e7376b28060f02ac5720da5bf27e010c8eb3311f1c6eef5e96685ce1554e0792

Analysis

user interaction
yes
max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vipexyz.dll
Size 722KB
Sample260816-a24yzaxvbv
SHA256 e7376b28060f02ac5720da5bf27e010c8eb3311f1c6eef5e96685ce1554e0792
MD5 bfc791dea7bb5d1dadd59e1139b9c22f
SHA1 0542a7e949383c9c7e82570b28381bec42cd1ed4
SHA512 98fb1a15259a1f3577bc282965d1dc3436fa7a4a2fa1321f4ae1307394b6bf75bf6053928fbe4748ddd74c34bb999e0d817e5d1d1157bc172a47f53fd3126375
SSDEEP 12288:OdKI0qySxtHrpkWB/3o/H3ZjfvWvumly+dOE15ldP:OdKIVygtHrpN4/H3ZjfvsumlZnxP
TLSH
T19AF47D05A7F811E9F1B3EA76D9B21512EAB27C850B70A5DF03E0499D1F337A0963B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
204	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313146409912260"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2960	chrome.exe
2960	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 5948	2880	chrome.exe	95
PID 2880 wrote to memory of 360	2880	chrome.exe	96
PID 2880 wrote to memory of 204	2880	chrome.exe	97
PID 2880 wrote to memory of 360	2880	chrome.exe	96
PID 2880 wrote to memory of 5020	2880	chrome.exe	99
PID 2880 wrote to memory of 5020	2880	chrome.exe	99
PID 2880 wrote to memory of 820	2880	chrome.exe	100
PID 2880 wrote to memory of 820	2880	chrome.exe	100
PID 2880 wrote to memory of 4456	2880	chrome.exe	101
PID 2880 wrote to memory of 4456	2880	chrome.exe	101
PID 2880 wrote to memory of 1116	2880	chrome.exe	102
PID 2880 wrote to memory of 1116	2880	chrome.exe	102
PID 2880 wrote to memory of 3328	2880	chrome.exe	103
PID 2880 wrote to memory of 3328	2880	chrome.exe	103
PID 2880 wrote to memory of 3952	2880	chrome.exe	104
PID 2880 wrote to memory of 1748	2880	chrome.exe	105
PID 2880 wrote to memory of 1748	2880	chrome.exe	105
PID 2880 wrote to memory of 1252	2880	chrome.exe	106
PID 2880 wrote to memory of 1252	2880	chrome.exe	106
PID 2880 wrote to memory of 716	2880	chrome.exe	110
PID 2880 wrote to memory of 716	2880	chrome.exe	110
PID 2880 wrote to memory of 4352	2880	chrome.exe	111
PID 2880 wrote to memory of 4352	2880	chrome.exe	111
PID 2880 wrote to memory of 4808	2880	chrome.exe	113
PID 2880 wrote to memory of 3244	2880	chrome.exe	112
PID 2880 wrote to memory of 4808	2880	chrome.exe	113
PID 2880 wrote to memory of 3244	2880	chrome.exe	112
PID 2880 wrote to memory of 2960	2880	chrome.exe	114
PID 2880 wrote to memory of 6068	2880	chrome.exe	115
PID 2880 wrote to memory of 2960	2880	chrome.exe	114
PID 2880 wrote to memory of 6068	2880	chrome.exe	115
PID 2880 wrote to memory of 3536	2880	chrome.exe	116
PID 2880 wrote to memory of 3536	2880	chrome.exe	116
PID 2880 wrote to memory of 1828	2880	chrome.exe	117
PID 2880 wrote to memory of 5668	2880	chrome.exe	118
PID 2880 wrote to memory of 1828	2880	chrome.exe	117
PID 2880 wrote to memory of 5668	2880	chrome.exe	118
PID 2880 wrote to memory of 4692	2880	chrome.exe	119
PID 2880 wrote to memory of 3096	2880	chrome.exe	120
PID 2880 wrote to memory of 4692	2880	chrome.exe	119
PID 2880 wrote to memory of 3096	2880	chrome.exe	120
PID 2880 wrote to memory of 3100	2880	chrome.exe	122
PID 2880 wrote to memory of 3488	2880	chrome.exe	123
