559cb6dac57da660ae3a0f1575cca446eceb8d3dc5978ab960ce9f603c8d1e16

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
166s
max time network
167s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 66.8MB
Sample260812-3d4brawgrc
SHA256 559cb6dac57da660ae3a0f1575cca446eceb8d3dc5978ab960ce9f603c8d1e16
MD5 fea63b5fa86933145762879e020c048a
SHA1 895c8df29942f94a424693a4e7baa09271228e6d
SHA512 c7a97327235330157cab2091d9c99e15eda656babd44eb9bcd82774debc8146ba0d2fccd28816bb62cfef7bdf774fc884d3b8cab3772523d0dab888ddcaf9e71
SSDEEP 1572864:nf557tMY5PoYdG1SrG3J+lu8ghG0W0RHsNgL2oKcnJKfBmfS:TtpndASa3S3YG70iNS6B
TLSH
T1A0E7231493E404A5E97BDB34C666D333CAB0BC529635C10F0999F2421F73EA29B6F726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5592	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5732	taskkill.exe
2844	taskkill.exe
6116	taskkill.exe
3776	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310508726849612"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{95E9260A-C41A-4F73-801B-C8C308485619}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2972	Launcher.exe
2972	Launcher.exe
2692	chrome.exe
2692	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	Launcher.exe
Token: SeDebugPrivilege	5732	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 5732	2972	Launcher.exe	91
PID 2972 wrote to memory of 2844	2972	Launcher.exe	93
PID 2972 wrote to memory of 6116	2972	Launcher.exe	95
PID 2972 wrote to memory of 3776	2972	Launcher.exe	97
PID 2692 wrote to memory of 3924	2692	chrome.exe	105
PID 2692 wrote to memory of 5592	2692	chrome.exe	106
PID 2692 wrote to memory of 5596	2692	chrome.exe	107
PID 2692 wrote to memory of 5596	2692	chrome.exe	107
PID 2692 wrote to memory of 3764	2692	chrome.exe	109
PID 2692 wrote to memory of 3764	2692	chrome.exe	109
PID 2692 wrote to memory of 3704	2692	chrome.exe	110
PID 2692 wrote to memory of 2508	2692	chrome.exe	111
PID 2692 wrote to memory of 3704	2692	chrome.exe	110
PID 2692 wrote to memory of 2508	2692	chrome.exe	111
PID 2692 wrote to memory of 4476	2692	chrome.exe	112
PID 2692 wrote to memory of 4476	2692	chrome.exe	112
PID 2692 wrote to memory of 240	2692	chrome.exe	113
PID 2692 wrote to memory of 240	2692	chrome.exe	113
PID 2692 wrote to memory of 5372	2692	chrome.exe	114
PID 2692 wrote to memory of 4936	2692	chrome.exe	116
PID 2692 wrote to memory of 2004	2692	chrome.exe	117
PID 2692 wrote to memory of 4936	2692	chrome.exe	116
PID 2692 wrote to memory of 2004	2692	chrome.exe	117
PID 2692 wrote to memory of 3136	2692	chrome.exe	118
PID 2692 wrote to memory of 3136	2692	chrome.exe	118
PID 2692 wrote to memory of 3612	2692	chrome.exe	119
PID 2692 wrote to memory of 3612	2692	chrome.exe	119
PID 2692 wrote to memory of 1344	2692	chrome.exe	120
PID 2692 wrote to memory of 1344	2692	chrome.exe	120
PID 2692 wrote to memory of 5588	2692	chrome.exe	121
PID 2692 wrote to memory of 5588	2692	chrome.exe	121
PID 2692 wrote to memory of 1588	2692	chrome.exe	122
PID 2692 wrote to memory of 1588	2692	chrome.exe	122
PID 2692 wrote to memory of 4184	2692	chrome.exe	123
PID 2692 wrote to memory of 4184	2692	chrome.exe	123
PID 2692 wrote to memory of 1388	2692	chrome.exe	125
PID 2692 wrote to memory of 1388	2692	chrome.exe	125
PID 2692 wrote to memory of 4272	2692	chrome.exe	127
PID 2692 wrote to memory of 4272	2692	chrome.exe	127
PID 2692 wrote to memory of 5380	2692	chrome.exe	128
PID 2692 wrote to memory of 5380	2692	chrome.exe	128
PID 2692 wrote to memory of 4372	2692	chrome.exe	129
PID 2692 wrote to memory of 4860	2692	chrome.exe	130
PID 2692 wrote to memory of 4372	2692	chrome.exe	129
PID 2692 wrote to memory of 4860	2692	chrome.exe	130
PID 2692 wrote to memory of 920	2692	chrome.exe	131
PID 2692 wrote to memory of 920	2692	chrome.exe	131
PID 2692 wrote to memory of 2856	2692	chrome.exe	132
