1c7e1302a8c1546081c1a8d86691094b082047bfddad119630607e4d7e58d50d

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.exe
Size 1.9MB
Sample260811-1892nsshpe
SHA256 1c7e1302a8c1546081c1a8d86691094b082047bfddad119630607e4d7e58d50d
MD5 aa5760906139510c93486509667dd5a6
SHA1 5a1bd2be70201410056de99fb7430c4e2a5de2ca
SHA512 785c6cf4661cb019a52a23279033688a1ab8411799fb790d9f697e4ff2a6e292de66e6c179f8c9f273e12b29947dc094a73290ef5ee4fb7de5ab873108d2934f
SSDEEP 49152:mPKGL0zWo01Nrxatjw3aKZIN1eyaS3gF0LGV6:LWTFcFw3Vm1pa3CLGw
TLSH
T1DB951253F25298A4E061EA384E1096079DB6705407B0BA7F37E70A746F7A2E10FFDB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309604403884257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
4552	chrome.exe
4552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe
Token: SeShutdownPrivilege	1268	chrome.exe
Token: SeCreatePagefilePrivilege	1268	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1268	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1268	4136	payload.exe	89
PID 4136 wrote to memory of 1268	4136	payload.exe	89
PID 1268 wrote to memory of 5916	1268	chrome.exe	90
PID 1268 wrote to memory of 584	1268	chrome.exe	94
PID 1268 wrote to memory of 584	1268	chrome.exe	94
PID 1268 wrote to memory of 4652	1268	chrome.exe	95
PID 1268 wrote to memory of 4856	1268	chrome.exe	96
PID 1268 wrote to memory of 5000	1268	chrome.exe	97
PID 1268 wrote to memory of 4200	1268	chrome.exe	98
PID 1268 wrote to memory of 4660	1268	chrome.exe	99
PID 1268 wrote to memory of 5056	1268	chrome.exe	100
PID 1268 wrote to memory of 4856	1268	chrome.exe	96
PID 1268 wrote to memory of 5000	1268	chrome.exe	97
PID 1268 wrote to memory of 4200	1268	chrome.exe	98
PID 1268 wrote to memory of 3264	1268	chrome.exe	101
PID 1268 wrote to memory of 4660	1268	chrome.exe	99
PID 1268 wrote to memory of 5056	1268	chrome.exe	100
PID 1268 wrote to memory of 3264	1268	chrome.exe	101
PID 1268 wrote to memory of 3932	1268	chrome.exe	102
PID 1268 wrote to memory of 3932	1268	chrome.exe	102
PID 1268 wrote to memory of 2484	1268	chrome.exe	103
PID 1268 wrote to memory of 2484	1268	chrome.exe	103
PID 1268 wrote to memory of 4760	1268	chrome.exe	104
PID 1268 wrote to memory of 4760	1268	chrome.exe	104
PID 1268 wrote to memory of 3652	1268	chrome.exe	105
PID 1268 wrote to memory of 1908	1268	chrome.exe	107
PID 1268 wrote to memory of 3060	1268	chrome.exe	106
PID 1268 wrote to memory of 1908	1268	chrome.exe	107
PID 1268 wrote to memory of 3060	1268	chrome.exe	106
PID 1268 wrote to memory of 4092	1268	chrome.exe	108
PID 1268 wrote to memory of 4092	1268	chrome.exe	108
PID 1268 wrote to memory of 4556	1268	chrome.exe	111
PID 1268 wrote to memory of 1472	1268	chrome.exe	112
PID 1268 wrote to memory of 4556	1268	chrome.exe	111
PID 1268 wrote to memory of 3168	1268	chrome.exe	113
PID 1268 wrote to memory of 1472	1268	chrome.exe	112
PID 1268 wrote to memory of 3168	1268	chrome.exe	113
PID 1268 wrote to memory of 5876	1268	chrome.exe	114
PID 1268 wrote to memory of 1524	1268	chrome.exe	115
PID 1268 wrote to memory of 5876	1268	chrome.exe	114
PID 1268 wrote to memory of 1524	1268	chrome.exe	115
