ee6e3fc9bbba21693e29f5bdcf361fcd3ac540b126c3584f640e50f876d4e6b3

Analysis

user interaction
yes
max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Activator.exe
Size 602KB
Sample260815-jxp4pasckg
SHA256 ee6e3fc9bbba21693e29f5bdcf361fcd3ac540b126c3584f640e50f876d4e6b3
MD5 c5690e5045f49afda18ff9a0a1a8b42b
SHA1 3ef87607cece6132fb8ef100271880d176bb62aa
SHA512 276abdd89926d19c4398d08d4a29a1f4d4d9fce734376a73fe20d2c5583408b7605a347f9fe4c0699ae4c09fbd5f730dfdc67bb14d623b12693a54883c7fd08b
SSDEEP 12288:Di8kg48vcivO9h2farcamOCLSkghGkEct90JNBxWRoSes2:DiTVh2VyxPy1
TLSH
T1ADD412D226B98CD9E250DC78C5554EE85ACBEE0CDF3C3A71297C3B2C967C98A1B40C65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
80	1320	chrome.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Activator.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activator.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312546892441002"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe
Token: SeShutdownPrivilege	1432	chrome.exe
Token: SeCreatePagefilePrivilege	1432	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe
1432	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3080	Activator.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1516	1432	chrome.exe	92
PID 1432 wrote to memory of 3084	1432	chrome.exe	93
PID 1432 wrote to memory of 1320	1432	chrome.exe	94
PID 1432 wrote to memory of 3084	1432	chrome.exe	93
PID 1432 wrote to memory of 3956	1432	chrome.exe	96
PID 1432 wrote to memory of 3956	1432	chrome.exe	96
PID 1432 wrote to memory of 992	1432	chrome.exe	97
PID 1432 wrote to memory of 992	1432	chrome.exe	97
PID 1432 wrote to memory of 800	1432	chrome.exe	98
PID 1432 wrote to memory of 800	1432	chrome.exe	98
PID 1432 wrote to memory of 2624	1432	chrome.exe	99
PID 1432 wrote to memory of 2624	1432	chrome.exe	99
PID 1432 wrote to memory of 5648	1432	chrome.exe	100
PID 1432 wrote to memory of 5648	1432	chrome.exe	100
PID 1432 wrote to memory of 1620	1432	chrome.exe	101
PID 1432 wrote to memory of 1608	1432	chrome.exe	103
PID 1432 wrote to memory of 1608	1432	chrome.exe	103
PID 1432 wrote to memory of 1756	1432	chrome.exe	102
PID 1432 wrote to memory of 1756	1432	chrome.exe	102
PID 1432 wrote to memory of 4688	1432	chrome.exe	109
PID 1432 wrote to memory of 2344	1432	chrome.exe	108
PID 1432 wrote to memory of 4688	1432	chrome.exe	109
PID 1432 wrote to memory of 1976	1432	chrome.exe	107
PID 1432 wrote to memory of 2344	1432	chrome.exe	108
PID 1432 wrote to memory of 1976	1432	chrome.exe	107
PID 1432 wrote to memory of 2172	1432	chrome.exe	110
PID 1432 wrote to memory of 4832	1432	chrome.exe	111
PID 1432 wrote to memory of 2172	1432	chrome.exe	110
PID 1432 wrote to memory of 4832	1432	chrome.exe	111
PID 1432 wrote to memory of 4244	1432	chrome.exe	112
PID 1432 wrote to memory of 4244	1432	chrome.exe	112
PID 1432 wrote to memory of 772	1432	chrome.exe	113
PID 1432 wrote to memory of 592	1432	chrome.exe	115
PID 1432 wrote to memory of 2804	1432	chrome.exe	114
PID 1432 wrote to memory of 772	1432	chrome.exe	113
PID 1432 wrote to memory of 592	1432	chrome.exe	115
PID 1432 wrote to memory of 2804	1432	chrome.exe	114
PID 1432 wrote to memory of 1656	1432	chrome.exe	116
PID 1432 wrote to memory of 1656	1432	chrome.exe	116
PID 1432 wrote to memory of 2984	1432	chrome.exe	117
PID 1432 wrote to memory of 2984	1432	chrome.exe	117
PID 1432 wrote to memory of 1344	1432	chrome.exe	118
PID 1432 wrote to memory of 1344	1432	chrome.exe	118
PID 1432 wrote to memory of 1984	1432	chrome.exe	119
PID 1432 wrote to memory of 4728	1432	chrome.exe	120
PID 1432 wrote to memory of 6976	1432	chrome.exe	121
PID 1432 wrote to memory of 3904	1432	chrome.exe	122
PID 1432 wrote to memory of 3904	1432	chrome.exe	122
PID 1432 wrote to memory of 2896	1432	chrome.exe	123