PID 2692 wrote to memory of 2856	2692	chrome.exe	132
PID 2692 wrote to memory of 4504	2692	chrome.exe	133
PID 2692 wrote to memory of 4504	2692	chrome.exe	133
PID 2692 wrote to memory of 5476	2692	chrome.exe	134
PID 2692 wrote to memory of 5876	2692	chrome.exe	135
PID 2692 wrote to memory of 5876	2692	chrome.exe	135
PID 2692 wrote to memory of 5064	2692	chrome.exe	136
PID 2692 wrote to memory of 2336	2692	chrome.exe	137
PID 2692 wrote to memory of 3396	2692	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /T /IM EasyAntiCheat_EOS.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5732
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /T /IM SILENTX-OSU.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /T /IM lame.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6116
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /T /IM SilentXLauncher.App.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc8,0x134,0x7ffba527c728,0x7ffba527c734,0x7ffba527c740
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,10617447803398609927,3184781815812415526,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,7807258434199587546,17251190030727237864,262144 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,15944512674412625927,14351720017990241891,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,16291708082090475174,3799995393812504990,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,7734715116218020775,17482619144354782303,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,14675629610616549339,9954372846629271018,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,16808650345897036818,10582505096345494137,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,7985398777259026228,9179131624755624855,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,1961434279910691250,8117840508928443600,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,4296151132225237402,18202684642790506093,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5584,i,3269463036236173239,12714538036858504715,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5948,i,11694893944886541387,4067530674600101042,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,8602731698154286213,16932660059785878116,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,5708690657715719634,3848105039247876354,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6380,i,13417298054240044762,10556734496619955396,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6556,i,10131661535576746941,17873935032485898324,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6352,i,13653713010602165012,17370249243801980311,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,9720046148570607200,10453574907638684601,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,3148379700602413516,4623304466950508723,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5828,i,4660590569173691397,10976138855993947446,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:9
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6564,i,14844916152104659500,12634962315014899566,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6036,i,12672317695198510791,17165789528752274729,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3232,i,12503913295922356403,16902119901215549154,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6776,i,14031551379121753372,7630473497920695075,2097152 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,15882923661898762014,1136410674964925744,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,10588231662998358186,4816464739987846698,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:12