PID 1268 wrote to memory of 1116	1268	chrome.exe	116
PID 1268 wrote to memory of 1116	1268	chrome.exe	116
PID 1268 wrote to memory of 5372	1268	chrome.exe	117
PID 1268 wrote to memory of 5372	1268	chrome.exe	117
PID 1268 wrote to memory of 5356	1268	chrome.exe	118
PID 1268 wrote to memory of 5356	1268	chrome.exe	118
PID 1268 wrote to memory of 4312	1268	chrome.exe	119
PID 1268 wrote to memory of 4312	1268	chrome.exe	119
PID 1268 wrote to memory of 5996	1268	chrome.exe	120
PID 1268 wrote to memory of 5996	1268	chrome.exe	120
PID 1268 wrote to memory of 2420	1268	chrome.exe	121
PID 1268 wrote to memory of 2420	1268	chrome.exe	121
PID 1268 wrote to memory of 4908	1268	chrome.exe	122
PID 1268 wrote to memory of 4908	1268	chrome.exe	122
PID 1268 wrote to memory of 5744	1268	chrome.exe	123
PID 1268 wrote to memory of 5708	1268	chrome.exe	124
PID 1268 wrote to memory of 5744	1268	chrome.exe	123
PID 1268 wrote to memory of 5708	1268	chrome.exe	124
PID 1268 wrote to memory of 1100	1268	chrome.exe	126
PID 1268 wrote to memory of 5124	1268	chrome.exe	127
PID 1268 wrote to memory of 4304	1268	chrome.exe	128
PID 1268 wrote to memory of 4552	1268	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1b8,0x1bc,0x1c0,0x190,0x1c4,0x7ff83193c728,0x7ff83193c734,0x7ff83193c740
    3⤵
    PID:5916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    PID:584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:9
    3⤵
    PID:5056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:9
    3⤵
    PID:3264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
    3⤵
    PID:3932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:9
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
    3⤵
    PID:5996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,13250184813837548920,1360808444188749176,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

542f18ae-5627-4fea-a09c-57bd781dc06f.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\542f18ae-5627-4fea-a09c-57bd781dc06f.tmp
Size 8KB
SHA256 8e528adb4a77253586b7d4a73d904fd6541e5f3d41938b1b5dd67cd540107ab6
MD5 35bc83cec2dc6981368aeb4a7169a82d
SHA1 6a03bfed5b6e2b424a6c63166d2b6a06fae72172
SHA512 3c3f95bf100c33192bc128734786f1786bdf0394e46647ed3e86aac280b7dc44acc2f26848260e6cf7a39db179045a544d4e28b24651a78162069c5776f32175
SSDEEP 192:zR2/3XdxyXcZJv7FAPRp2yXsb+WN4cpppLQiyIsnAUgE:zROeMXMXtXw4iE
TLSH
T13702C61DAC14A57BACD6E31AFA657B42E2F5102174943D44DBFCC92C28EB6CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 56591e240dedafca55ddf178fd574d5205e10216391ec56a6846cb4ee023c434
MD5 14e3fb9d9af8e7f0996a5c8c366b379a
SHA1 e8d7bff85da07ac129cf1d3bbe8519a7353bf443
SHA512 696cb0aefe02a1649d2f58a7b3ef6cbf95dca95c3dfe89ff8e7d7b65601aee1ade9deeadeedafbcef31ad042e626390c3abceac493da9e61e29c15ab19877e69
TLSH
T1EFA0021052D00411DA9D537B35661782263169350113535391D008C5C8722E56105151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a6c5.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Code Cache\js\index-dir\the-real-index~RFe59a6c5.TMP
Size 48B
SHA256 f22cb601b6a56ddf9ecc2f0bd7acf6893a2266415ac5a679eb68460cbad81987
MD5 cdb038b56c2e8d260196b2545f2da678
