8bb2c05132
SHA512 8fbe7c3c479782b023ae47aae596bb8d505b88f1c064faed4db5479e83cbe5fffabe6b2a6edb1b2467fe6850a77323e7b2f4e41c7cd55181ec1a3bac329de51d
SSDEEP 192:N2Rgrb41+Opfv7sAPRp2Ehi964Hsb+WNnro4hrNU2NOxX0j7HwDcVyIsnAUgR:cRgPcNBX6bwcOpU2NOXk7H64R
TLSH
T10E42B73EB9652A7B5DCBC219F9217B57E7F9102225A42EC4E7FC592C10E3ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d8f2ad1671de9c6beaf8d2186a135533cb305bc227cc7f38d908b9c1544f5428
MD5 d68bdcaa2eef91688a2c1410a175a125
SHA1 7303b1aa88eb48c40b724f86fbc5a7f5b9ffc90d
SHA512 dc647ff0cc7c3ccb8dc4af818ae6de13cf7a3ddb364ec206be30b7cdd67f6388acf5f77320fd7178e6b89ab4fe591fe9b99645bdc93b9ff6e1663c67bcc5ef7c
SSDEEP 192:N2RIcBzrb41+Opfv7sAPRp2EGV964Hsb+WNnro4DgEexX0j7HwCcVyIsnAUgE:cRImzPcNBXobwc7EeXk7Hv4E
TLSH
T1A042C83EB9552AB76CCBD219F9217B57E7F9102224942EC4E6FC992C10E7ACC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7bd271ae93571fd02e10a614f4e18003c586b9a908789510b5dc1f4783782ee0
MD5 076560e1fc9c269409feedcaba18bffe
SHA1 da7f3326bce2606d5bee8a45b063eaa049147570
SHA512 380675438af4797d9b2744f351214ba243146fe23c594ee507c26fee057fa9628faa0553222746547cc480f6d8d9309d815b8dea3e661e999f26c9734bf6ba09
SSDEEP 192:5RIcBzrb4T+Opfv7s9PRpnEGQE964Hsb+WNkwWFBDgE9xX0j7HwucVyIsnAUgE:5RImzPuNSX9bw6GEHXk7H94E
TLSH
T1CE52B62EB9152AB75CDBD219F9217B57E7F9102224902EC4F7FC992C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2fb2c3d4a27c516106388d62a57f0f1986386dd47fa585fdc45b1d7e657e31eb
MD5 d14d014dfb645ace5eb1d8d74d4a7569
SHA1 fc0a94973502ba3b66ea2394f62e0a4d76a8a5ed
SHA512 a12f6dcef13ce0c7c13170faa93f5fd1bd801930391cbdb78aef3b095f302d05cc99d34cdf18be1314d7c2a675e383434c50cfc7b427f1da4520e0d7a906ad98
SSDEEP 192:lRIcBzrb4/+Opfv7s9PRpnEgQE964Hsb+WNkwVS4DgEmxX0j7HwucVyIsnAUgE:lRImzPSNSXTbwy7EmXk7H94E
TLSH
T15552B62EB9252AB75CDBD219F9217F57E7F9102224902EC4F6FC992C14E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bd98dfc6fd2f6f2ab41a5f3e7a5370566bfa08ca83653a2379fe1372718b387c
MD5 bdb5a0cc6312447813da6e2090cfef83
SHA1 a02c660f9719a4c687a5f0a8e41acf28478eacca
SHA512 f346334408cc3c19e81aeff2938dcd74b9a85fad29fc59360cede1dc168bb64e2a54b4fe07719f4364a5383b169dc31eebeec2fc3eef0abad248b47e2657ef56
SSDEEP 192:lRIcBzrbx/+Gfv7s9PRpnEgQE964Hsb+WNkfBVS4DgEmxX0j7HwucVyIsnAUgE:lRImzPFvSXTbwL7EmXk7H94E
TLSH
T1E952A62EA9652AB79CDBD219F9217F57E7F9102224902EC4F6FC992C14E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 746d49e90bae9a72022910224ebf18a70d07c7e22320e757ac938dfa222f0ce2
MD5 0d5761e936b989f20e9105b724d69d2d
SHA1 3a674831cc2e7655e7589b844963612e980c1a87
SHA512 422a75e17ad7693da5b17d2adb54b6fb2a2238fc22dee57a78f101845e812a7d91892cb9203975c1b49b1b92a83fd28891f094cc8baf0e1cea8099ed67080307
TLSH
T1F1A0021612542061C028027125E94185322A8D5015E2171B809EC148DD501504531C44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0f8164530f718402abac8ca3202c6119e9c3c22cc643578e9af6e83d63a0e064
MD5 c579c8c23d3e4a9241ecb3fc9df4731f
SHA1 6f0bfa2927124f6ad4816d2b51ffc341ac6684f5
SHA512 e66dc2c68b91e4b10c7b541131f233a3e507d19cf40df5e439d92b661993e196adea597bdad3d7d49a97b7b60e0b5dbf54652be7735d839af3dac4870c29d7de
TLSH
T1CBA0021085C01851DD0C427062761E4533518D162D658343E8E20845D85BBD04201900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a45f3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a45f3.TMP
Size 48B
SHA256 b7fd8ff00ce8c90ff49cbb6044aa751226e737e17701ef13f35250952ff91f54
MD5 93c5a450b961c0a327b488202e4e19e5