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3596,i,3726641926728747639,14063367635114177190,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,11134170999465986695,7211215362110653681,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,6142285315463138717,1834035779061054820,524288 --field-trial-handle=1888,i,15618034811106975757,17042294620363637647,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 86f79dcf9844408d11e25fc380a450a0facf67a83ebf750223187009de8b7c2e
MD5 f28503990feac6da30302ef0a90b7b0b
SHA1 3167fd3aa486a31f4467cb1547297361ae9cec20
SHA512 54000688c66e075c1c3360018c0bf2eaf64a625d7388d2ad038edccf4b074293c8b2ea5832fb55a75205555bb317e93436df624d356b02a8191c3a033a8c9e2c
TLSH
T1F8E068A5CE68EC270AFD176E60904B85E75803976B41880F3E3DA40C8FB073B4586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 017fbf33284c9d8c6036adad0c25f578bca65ce24176e7b4c94df9d0eb19efee
MD5 d713ee7435851d0adb3516912dde2436
SHA1 45860a271692ec57682dc4bd2a2f80051c3b68fd
SHA512 9169283e349b6c7894d3798ec0e26122ffa74e11c2f77a2a6249e909f3c9ed28e39afb7172ccd7634bc4676872ed0c6ae2c8e30bc50a05669742900720f3cead
TLSH
T19311CE4FA2D3A742CFF808F0DCF4C44A2E304C9E8989770A73D49C9535061B26364746
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

9dd30351-265a-4c57-9ee9-249412c0f6eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9dd30351-265a-4c57-9ee9-249412c0f6eb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a67c55826e6e8c8ee270a68c0fd2fdce3fd3532c83f05f46bc3ed260c3b8d687
MD5 04e0fe33e12a1f8d7ae40985bdad97ed
SHA1 527b9229ba6e18c4148d4b843a00c3f5ea7082fe
SHA512 92403dc98567a38d47f77830da3030e6ef025c5c1171d5fd8e997e4698bac5c2c2db086b468a0f333780072461322fae3d58f1c5eb7832400affd602b93343c6
SSDEEP 192:DWN+NY0OoNIAjJoeSJsIf5Gn4guBH4HJ1lIAaPIISIX56vafPEDrz1xJNP7ZU7E:DWN+NY0OoNIAjJoeSJsIf5Gn4guBHyJD
TLSH
T1B112DDF7C3D8C62D885116F8AB25AF1FCE191A2C432D3C26C9D8BE0BA3E1471D25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 d98c72d6fb0f116d280c4b59d433fcd2b2e4a6611db5d2e42fb8c00ab47f8cda
MD5 d05168464915875eb822e68814281415
SHA1 56a475ed6d3bdb8ef52af1dbf34990611f42bdfe
SHA512 f97d0a9c97a116a20d453f6d539526dbe577cc22680a9dd164e025053021e31e4c250feab2a7e60cbcddad26eea503065708eaf846fa61e19010f2cd74fd427b
TLSH
T19A019EAB9A7E746B207899BF6E0579055CB5B4350141B8F4DFA7812EF0C35FB1B02413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75b7f5f9a7a6371ed1602bde6ef40e570c3a388c701a2f9d3336d53ca40bae56
MD5 f20c233d9674a28bb75fa8b731cfbf3d
SHA1 7b636eaffc01781f19c529488edbeab1cb0e52a0
SHA512 285e1cff10142b223e64864eb4b61793fb0d88fe068eac01e050e98404bc87330ce131a3945dabb6189114ffae7304a4ac3625d0a933f32bc98a0b04dac15a61
SSDEEP 192:xRlWqgQ3v7xAPRp2HFd9SHsb+WNnNK46R2JOeBQVyIsnAUge:xRlWcfIXOEwYX2PUe
TLSH
T14C42D82EA910697B6CDBD21AFA61BB57D7F6003225943E90EBFC892C14D76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3aff9adfbb91a8076ceb759995cf16dd5b17d7a12a547990ca1df96797e21985
MD5 2841c9799cd0d921ad9f91e5bf6b3b7f
SHA1 fabd96467a9619b4e55ea80c5dd004fc96977659
SHA512 7c4271d47e8f0a9f73ff62119eaf1de34aee3dbfc8800104ec0dceca38512db350cbb6645de2e61dee6e4b8c08e3804b51263f0691353fab588875d9a9e5c2a4
SSDEEP 192:xRZcBzWqgQ3v7NAPRp2HNRx9SHsb+WNnNK46R2JOeBQVyIsnAUge:xRZmzWcfMXQLEwYX2PUe
TLSH
T16B42E82EA910697B6CDBD21AFA61BF97D7F6003225942ED0EBFC892C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 98eae2288826a6396c7cf3ad79bada860f31807870502e0cfed1ad61ff816d2e
MD5 32276c59c8ad9be05966f7edd405a9b1
SHA1 db3cb1940d95d3a3acb340b5f88064770f5c6254
SHA512 88dad949599f5f66bdaa6ed481f5662578783131607e51eb48c1f7fcee6c2d32ace5056be9f839db928efe6e1325421ccde54d05c39cd0f16a55900877460f5c
TLSH
T10CB0220A83080E80E00A0B3200F30A08B3302C2F000E0283C2C200B0F880CC0BB28800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 306f132d979f6d343c976a65e923a1c07da434e7165602e4930a502caff5b139
MD5 33072062ed52efe3dd59dd46fdca7a26
SHA1 584f0969a30d3a50b9e348ac3137632ef5058af4
SHA512 4c3c7a67ddc9518e026cc59b7609977771900c393cca416988f90d251bc690f2f37c8a5afb74ddb2c7ce08fcab8999aea908a54a362a3ac223acdcabd2d06361