SHA1 341d93c0690351e4a5e145ac6ed067f90f8a3480
SHA512 2683dae2f821cb821fbb79f8624c43125fae45218df26712cdee2632f335e06c54c73067f3459b3d13ed1e797d4b4606934d60ef8168057b44f9b9d8719c45f5
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Network\Network Persistent State
Size 1KB
SHA256 d87c23f382ae69f8ec62eb04892135429b9c4e01df962e75af974c5ae81a8a2e
MD5 849221b54ff52a5ee68182137ec60e69
SHA1 ac813a4a1cae89828e57812de17d9d7541590bf9
SHA512 0ae9dffe60c0e026876803bf129f0cc800372f559509d9897eaf418f9e87a91f5d7a0f5645048c67489ab4edc4a39085d3961fb7fcf594d6fd9e84f8f42d1276
TLSH
T1023190F7C3E8867D895185F4A7156F1BCE2E0A14432D3C56C8E8AF1F93E2971E10095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Preferences
Size 9KB
SHA256 94b5fa522b437237a056524df86bae6582d4120e62c42a83782b9ceeb0f8bf08
MD5 8671ddac1eaefc09cef493c1b642123b
SHA1 601377f595938b241469bb218a68315a3fa596bf
SHA512 1736ebc9faf3f536fc7c93e85b9617da06568d83ea814eaf1f2a52a4703594fa859ab8a657020fae9201e655f7888ecb6d0320f07227c207f1f702813e122ee6
SSDEEP 192:zR2/3XdxyXcZJv7FiPRpbyXsb+WN4c6pvLQiyIsnAUgE:zROeMX6X2Xw4nE
TLSH
T19D12E81DAC14A97BACD6E31AFA657B52D2F4103135943D44EBFCC52C28EB6CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ac37eafce8a7bc455e874ddabd551aaa011a2f87dee607564128c7b4ee120a80
MD5 c036b88f48e62ad8a40099e2bba7fa35
SHA1 0a5a8ad3ac6140e9bc9f0ef61a0300f879dc4803
SHA512 aa92f55d9b75e50bc6a4411b6eecefd14f5c2fb84dd3642ceaf12542c8ff187457b7e349a98cece4b19d67e5cfbfca8ed941f5cd97cb611af8201ea054b50c07
TLSH
T147B01245C0471711DC4185F03145A454A2509E31A111470383E05A99CC470D0625A188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c20e.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c20e.TMP
Size 72B
SHA256 c2028b0986212e4b9acd048b7e68777c2635ac9e7b8ce2096e3d14c813ba2bd5
MD5 9d623f400800decf706faae2f3d095aa
SHA1 cab1ef3c53be864a62705299b73c778bb1d2d144
SHA512 8a3acf8a96cf6a762fb94ca4a10d9dcf00d6e8afe697ebb46393546b33b85c5f9eeb6b75cf4513cfc3ef6b75577c8ed71138c595405645aaaff118dc7f5133ca
TLSH
T119A0021542448216C10443F02C82878D3221BE2AD706021377D84366CC702614F12584
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 da0e5933e9598801264b647099c6de8f4a6af8f8e2bb5c2505d88f684b80e642
MD5 88bc5658dcb3f2dcc0ed0be754320be5
SHA1 78823003755d185db57fab9571f00bee773daade
SHA512 2d4cc08321275327cea1f99abc9c214de8d2dc595696399ba4dfed9461402a13bc1bf37dbb29ae9f5ef5f642ce2d3ca3c3661872f36045df21889630ddcfef4d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3ae31b04ee75a75bf62384a1ab015c2780d0414976eac573da6e97588bcc554d
MD5 db46af6e4e6b52da39a333f4fd9cf6a5
SHA1 56d1661fe8f65c64613dad1a7e74f566e3bd11a7
SHA512 654ee8d056ae03afb3838757dca9ad21756dd3ab3ec21927375f883b44f2c833c015fd9c94831061122a6e9b489f59a0d3839d7c07cbff195346fd0902ff375c
TLSH
T1E5A00218D1E11911CE314670A0F2974572A1CD1516615703589549D8ADEF7D55511100
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c44dbb96-4ba9-4d7e-8a11-0a1b7070d659.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Default\c44dbb96-4ba9-4d7e-8a11-0a1b7070d659.tmp
Size 17KB
SHA256 27a7dee5f152739fb8e005051b792a12a8451bdfd8136cc42937b09228ada330
MD5 4502321dc2d9f1cfa3216310bba213a4
