58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XhangerCS2Lite.exe
Size 1.1MB
Sample260818-3crassseqh
SHA256 58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05
MD5 3ed2c582c7310b2926ab8ddcb1fadd2f
SHA1 20102cc731a607b572000cb9f9c093f0d6604790
SHA512 50be358072412edce6f414255d10f38bbb74a2d4001064344fae8f2c5d0efa347ff9460930816af81b1b460e9620f518cf5d4faa42baf22e10d5fb3771aa07d9
SSDEEP 24576:C4SCctUXaZ9EzOUoIyGfoJVNbjZO0R5P3rjD3gPH2EF1:CInXaZXHzGfmBOw3rjDZs
TLSH
T1DB35D003F3A2C33ACB17283186A6E762567FBC501B12918773A82959DFD31E04F9B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XhangerCS2Lite.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1040	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315690282305284"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe
Token: SeShutdownPrivilege	4232	chrome.exe
Token: SeCreatePagefilePrivilege	4232	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe
4232	chrome.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4648	4232	chrome.exe	90
PID 4232 wrote to memory of 4692	4232	chrome.exe	91
PID 4232 wrote to memory of 4692	4232	chrome.exe	91
PID 4232 wrote to memory of 1040	4232	chrome.exe	92
PID 4232 wrote to memory of 1624	4232	chrome.exe	94
PID 4232 wrote to memory of 1624	4232	chrome.exe	94
PID 4232 wrote to memory of 4824	4232	chrome.exe	95
PID 4232 wrote to memory of 4588	4232	chrome.exe	96
PID 4232 wrote to memory of 4824	4232	chrome.exe	95
PID 4232 wrote to memory of 4588	4232	chrome.exe	96
PID 4232 wrote to memory of 5952	4232	chrome.exe	97
PID 4232 wrote to memory of 5952	4232	chrome.exe	97
PID 4232 wrote to memory of 4740	4232	chrome.exe	98
PID 4232 wrote to memory of 4740	4232	chrome.exe	98
PID 4232 wrote to memory of 6028	4232	chrome.exe	99
PID 4232 wrote to memory of 3232	4232	chrome.exe	100
PID 4232 wrote to memory of 3232	4232	chrome.exe	100
PID 4232 wrote to memory of 1628	4232	chrome.exe	101
PID 4232 wrote to memory of 1628	4232	chrome.exe	101
PID 4232 wrote to memory of 6060	4232	chrome.exe	102
PID 4232 wrote to memory of 6060	4232	chrome.exe	102
PID 4232 wrote to memory of 1988	4232	chrome.exe	104
PID 4232 wrote to memory of 1988	4232	chrome.exe	104
PID 4232 wrote to memory of 3900	4232	chrome.exe	105
PID 4232 wrote to memory of 3900	4232	chrome.exe	105
PID 4232 wrote to memory of 6108	4232	chrome.exe	106
PID 4232 wrote to memory of 6108	4232	chrome.exe	106
PID 4232 wrote to memory of 5124	4232	chrome.exe	107
PID 4232 wrote to memory of 5124	4232	chrome.exe	107
PID 4232 wrote to memory of 3816	4232	chrome.exe	108
PID 4232 wrote to memory of 3816	4232	chrome.exe	108
PID 4232 wrote to memory of 4092	4232	chrome.exe	109
PID 4232 wrote to memory of 4092	4232	chrome.exe	109
PID 4232 wrote to memory of 5160	4232	chrome.exe	112
PID 4232 wrote to memory of 5160	4232	chrome.exe	112
PID 4232 wrote to memory of 4916	4232	chrome.exe	113
PID 4232 wrote to memory of 4916	4232	chrome.exe	113
PID 4232 wrote to memory of 5388	4232	chrome.exe	114
PID 4232 wrote to memory of 5772	4232	chrome.exe	115
PID 4232 wrote to memory of 5388	4232	chrome.exe	114
PID 4232 wrote to memory of 5772	4232	chrome.exe	115
PID 4232 wrote to memory of 3552	4232	chrome.exe	116
PID 4232 wrote to memory of 3552	4232	chrome.exe	116
PID 4232 wrote to memory of 2044	4232	chrome.exe	117
PID 4232 wrote to memory of 4864	4232	chrome.exe	118
PID 4232 wrote to memory of 4572	4232	chrome.exe	119
PID 4232 wrote to memory of 2388	4232	chrome.exe	120
PID 4232 wrote to memory of 2388	4232	chrome.exe	120
PID 4232 wrote to memory of 3044	4232	chrome.exe	121