TLSH
T136A002505AC20511ED304274A06145466E62CE1B3992831797D50844CF9B2C04301550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6c69d1626a9049fa983e7e7c60c6785488aad30b17bbc06f6cc832b79d055cf5
MD5 0153ccfe464b34a0afdbc8251d2cd488
SHA1 93128eaf83955fb78e0a225b1a802e599039fb46
SHA512 f7c9fccdafa9054455c08a36b39be6d5b380fc683e30c396e7217ed084606fb53bef730360a7e4a299b52f60ec983d49fe1a284cf1bc0fb14dd6e17c29f12973
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5c0094.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5c0094.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 bcac1f337a346bfca18821d98fad5f98c6a44dab84900782f1ecc404613e69a0
MD5 3d096433c95dd2e62c214530cb95fecc
SHA1 4975c5524de18fbf4a06f2a2d9e58db5eb36327d
SHA512 85be5a21b6f4f02e56ca29a7bcc64628f987acd0e2cf87102738f3d66cd047151332dcfbd2a0a99d797877eb5096929f77e34845a39c690ad659b0508701ec50
TLSH
T12EC09BE76414454F9635DEDC2028763DD62B955D4CD4ECECD58840032974B334C05E79
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c0036.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5c0036.TMP
Size 157B
SHA256 68ff804795a393a61c3925d1b676c48083515da36108d21e79375e111bfe4fee
MD5 f851a256572740149ae28f140c816946
SHA1 8df7261dd6b8d46e93cbab953021d044158a57c5
SHA512 d5d325f4671a907312ef835c93523e533ca0d86b16964e108254bfec7602e0f01a765b2f003f8be05a8f3ce38919b44f9c2280dda099c2ac095e365e412b4454
TLSH
T1B4C04CE76414454B9731D9D82028762DD62B5D5D4CC8ECECE54970022574B338805D69
MD5 SHA1 SHA512 TLSH

Submit Download

c18a2184-6fd2-4d5a-8492-bc89154768f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c18a2184-6fd2-4d5a-8492-bc89154768f8.tmp
Size 13KB
SHA256 0f8735c9cea8bf32a4f3210d4ce27e9bcce916276caceee7fd7846b89184bc33
MD5 f0c9b369a03d2142ffbf0df5a6e6aa58
SHA1 7b93fa272682e2785fea521efb6e0792643cdda8
SHA512 2994865f36d32fd5cfded088918bd5d84bf5c30f86e589cc443278061d352362f13d94f7ad3dcc7a40c864152255c19c30ebe95e1352eaaf08b63bfe77415e29
SSDEEP 384:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOXODt0+ErU3rwHGx11Bnj2:Dlts7KxkXqKf/pUZNCgVLH2Hfgs4UOpY
TLSH
T145520967A48D9A3F0FD8C94CD8137F4FADB6025666784D2457FA9C0803A97CB124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 d4a09f5c868f6499aaa94f2f29654397c32db1523192916fdd2fb0a7f9644631
MD5 4f6a6f14dfdc72dc32100b5ed97409b9
SHA1 99fb53d56d7744d6f5207796f0b0516a7a9e141b
SHA512 00076257c2d30e267e01f9cd1c96c31eb689db83cbe4180f612842699e9de9d01c8327eb507270a42f968911f2cdf1eb470b18e32b13ee34f7ea9f5e928d3303
SSDEEP 3072:QhULvTtUlpXdopiiooj2mJHoqME6+2RidX8fVogjr:QhMrtUHXdK32mtoA6/Rvjr
TLSH
T10CD312F27EE35D56861CE105714FC61FAFEE6FA026EF1D898FA96D0E09E90A90303415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a1a9669322305e92d495159718c48cb99309131c4b6854d12b09afdc9867415d
MD5 0866fec31c4525e347115ce735efad3d
SHA1 498ff9b2672ad9490b035714da9141920b1728f6
SHA512 2fb728dab3c4d19e6e4269eb9b211e341742ab5ed43552d739bf7c4938df8e98ce5489ab9d4304dde9574c42d9f3c78065e16eca77ba05a6fdedf02f48d63bd1
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5B9DWB6EGyvP/e+0BZPEOLv4a:MC08UR5rYv3eDUDrGgae+0BZsOP
TLSH
T17BA10973A86A8D7BA976C48571426B43CFB5B17BA521BE90E9EC1F0C11E70EC1301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 097d01c298d2bb22ac724dcf98ff2a1d9ae5cb3da2cafb03bfb759c3e579f7c0
MD5 ace347d7cc4792330e8a85acb2a253b5
SHA1 588e2ee8efc5abd11ba2803f3c3f7f2ff0ea173b
SHA512 8bcf3be1f724fd9a65f421017cab219c22090e1e42a142669b4f68096d8217fd8c6a662b28d9d148432a71116e5ba46cbd6e875ef0f27db61a592969429c2f81
SSDEEP 3072:vhULvTtUlpXdopiiooj2mJHoqME6+2RidX8fVogjr:vhMrtUHXdK32mtoA6/Rvjr
TLSH
T17CD312F27EE35D56861CE105714FC61FAFEE5FA025EF1D898FA96D0E09E90990303425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2692_1070753927\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download