PID 2880 wrote to memory of 5708	2880	chrome.exe	124
PID 2880 wrote to memory of 2960	2880	chrome.exe	125

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vipexyz.dll,#1
1⤵
PID:6128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcaed0c728,0x7ffcaed0c734,0x7ffcaed0c740
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,10491013459168740364,1428199535279748480,262144 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,6754918076859511450,12848533645492626781,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,1304912957262363856,14623647572888846975,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,5839855820828413067,5212909146208436475,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,5296788958682358408,8516977747556404624,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,13125253378552714466,14853522070569361357,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,1401545919822412718,10315165712181097868,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,12826372044518479132,3341107611784325273,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5460,i,5138504986893416939,767760090083218571,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5468,i,1139811281303484685,6672017030891779492,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,9023127476537933454,1728119514721605609,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,13133950268937993655,17097498471612105987,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5492,i,2290973853681399848,13647484986099742675,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6212,i,17816919976187434461,15932182585100736924,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,17474266189013125568,14042433421364492853,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5772,i,15033095190889610906,13818292178904293937,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5356,i,15827691952164798615,17016438378286312375,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5688,i,7701082705150567620,2401130216896575907,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,9835466839141345544,10332062311670146622,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5744,i,10587753167345230412,11675865312764885186,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4820,i,506493167346746090,13416805417037552034,2097152 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,10157472947087940069,8998559176906216232,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,9705426974964985696,17261361262329172476,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,243207265574023640,16701328248285558880,524288 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6204,i,3327049687793943955,1971835213859751789,262144 --field-trial-handle=1888,i,320868108078268471,10202854603327537607,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04757d6d-26d3-4a51-ae33-1658fd48fcad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04757d6d-26d3-4a51-ae33-1658fd48fcad.tmp
Size 11KB
SHA256 35720e51704ea17ec5886b275b700937e549aff1fb722e858126ee886ea28ffc
MD5 93ddf06626bbcc7f3a74a436c5fb0236
SHA1 c57e1525dc45a79d0acb798fccaab99098729df4