PID 1432 wrote to memory of 2896	1432	chrome.exe	123
PID 1432 wrote to memory of 2640	1432	chrome.exe	124
PID 1432 wrote to memory of 2640	1432	chrome.exe	124
PID 1432 wrote to memory of 4160	1432	chrome.exe	125
PID 1432 wrote to memory of 4160	1432	chrome.exe	125
PID 1432 wrote to memory of 3304	1432	chrome.exe	126
PID 1432 wrote to memory of 3304	1432	chrome.exe	126
PID 1432 wrote to memory of 364	1432	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Activator.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbbc9ac728,0x7ffbbc9ac734,0x7ffbbc9ac740
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,18263544191163136896,7818783774377018657,262144 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,10119668534264971217,2427632430407565314,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,1836305988841158529,9003362547071820858,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,9924123182609818304,5726169577412717306,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,2247882217404569396,1718397966893936735,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,16176369835232757884,2408985906585459376,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,10587715629016733422,4385346206193289011,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,2980290624532494508,8903062685497998410,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,13939094915492752454,13405081194598627049,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5520,i,14133711001109037686,16860041332641502736,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5604,i,3041846031718752088,18396691649505113383,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,2057425917225884226,6459745382692415538,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6056,i,16248701260784831728,8308194431276178068,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,12194593416213431577,10957620391713742741,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6240,i,17065250059899615712,7924755981274449172,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6064,i,7005686127776116670,9019703957450440357,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5596,i,10799140516281256192,6795517591381600390,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5588,i,10328681394652336993,15740425927379976874,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6244,i,11142593280376824444,5532277368145512783,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5788,i,1523746719893251953,16228597008399516251,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3300,i,13940700298101388394,2352995062126967471,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3916,i,14991944643680890653,5132874045211594810,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:9
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,2019529169523266189,15907972807751388998,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6660,i,789185006141727343,11313792397220311549,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,11983618640556434307,10247657489795717150,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6660,i,5200376516854497528,7883553375757967686,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6464,i,11970513602750191478,18302620102957067003,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4800,i,14141430508577979303,7438706816579657485,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6456,i,12363121079223175904,11804196150180110743,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3740,i,5004623521729204693,9175981622041638160,2097152 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,10634736556587970832,907013804508355832,524288 --field-trial-handle=1860,i,9276192715853182312,16586210526739437680,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 6931e329c12a568ead43fc69ad58a77849b15ec99ce30f06d1886ff9b08c0477