SHA1 76c8c94a22cc82884fa4c6b2a5af6c17afb2af59
SHA512 6d0d353a8f6355a431176edde4db801c4ca6bf59c0281e9f3e7438f93ed14c56d53dcbc4db0b0db8b3278099ecb828c3d80fc4fc45420dbb8efcf3f7f4947efe
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 959cd257afcc043069167c21cf958bc4ae93c27533354d037d43792c4394d412
MD5 45dda72499c571d6b4a1319ed6f00937
SHA1 fd6fe21c7d73bc89790c26629b436cad4f5c9b08
SHA512 611c79a435de3471e4576149a38556d36dd5fd7b5f67b18f76a4fb232f9b0528846b90942fd43ac3ee33e99520e21f2bf0cf305ad3dbb53bdb77ca63594d048f
SSDEEP 3072:4ap89KuB2qjtiCfvUUf0vxlaVW6KPHnUno6PnZUsn01WF:L8QGnRUUf0ZwVW6OHCFPn6s01WF
TLSH
T14CC312F60EB26C625A95F17431CEC1EBEE5D42A3C68534C901D85BC4CBCD8E66386B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ddb35de06b40a7b03821622b9ce66225b278ed51796f2d97448a2badc154ac37
MD5 cb4526e0ecda9929dcc0b85f435f00eb
SHA1 4deb16cf78522709de4a6a81339784d40ccbf86d
SHA512 59a83ad60d334a1c9b6bc043d311b55f9e7792f48a7f0c79a6b91228659b8e6c06c994e74d5ffd936b1c61baf73bebd8b16dfb703cb9ff9e63f0eb2ac495c674
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok55CD1B6/dGyv95S7hbb2Jv4a:gC0LA/TE57cDUDmLUweS7hbKl
TLSH
T1CDA10871B4A95AF75D79C584F9827E83CF78A117A9226F84D8DC1F0C10E74E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 f4ad2d3eb7a70978600bbdd3904a6b1c605ad73db3f75b823db654cf754e0ab4
MD5 d97b49083f8a8c293cae577880e695c8
SHA1 6a370e0f6149fa44db3e1516f56ff080d84bd0bf
SHA512 12c74daa760e8e7936bc4c02fff6619b394b693d436a5022acff5615f53f98fa6c10f3266ce1fb352f9cd0e96597fe4c09e71bfd45bc7879d59a8d5fcf140994
SSDEEP 3072:6ap89KuB2qjtiCfvUUf0vxlaVW6KPHnUno6PnZUsn01WF:R8QGnRUUf0ZwVW6OHCFPn6s01WF
TLSH
T17DC312F60EB26CA25A95F17471CEC1EBEE5D42A3C78538C901D85FC4CB8D4E66386B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 19e58a4592f225c6f0229a49dafb92d22e508aa699370d155c16d784bbb8e337
MD5 3223653b50b396b792b8afd13d54bfdd
SHA1 610d9b8f30251183befea798bdfe978885846201
SHA512 e7e02069aa7a2215ac7dc6581bb4926b7a2f45a0554054d94ee2c625884665f619bf7fb777fedaee36322a9f91236b1c9d7da09747fa8969a9a25d0a6b776e20
SSDEEP 3072:Dap89KuB2qjtiCfvUUf0vxlaVW6KPHnUno6PnZUsn01WF:S8QGnRUUf0ZwVW6OHCFPn6s01WF
TLSH
T1E3C312F60EB26CA25A95F17471CEC1EBEE5D42A3C78538C901D81FC4CB8D4E66386B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8ce975c252c6f4233176269c16280071b0d456d55da9cce3e9ee9133158c7b12
MD5 67549d2ffc7f28b67b6f4d110e4350dd
SHA1 47b16a2f7c23bba37971591db273dadc0dbf507b
SHA512 450917a69fba645c7e5a96cd11a2b3770d8c47f04eac5ecb2280708f9369f2aebc2079e778c8ca270ca6d124f894761401d7215d3f2e4e21ea78b95157e0592f
SSDEEP 96:OC0d+cAOIt5aDVmufj7HcZSl8h4otop55pD1B6FGyv9JtFiO0AuSw5SD7h0j9IK3:OC0LA/TE57kiU2TLN+tFGSw5SD7hUZvP
TLSH
T19EC13B74B8AE2AB35DFA9550F6837987CDF8A057A9116F9489ED0F0C01D74EC2343A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 ca4725bef9d614f581e959273492136a410ec978c8f002729d9b260e8dee1a52
MD5 20aa0b357dbb088e13d475dc571aa184
SHA1 cdd09ec16ac5d5e0f4dba50400146e5b815a39d5
SHA512 5df65c6ee2a8e68b13cbcd3805e63eec292323cc50d59c9e00be16cce5c2382c5e15e03343af2610979ec858016dd8c7784fe3a816d46f8fd41e0671e0475645
SSDEEP 3072:/ap89KuB2qjtiCfvUUf0vxlaVW6KPHnUno6PnZUsn01WF:W8QGnRUUf0ZwVW6OHCFPn6s01WF
TLSH
T169C312F60EB26CA25A95F17471CEC1EBEE5D42A3C78538C901D81FC48A8D4E66386B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4092_544909050\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4092_544909050\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download