SHA512 6e62dd9da113dcee644fdd45d0f6fbb6a7f1d757fafbba473d5b5e007f499286b8b35189fd740e34d3fed5f8aff06ac9acf53338e8e94e76d439c7d9b40be3d9
SSDEEP 192:nRQ9oWUFv7xkAPRp2T9GHsb+WNnptdXUJCkwQav/VyIsnAUge:nRQ9DU1fXMgwvd5wavZe
TLSH
T16F32A62EA914793BACDAD22AFE227753D7F5202175942E84EBFCC92C15D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f5c52de654964c4acc318fec05ce0d34ced61ceb70af4196d93bd9e866a17cd
MD5 9b109b540eba02f96f13742710c487b8
SHA1 f36090c0de82cef64137b9f7029924b57c5a66e1
SHA512 d95c7b41038392eee865caf71baa3ed0de7bc9d1b3c26e56185bb783936a6d1f0c6e7b2f9735a0d922b076b5f5bb0f83cfd1c831190137772b2d0a06e90d34b4
TLSH
T1AA518CF7D3E4997D851166E49B21AE1FCD2E0A28121C3C62C9D8AE5B53E2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75aed23b2f590b2be595b7d16e1f6d4a42bab9b3cc23d30faa83e0c547a4bc5b
MD5 0898499e73f7cda2e1c7eac7334082ef
SHA1 6206f2a0c3fbfe046b4a4788857807266c1827f6
SHA512 59bb36a6ec8cbfede4b31c34ecb6afa46ec4c1c50d183e029fc4c46b2c7df2cb677c6d4642a3d076aab273813f0749b828051ec66cf01698eca9e734f4d706f9
SSDEEP 192:nRQ9oWUnv7xkaPRpwT9GHsb+WNnptdqUJCkwQas/VyIsnAUgE:nRQ9DUvhXWgwvdiwasZE
TLSH
T1B342C72EB914693BACDBD22AF9227B53D7F5202175942E84EBFCC92C15E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 05843cd8af1cb4c71e9bada1142aa71733434e5300a4992ed8aa5712b41552c8
MD5 8354d6f087895a4bf027a19724c24fde
SHA1 e383a50e218c251297cb52881ede5dbba5094e66
SHA512 7acf56e72438d11690f89d27fa1af9f900ca5f796e1013edd0edc92b6945046e50a2fa7406878ce9fcebf7615470646f9533c9a356f05e474881c3f69f3c0128
SSDEEP 192:nRQ9oWU6v7x4aPRpwT9GHsb+WNnptdqUJCkwQas/VyIsnAUgE:nRQ9DUW5XWgwvdiwasZE
TLSH
T1AE42C72EB914693BACEBD22AF9127B53D7F5202175942E84EBFCC92C15E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 15b47816216962a1bdb58f905edc889cf3c32d09a9b90cdfaf6aeb91d15f37b5
MD5 d50969b9d68939a79a6c9f24b0e8776c
SHA1 b189ef4cb409836de79a44d213cd8be232812c94
SHA512 bbede0b7aa7964253c56066affa53ebf159fa7a397f836abb122fab21fe91279a767d794e48418fc8a738e5cba480123c51c052a8f7b367291feccc2ecad2aaa
SSDEEP 192:nRQ9oWZkv7x4aPRpwT9GHsb+WNnptdqUJCkwQas/VyIsnAUgE:nRQ9DZA5XWgwvdiwasZE
TLSH
T11042C62EB914693BACEBD22AF9127B53D7F5202175942E84EBFCC92C15E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4379b7718c7ce7b7cf1a9fc946c53f19539645d87d45b1d7383d140af9b8e3ab
MD5 6b24a077bd5698252301714237097d54
SHA1 4d982d40edaf53f526581135f2cc67edee8dc184
SHA512 52d9d0b4430876eb3fedd00547d013ed4bcca66da2695345d2bdf8acddc66bb2172f315b82254d8ce41cd8538fe3d1dd386c7764f44d77bb91af2649c3c976ef
SSDEEP 192:nRQ9oWUWv7xkAPRp2T9GHsb+WNnptdTUJCkwQau/VyIsnAUgE:nRQ9DUifXMgwvd1wauZE
TLSH
T17242B62EB914793BACDAD22AFA227753D7F5202175942E84EBFCC92C15E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 dd1e9a745483d9488a92ccd62cba38d1c0a2660d42adf557169c1a7893ec17a7
MD5 1a4a790df8ce83af857368f0a94faa57
SHA1 f7d0e463ebeb8a003f4f0453046ad1ed6311bc7c
SHA512 3dfc7487eb8be91380c4aa46d1f70953bec671374c42455e9eae60f2a796ebdd3b7ae898a918a215c57545b9c61e414b18774ef64fa40ba101023fade4e994d5
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU3PgHGtJidmta/:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOh
TLSH