PID 4232 wrote to memory of 3044	4232	chrome.exe	121
PID 4232 wrote to memory of 4916	4232	chrome.exe	122
PID 4232 wrote to memory of 4916	4232	chrome.exe	122
PID 4232 wrote to memory of 4836	4232	chrome.exe	123
PID 4232 wrote to memory of 4836	4232	chrome.exe	123
PID 4232 wrote to memory of 2780	4232	chrome.exe	124
PID 4232 wrote to memory of 2780	4232	chrome.exe	124
PID 4232 wrote to memory of 2328	4232	chrome.exe	125
PID 4232 wrote to memory of 2328	4232	chrome.exe	125
PID 4232 wrote to memory of 1936	4232	chrome.exe	126
PID 4232 wrote to memory of 1936	4232	chrome.exe	126
PID 4232 wrote to memory of 6104	4232	chrome.exe	127
PID 4232 wrote to memory of 6104	4232	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\XhangerCS2Lite.exe
"C:\Users\Admin\AppData\Local\Temp\XhangerCS2Lite.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x80,0x134,0x7ffe4703c728,0x7ffe4703c734,0x7ffe4703c740
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1449940286509954346,16698193629884534377,262144 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,7603038309688928153,15923700535650074946,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,3738449640193736817,1281045900623634682,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,17791024389019538124,13691686677826902907,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,1327455317605008944,10179327115952349289,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,9719522893830656420,13779167167404173434,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,9629611941999157894,10572328100251440773,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,14627639106148618456,17635865997276835696,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,3371556944736394176,5421243590191464840,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,10389745164726717731,6842307060073094125,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,14650274238010166527,3647688982300499039,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5788,i,2703467114302264870,17358248381568749215,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5800,i,4414455363049160591,6507470524204793109,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5520,i,280584949618060716,18439767197761319983,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6380,i,2395501790457486698,7291100261204081106,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6456,i,12731027617217362864,3894362710093125870,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,3210535860427928374,6620649625701979010,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,9322385109699117647,380444994052063496,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,1948747540992838646,12712109167203167771,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6020,i,12357178733691420257,11267737848690567149,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:9
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5952,i,11358160856643583255,3945924647996024725,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5844,i,8894493474698372837,6690922532118745967,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,5847354259137932645,18069074266891511287,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2904,i,13940604329665261816,9714346844541887170,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,10947923247275972135,5415840068172021839,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3480,i,2503989331281211515,5077244773276023318,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=272 