SHA1 eb536a9b40178227dc05fa6f63ff1a9c98f2a954
SHA512 ed58c58de7c2d5db8f62da7462d52e38257fc05db7ab073dbc16482ecdce1b585824d8f1776433095c8ff0bf0ff98d55e05337bf72d51568151d0031375e2663
SSDEEP 384:iUjYf7KxkXqKf/pUZNCgVLH2HfgslmP7pLuLci3qrXODYD+ErU3HKHGL/+M49Zg:i4Yf7KxkXqKf/pUZNCgVLH2HfgsYP7pi
TLSH
T1F27209676C4C9E370F94C6CCD8277B4FADB5024B65E9C96442FA982903D5ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Local State
Size 123KB
SHA256 734add1c11636f6dd8e6a86c58662a0ea02a067057341934ef7941359023c283
MD5 deb068ebb924b3849f3b5160ae05e271
SHA1 729e2e05c4a47e7e391c689ef7df1ec83a4562f8
SHA512 2a9c71bfcca6765984afc3b666fc82797f53eda7d88837479c0370cdc045e6e9bf101d4695fc0f91ae1bee95b6eb4ed82bd0df124033eb20ba3ae9ac7013d68f
SSDEEP 3072:7oLqi2/AFNBqxqg22pTXGaixDN5GmfW9MBeJ/eSQu1Zn2:7wNmqgFXHid39fWeG/eDuW
TLSH
T17AC312B1EE055FF2428AC29562BA7B347EA09005665CEF33C8AFEE0D16B3E059771075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Local State
Size 123KB
SHA256 c61eef6eab9f15d1f26ac493ea05a9fee685f59730a133b230ef58aa1113ad0d
MD5 3a88d53320ad7ba42e5859ca7e059c13
SHA1 7df1f28f4b27dfd10e7bc38adcafeaeded66a488
SHA512 e0281398cde078049dbbdb1c1a52358b852be95e6045f9deabb12c93c540dcaab42713611d2fc3b65e41f1e2fe73b219173e154ab5a9415995bb451dee65129a
SSDEEP 3072:2oLqi2/AFNBqxqg22pTXGaixDN5GmfW9MBeJ/eSQu1Zn2:2wNmqgFXHid39fWeG/eDuW
TLSH
T170C312B1EE055FF2428AC29562BA7B347EA09005665CEF33C8BBEE0D16A3E059771075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Local State
Size 125KB
SHA256 de08ba40e05a5ca6c0f3756450c10ceac14c3fa98aa5c4100cc1684221c9b165
MD5 86443ab5e81b63700e6d0e246d8339e4
SHA1 2ae12b912f0c1631c2f61a8ab95d589c5136222b
SHA512 68c2766c50e67cb098934561e07a692eef23fb17204881c0a80d5e4742404c184638e9d3851e31d04247df4782bc2a8d2434f239832b051a048abd0f430e5072
SSDEEP 3072:24BLqi2/AFNBqxqg22pTXGaixDN5GmfW9MBeJ/eSQu1Zn2:24ZNmqgFXHid39fWeG/eDuW
TLSH
T190C312B2EE055EE2038AD19521BA7F356D90900B5B1CFF33CCABFE0A1563E099762475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Local State
Size 125KB
SHA256 6e48cc6f668c3b24af358d685a2cdeb37a7ec3f64be997562100a35d0db06583
MD5 94667b1a84474a1cf4bb71b539f99184
SHA1 e495f72670489777facc299ba23939c9db18d840
SHA512 edcf0ac2ed28208a9fa6074d9e256b21d0d724d977f6679f731fc37ea2a0779dde81c39937e1b9f81f89d5694cd1f90c6a002774c75c17d94a47332c45f8c8a1
SSDEEP 3072:2I3Lqi2/AFNBqxqg22pTXGaixDN5GmfW9MBeJ/eSQu1Zn2:2I7NmqgFXHid39fWeG/eDuW
TLSH
T10FC312B2EE055EE2028AD19522BA7F346D90900B5B1CFF37CCABFE091563E099771476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597b12.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1268240734828\Local State~RFe597b12.TMP
Size 1KB
SHA256 a7b8b7b02229c7af21ae2887afda15fa4ec4fbc4ab09b309545fff4e8d64191f
MD5 2f000993df359dd99b967953200f650d
SHA1 b448c0f9c1d00e99601fdac8b69428c96e21f190
SHA512 141edcadd022c8f35e4a9ce9a22514944ad53483d444781003f6cd90978844b16f883c6a89900b2afb81d2a783b3cf697972a4400b7da388d30b56c195d9f2f3
TLSH
T13C1175B1342929317AF9C65DE15157DB5E74E2368052AF1C2ECE0934113B2AE2B17C31
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1268_173004655\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download