MD5 25c8890e24c42df730db17a18899a800
SHA1 be2280db46d84671772ea1b1ab976a5ebda35590
SHA512 2c89af540f2ac27c0a44cd2c9b8d3bdd4fc87621471e07f6e4d454f865c51ab834ccf82e03132a43398a55a3a116035cf000081d455674b631497f41b9086f27
TLSH
T11AC0925CA0514990C78E02B00CEF082321B04B7D1986A276FEA06D8F79E12F28146800
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

910a52b8-964d-4b60-aa67-098e02e4286e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\910a52b8-964d-4b60-aa67-098e02e4286e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f948755d7bd15c9b6163bfeadcf1a7f887a742112d5a0dc26e7094e89546a26f
MD5 aa07784d5103efda8d27addaa2a5b69d
SHA1 90baec8cbc2118d9713c2dc3f3d9e1c50961df6f
SHA512 65cc02ce7f02a25ed665e3f7fdc67663dcd6024404d34c1b58e5f8751a37d225250939ab456e3333d8596ea782ba5ba601e413ce14f17b104fe764810acb1e85
SSDEEP 192:Dwh52zpIJhHP9NZzey0FK4u4fNPJaPUfP6ovqkVjShs9:Dwh52zpIJBP9NZzey0FK4uENxaMfCoSY
TLSH
T1D0E17DF7C3E8862D890155F8A7156F1ECE1D0928432D3C67C8D8AE5F93F29B1E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b0a7cb5257e7b14789a67efc243a21ca40b168688809e19d2cad260ed16c96b6
MD5 32cf515c7cc8936c6b30bed2df5ff7f0
SHA1 4663940695904a09c6a003fb49810237456fbb05
SHA512 40e83125eca09e8f893c92b25c58ed77a86e3ddbf93f1cf625ebaafaf46390520a28cabb234ad02aa4deecf98f4edb54ca05b0729d30c11f2e0da3f98de3fbed
SSDEEP 192:MRzhhJRiGv7FwAPRp2BDJY9CHsb+WNn384Do2KmePHP2KDjW+VyIsnAUge:MR9vgy5BXFkwMj2wHP2KfW2e
TLSH
T13842C62ABA5069BF9DCBD21AF9617B5BE7F5102531D42E80EBFC892C00E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8cd78495be92afe7f215b309fdd5725bdf3e014cfe448cc0531270fabde38fbd
MD5 4e652945bd298a5a6e59c5335bd625c3
SHA1 c19c2f075180454f1aa4eacffdb5a3c7995db1df
SHA512 a79ffe6d678234e6e298773f56541904583407a74fcaf907b97578cb96b5ed27fb7ba0c1c01c129aab8642f66d0344a8720feb00f2e4e73caa000530290b5294
SSDEEP 192:MRzdcBzhJRiGv7FwWPRppBH/O9CHsb+WNNn384c7E0mePHP2KDj1+VyIsnAUgE:MRhmzvgy5LX2kwu/E+HP2Kf12E
TLSH
T1A652B66AA95069BB9DCBD21AF9917B5BE7F5102531E41E80EBFC8A2C01E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7889dd98a24297cf880654f611ca8350ba5748294c6e081543d8c77691c173d7
MD5 e3c5477fe4f3fb3eea3fdd47edfc287e
SHA1 40b36b76ffe767089542ae6fcdca3fafe0d38fe3
SHA512 49f40c475b45ba1279a29fc0b3d895129e6257765b700fad770c056ca82d413a2a027c472bbe24123d7b526a2825ebb69b82341db654d55055cd2a9371be5a6a
SSDEEP 192:MRzdcBzh5RiGv7FwWPRppBH/O9CHsb+WNNn384c7E0mePHP2KDjr+VyIsnAUgE:MRhmzzgy5LX2kwu/E+HP2Kfr2E
TLSH
T11452C76AA950697B9DCBD21AF9917B5BE7F5102531E41E80EBFC8A2C01F79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 bebae7d386c92bf9c7eac373a6cdeba9b50fac1b57dd5e772968c7cfde8fb28f
MD5 c560c05c994523e5600efd0dce6c9d16
SHA1 04bd20e23a985ecf1abb34b7eb562ef668a1d28f
SHA512 c4dcc6b0cb7b3d6e384e8a56798607cb64de10befa7fd0260c4df0de01617740b2e1265db33cbff46b1b36694dfb3c99b49cac75727e024ecb357d3409d74bad
SSDEEP 384:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmXODdc+ErU38cHGh1X4GtdkD:BLbC7KxkXqKf/pUZNCgVLH2HfgsPsOZL
TLSH
T1E452F867648D9A7F4FD8DA8CDC126F4FACB1025666A80D2493FB5C1803957CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 01220c6a7e54ea5cf12460f362258ae564308722e221978fd069c7d52966506c
MD5 4f2751cf862509325323439efc106dd2
SHA1 94023048f872b98b92710dcadd618a9a5687ab8c
SHA512 c0f4649b5fba7f7f82a2e928d18cdf4aeb17f112fbea172c9d1cb0ee84788e7da2080e422ff8bf140adf979a1ded615e6092c9ad80f2d286b901f03b6cfb6f99
TLSH
T1F8A0021891D04811CD019375B965098F22915D6A55558373ACD3086698AF1D08146A10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af55e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5af55e.TMP
Size 48B
SHA256 973041c43c1ce583cfca84af66c08fd291703b8673f11179f27a0d7e1aaaf48e
MD5 0cb37e296e71d1f091183b67d725f7d7
SHA1 1a2aa4dcac5d8a170eb9f3dac08b2baf65189af1