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5824,i,5130826735546774884,10201427401724366768,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3528,i,11559552128841295710,14835535619955346783,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6296,i,10660696916565972740,13712991627606520850,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5020,i,16554197673006222227,11428684674960155902,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5972,i,6355027194061018680,829622942894509192,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5520,i,1695773284812688509,9559663087357295604,2097152 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3560,i,15707202301273739039,3807448865850642169,524288 --field-trial-handle=1872,i,14534839401788907579,6281291113348371948,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:12
  2⤵
  PID:6104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 399cfbab42d49dd2f413441a918a60b0f902d8f7ee41dd0dd435c8226e460887
MD5 40bb16c32236813fa13c925dd9c5e7a9
SHA1 ebdb4a75250b4cfea3c2c73db96a13d09a4a6783
SHA512 313d72aac235910c70ed7e9f59f3c847183a67d9e2cbb9bcc34959e70f43f2a7f7005329f38531ba5c0fd269319313f22259bda2d561766e319ecbfa5742fcb6
TLSH
T119C09B1401919596CB5401B610E7854C25F05EF583926D558A613DDD9452351C103591
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d3b85f738aedfde6ba24c44cb9934d3fcb1ced121e48dd0550b7bc8f2b097e82
MD5 bd6d804e397434f8d1f376c770ff8dac
SHA1 40741f203e8de52e835ca59023e09eb2990cfa31
SHA512 80a297e6fb8d79f58ed3262950f6d79ff60c255787a190ca5b3e5c3e9a5914a2d78a60e422f2d36c9249513cc83c8c5c1bc76788a48ee16bac6b57932db36ed2
TLSH
T16B719BB7C3D8862D895156F5A715AE2FCE2D0A24421C3C26C8D8AE5B93E2872E21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1c4b5f9a5c96139aa784cc347f7eb394230381c91dba93c77a6c995fcfe3709a
MD5 c13077f112d6d1712f16115e462fb275
SHA1 7636292ed0db7e2177da73aef222a6b2a647fbe5
SHA512 aae5549b0e50ba42a706ce52dc2d1753654b1621f6796445d8ea325fcdc7235d2b773da96754f216ac715220254114ac7d2fb577a3f366e2937112c01bd048fa
SSDEEP 192:jR4dA0K3v7JkAPRp2799Hsb+WNnUq0MskwRkZTkw97a+VyIsnAUge:jR4dIfnXcvwh0c8iRa2e
TLSH
T10642C72DA910743BADDBD219FD227763E7F5102671942E84EBFC892C15E79CC221704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1e23b2f07d7c108bc5bc81032ae116863e4041d33d147a14c7250bd311154552
MD5 845e01d17272a99ca0feb1741978226e
SHA1 85e9afcb37909828fafcdf0eec27b0078a125d6e
SHA512 c434c3133dc6e427ab075bcc59881c2e30e4bed7978ac691742072fd761cd569882f704e2bdf4d8a25b46b1060baecf202f2e1f3ebc947d41a3ee17bfeba0a55
SSDEEP 192:jR4dA0gTv7JkAPRp25Q99Hsb+WNnUq4hn2MMkwRkZTkw97akVyIsnAUgE:jR4dqrnXPvwha2e8iRagE
TLSH
T13C42D52EA910743BADDBD219F9227767E7F51026B1D42F84EAFC8A2C11E79CC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 70ff3cd7d99c3828ba0bc1160b770567b2fdaa0464f3f6fb22af64572586affd
MD5 7085656b321e17d5b8c3d65037015705
SHA1 589b82eca29aa743d3dd855a268d00516c55467d
SHA512 ecc3d31453bd9ed325c6a709cdba19e04886b8370e548d57155ff72b33a5211e455949d81e102f479db39426c6fc10e7482bb7fc0e2b6d263299a22a3e8cba13
SSDEEP 192:jRQcBzdA0gTv7JkwPRpT48x99Hsb+WNnUq4dDYMbkwRkZTkw97aGVyIsnAUgE:jRQmzdqrTXnvwhyYL8iRaeE
TLSH
T1C542D82EA910253BADDBD319F9227B67E7F51026B1942F84EBFC892C15E79CC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 fb24162786a6b941b3ec129df8e69cedeb4a635f389d12399c82f579e2ec5ff4
MD5 b641478e5ef3410807b82755a40c45ec
SHA1 9cfab37805287417ef2ce602991c80353f2099dc
SHA512 d489670bc38f7bc09a44ae81f0870372c2f55af9f5d33f14757f57aca6cdc0849381e9a0e0729ad7d99436ec49041021a6593069749015cf4f985f19fc094c1f