T1C6520867684C9A3B0FD8DA4CDC16BB4FACB50257A2A40C6857FB9D1903D57CB120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b23c3231067e6869b88db365dc444463e18a2018e8bb9546ab234206fb290eb2
MD5 58571a695406a4b3434b5ad1fb5ba96d
SHA1 d3af87a64eac2523fcf7915db102b8d6e0a52494
SHA512 1698b96a58799fb7a7407c9822e761fa7f8856b513afce1c9ad618b6d6c8c5a39988ea2e36fb13a3e49cf5a6c14604b133811826cce92009616a12cf28ed12cf
TLSH
T1F4A002208DC04461CD006370A06105493652A9655961434764950EC48D5FAF4A215125
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b8b7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59b8b7.TMP
Size 48B
SHA256 45bee4ece1e5c8d40dd8ac45989340ebc75a9edba036c03c6e35d2c89cffed26
MD5 249854ae7ee7270a751ee0a6b062508e
SHA1 731b2ac5ce47b9738875575bec0127120c420d5d
SHA512 91d64c1dff29c8afa27b6c0126e21a4cd8601199972f4a64d45d6e4bcd0ee1c033aad6a52977fb418c0cc0c3160194a8cd30eb0ced3127a52b7820d2d61185c8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a1fdc7850280dbad4b3c9448f064da5c242716f5bba1352f21f8d1df220b29fb
MD5 9a75078eefb14f70cbf3ad0e56ec549b
SHA1 de3ce36de88dce0d351982d29d72721296f2056f
SHA512 9c28cc6e90f79bf14c697366d6016ea9890630d1940eee9ad8df6a6cb9c6640f41ba57ed3e99445b4afa1c5d9be7a74c4a08a6da0e39eac268ed465b38316db8
SSDEEP 3072:shbJONy79MSYu6h4tPlSzMHTkFlHIzk5UETxYIGfVRtc1L:AAQeTh4tPl/HQFlGMUESPGL
TLSH
T120D312F03C828DA355F90A6CB111BEFACFD85C53CA8A5D18CAC5AF0960AB5D5C10DE67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0b07a6ea94e8b4f7cf058f35403d8cc952e56cbba3132cba6340102ff37b7561
MD5 7c7bbd30fd73eb4f5be2329880e316ca
SHA1 4cfbcc5e0af879d480bf2e363f00b6f4eba73e34
SHA512 08df8f55972e9932b6cffd2f673442409998d7be3a5a93d682a9bcc8736d466cabbea35e4d418b57cdb73def8f90b9d971abb2e980abb62233904ee85220889e
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5FcDpB6gGyvhyLfOLZEbZP9v4a:SC0JeGnpDUD4vE1mLZEbj
TLSH
T1A9A10B71A06D99B344B6A949B5526B43CDA531ABDA21AE84EDD95F0C02FB0EC0342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 709174183e4d298fe225a276af87518d04e21b94b2d02f1e73b8c75f4f0bcd9e
MD5 e331a040c91918a3234dd13bce136c02
SHA1 a1db94f8ab8d9e35e53bb84a38875739bd581cc1
SHA512 2975a493e648962786e619147afa25d593bc55fa7b9aa1e620de08a47f0cb16fd04c8b35ae049e518ba9c2a0af076470b8805d0715ef8007a04e7ab439f54647
SSDEEP 3072:ehbJONy79MSYu6h4tPlSzMHTkFlHIzk5UETxYIGfVRtc1L:6AQeTh4tPl/HQFlGMUESPGL
TLSH
T1A4D312E03D82CD6391FD4A2CB125AEFACBA85D51C6CA4C54C7C6AB0971FB4D5810DB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 952f5f390a95bce8a4cd5430adcf6d2500f6c3771add4dabbb1c554c96564e06
MD5 68828bf4950cb990bae54abe30021252
SHA1 be18b9c66129a87585baae197d3eb5234487f1fc
SHA512 494d33a0dadff7239b1ed72a8814b512b2e3a850d39e4174078a95a74099d3fbd040f1236c41bf82231d9dd61dab4b50100297afe20967d3386ec10e20d54ec7
SSDEEP 3072:jhbJONy79MSYu6h4tPlSzMHTkFlHIzk5UETxYIGfVRtc1L:dAQeTh4tPl/HQFlGMUESPGL
TLSH
T1E0D312E03D82CD6391FD5A2CB125AEFACBA85C51C6CA4C54C7C6AB0971FB5D5810CB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2880_1160348952\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6128-1-0x0000022A78370000-0x0000022A78371000-memory.dmp

Download

memory/6128-0-0x0000022A78360000-0x0000022A78361000-memory.dmp

Download