SHA512 ec5efe801cf38fdf525652185d7d3107d341a75c85c534153c70314bea968948055fc30a5e952781dddd453f503ca2e88ae2d6685286be36f540121e4970ce93
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b7ce7cb9ad179fb3280dac31da9079cad87147e33e1a7e3c47c98ad89eefecad
MD5 320cdf189ef45f1a3d272b7efa494317
SHA1 8d10715267e3b9054b819f4ac1d837c989403c77
SHA512 8e77bfb3e3b2a21f74ddd0bc2cf8e01a952961bee3bd495e3417aca8c587d6d6480ca9756be71aff12cda04975441a4b8d6b6a6166d99e5c944024c74a982511
SSDEEP 96:MuC0d+CNkx/Fc5vBh2F8vIfjnNASrYSl8h4otop5/BDnB6rGyv1fQBFv1Qzbo6bl:MuC01N2c6A3iU2JB7wQBF+ZwIikCrU5D
TLSH
T153C11A3678ADEC7348F3E55AB5432A47CEB4603BA900AE94EBD55F1C01E74E80383D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 468243bb1c1098359f0a71e45c9f90c9c25a318f4348daa6b3d1cea0ee41a430
MD5 239c52230c45f3ef8c7ef1af856755bb
SHA1 9b17313972c042485fcada0dbf15c16b55285f30
SHA512 ad921130fbdc95432d7ca9368a5d5ce9ebcb5197863592d507951a6e2b4cf8781c4da39c12451671875daecb5002b09f96cf91b6ebc85e6b69f917eeb0899374
SSDEEP 3072:h5dt2ysIcOjLQgO05Y2hbJONy79MSYu6h4tPlSzMHTkFlHIzk5UETxUVBr3Ysb5j:hHIysIc2kgO1iAQeTh4tPl/HQFlGMUEE
TLSH
T19FF312B0A90BCDFB967A0754B0049E2ECFF48D63D985CC8D8BC97544D0E69E8C944E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 18f2d808415bae1d7ef381fb5c5b261e1ba1a4effb0fb724dda9e0a07592d881
MD5 6d25465653d3e4cf86ae15404ec06573
SHA1 9d874123f65d84e07dddd5c7d9989fe04e3825df
SHA512 fff96da76c1eb381cfd0522445e6ef7663b745c0f767a56f376fde52087837380567982e3f6b4975e2cd12dd5744a61a7038ba0d39f9c5bf9101cec19de30e48
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5/VDnB6xGyv1T5ikqbKv4a:MkC01N2c6AGDDUDlB1U5ikqbU
TLSH
T1A7A10932586D9C7788B2D549B5522E03DFB8612BF921AF94EAED5B0C11F70EC1381A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 fec943c4a53a2c96b90732d753f6257ac0860fa2ce6833d541ebf21cefaad5fe
MD5 47d5e5ef36a5ca84b9dee0a96486ac86
SHA1 68a628c42feb6d6fd5e9ef5724174fee78d249f8
SHA512 9bfb554d81b8dd656ecce1a62989a20f2ba18a11cacda3360ad99485d2da6327bef220e1d8ce5073e11b3559ca6ac2eeba0af3a22b569c8566a1caeea0df5bf4
SSDEEP 3072:1hbJONy79MSYu6h4tPlSzMHTkFlHIzk5UETxUVBr3Ysb5fbX:HAQeTh4tPl/HQFlGMUEeBr3YsbxX
TLSH
T150D312E0AE0ACE77A56B4658F0149E7BCBF88C6395C14D18CBC97309A1E75E4C448E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1432_554252385\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 189353.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 189353.crdownload
Size 2.7MB
SHA256 15c905df424eb80df0eccb607a3025a9c369b6c16fbf693294daa2b1c8697e69
MD5 226e59812c0cd541b605ce4f62490f99
SHA1 ad29676cc6c04941ac405960485de6cdf494aa6e
SHA512 fea32cedceeb926ca9b6483e078fc2c52683cef76486647e99da9dda93611c2f1490dfcbeccbbfb3c2a78d66f9910ac0c2b03f5c3412e0ce1b50ff1884d099e4
SSDEEP 49152:L6712fyR64QUVLSlWEYHSRa9wt8f9VLkyFBsNyL4sEDTo+JeMYF:Lg2fhFUVmMEEFN9VLHuE4sYzYF
TLSH
T130D501D51ABA8DADE050DE7C8AD1CCC9A5CF5E1C953D3A3A4638341CAF7CBDA2184C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 cd815f9c63ecf7258b6e9b836aee4dcbd9e5089daaf0647162f9d6b9c854984a
MD5 b3f2c2b5cdbabdb64138329f9099282b
SHA1 1493199d87320e976f46d97178ac2aa2c3beabab
SHA512 fd37f84e666f2dc16c469bde0f1f0b721f1958e4d815b80ccf05f90689945d70882254544277a354c23ef2329768fd90dbb05b78a799514485705447fdcfe89e
TLSH
T1B121BB260689916D26B341E5091CB82FA31FD0EF0E2B8D8D3E8E450F7BA2A1C5366646
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3080-8-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3080-7-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3080-5-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3080-6-0x0000000002380000-0x0000000002381000-memory.dmp

Download

memory/3080-41-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3080-0-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3080-4-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3080-1-0x0000000002380000-0x0000000002381000-memory.dmp

Download