SSDEEP 384:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRXODCB+ErU3ycHGKuSb8r7r:GUH+7KxkXqKf/pUZNCgVLH2Hfgsn1Oen
TLSH
T1DC52E92BA48D9A3F4F98D68CDC16AF4FACF1025765684C2457FA5D0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9a2952cdd1499ba47158d2a3852ab9ed51fd1ffec104803c2a4e8506436a42b9
MD5 e64cc6a8591a5a7db09eaa5bfa05eb82
SHA1 060b675412294877e7f33986b4856673802deb7e
SHA512 94ddf86b58cea962c0b3ce01ec4deb623b0eaaf7c889aa306337ca81af2b394bab3fd9c57c2298968b9e0f952daf69f508d8e92b0cb951989c4befd5b25b7b18
TLSH
T1BCB002E484005892C39A2775A0C6A0403B381C9103575B6550E112ABE919BB1C1B3641
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1db5400edeb01424edfeaba9fd0161ce06ffc490bebd0f7bc0fc2adeaf7d8dca
MD5 57e5b9619f189fbaf9af16ffe23df882
SHA1 ee248d8f0db8610b311f3023ac52b363aeb39a83
SHA512 63d9880e88b9b94ba280561404fdb4e4b965a7fb67f9835bc13d8be08f7d6a5a643bb96a65aac8544098125a09a9b4b43b724a7a45be5830314db7ef0d20227c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4820ab9625195cba426782637596f92715d6ece49297f21695adac2cc30617e8
MD5 240cdb736820f2ab2bf3062ba338c3ae
SHA1 7b0581cfb205907934ae960f1884a07c79d8b00e
SHA512 435cbbfec2b572bbcd2c345eef3684a229014ec02d786483eb38547da2cc0d1f363ff26fc7969f9ea6362e6f3e49cb750fb912a65431151b1371920c37ae0648
TLSH
T14CA0021041C00473CD554270F0B16D8662A14C1A1955434398E32848985B6C1C119500
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 321c14de8ac915411d1aeeeb7954e687fdf0fd4edab1715351c380dac126c3fc
MD5 8b0e045f69d397be623a3b2d3dc939ad
SHA1 16f80ebd7f062a75bcc5ea6e696a7d7f3dde55c6
SHA512 a3432525a00533805579ff9ea85afd8166a213eea5d57c95a8653a74928dd472330c1366882f958d4f5c03b4f3d83d8b79d23243fa5041d7d8e7deea043601fd
SSDEEP 3072:0ioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gB:0iwfOqi+91Nd3it2C
TLSH
T1FBD31277CC546FBD94EA6CCD72526856CD808AAFA914A34D11FA3E831109BD8E313CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bd531f802eb4d7b435257e3459f461cdf5dc25d9e6fea3e67d5a964caf91e5e2
MD5 2521eb61c65acc964cfea570d29c9517
SHA1 fc1d5a3a5713d023529c8a986716ddde5c45e635
SHA512 c3cf86ea6ac2ede91bce372d66880b0dcdced427c57f21ce67225b7a48f7509b29231a07d0671d22a3784a220ee4735f640f9e7a067c7bbf694d7ca274a5a4cc
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5R4DKB6vGyvk54EfTboRYv4a:5C0Ngjf5ZKSNqDUDQa7qEfTbog
TLSH
T127A1F8B1A4694EB7A4B6C5CDB1436B43DEA461A7E561EF84E9DC1F0C00FB1E91382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 eaed1a5b298ac2cfe2c4689c09f91816cd2d070ce804974fe9ba1898ffaf3b7c
MD5 fe8d345a1676855d77a7c70edc64e40a
SHA1 ac97d552fdac7de63b97b98c275b7f373b0c3b1e
SHA512 07bb7631a10d553cb53d1ffca2d0f0b5d539c1ba9029993d12229ca4521a426f1bd6b5c29f28dc7d2f1010e81c14d683812ca590b91d071662869eb6231644dd
SSDEEP 3072:NDioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gB:NDiwfOqi+91Nd3it2C
TLSH
T1ACD313B7CC546F7DD0EE69CDB2672856C5408BAB6410D38A42FB6E872109BD4E3138B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 11c5d7db26d836f56cfe82d571804d26094b5f912f366a2581717bc16d9926c0
MD5 7325ac2d53a941a0c6527ce1194e1cd7
SHA1 865429217be5503e3dce73f64b65cb046310c08f
SHA512 d12e28f276262f08f708eee1d3dc9afb19ebc4f85fdb4f4c237353276c91a11d9767c5de6a3c906493e2cc291b49d8afcc6b2cd9dbdc00243838988e61480a35
SSDEEP 3072:oDioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gB:oDiwfOqi+91Nd3it2C
TLSH
T1A4D313B7CC546F7DD0EE69CDB2572856C5408BAB6410D38A42FB6E872109BD4E3138B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4232_2072368140\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download