8c040dfa81118b136e0828938328bb910f9c2c5d806e056dc527f8ff5d1fe97f

Resubmissions

18/08/2026, 03:12

260818-dp72mswtb16

18/08/2026, 03:06

260818-dlxrhadl4y8

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dopamina Rust Project Customer/Dopamina Rust Project/Dopamina Rust Project/Src/Main.js
Size 2KB
Sample260818-dp72mswtb1
SHA256 8c040dfa81118b136e0828938328bb910f9c2c5d806e056dc527f8ff5d1fe97f
MD5 dcfb66855ce4fa7aebd501676cb80456
SHA1 f8929e691d2ac69fa6cc0c52ff7f9ad6b5d1387f
SHA512 2a55e447d1830039da7ccbac11df2a381c12b6ca1240cd1ddbbf37535cdd5b503591c7e4e31790fefd12f0e8ce8291ea20969b2189011c007049fc54b43fee61
TLSH
T1CF512E018DEB40E3417B441677677BC07969C26F0705CD3039DE63969F8C4A9B82FAEA
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5684	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314963442511099"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 5988	5972	chrome.exe	90
PID 5972 wrote to memory of 4764	5972	chrome.exe	91
PID 5972 wrote to memory of 4764	5972	chrome.exe	91
PID 5972 wrote to memory of 5684	5972	chrome.exe	92
PID 5972 wrote to memory of 3852	5972	chrome.exe	93
PID 5972 wrote to memory of 3852	5972	chrome.exe	93
PID 5972 wrote to memory of 4660	5972	chrome.exe	95
PID 5972 wrote to memory of 2388	5972	chrome.exe	96
PID 5972 wrote to memory of 4660	5972	chrome.exe	95
PID 5972 wrote to memory of 2388	5972	chrome.exe	96
PID 5972 wrote to memory of 6140	5972	chrome.exe	97
PID 5972 wrote to memory of 6140	5972	chrome.exe	97
PID 5972 wrote to memory of 1084	5972	chrome.exe	98
PID 5972 wrote to memory of 1084	5972	chrome.exe	98
PID 5972 wrote to memory of 4768	5972	chrome.exe	99
PID 5972 wrote to memory of 6088	5972	chrome.exe	101
PID 5972 wrote to memory of 4664	5972	chrome.exe	100
PID 5972 wrote to memory of 6088	5972	chrome.exe	101
PID 5972 wrote to memory of 4664	5972	chrome.exe	100
PID 5972 wrote to memory of 5472	5972	chrome.exe	105
PID 5972 wrote to memory of 5472	5972	chrome.exe	105
PID 5972 wrote to memory of 4920	5972	chrome.exe	107
PID 5972 wrote to memory of 4920	5972	chrome.exe	107
PID 5972 wrote to memory of 3660	5972	chrome.exe	106
PID 5972 wrote to memory of 3660	5972	chrome.exe	106
PID 5972 wrote to memory of 3452	5972	chrome.exe	108
PID 5972 wrote to memory of 5672	5972	chrome.exe	109
PID 5972 wrote to memory of 3452	5972	chrome.exe	108
PID 5972 wrote to memory of 5672	5972	chrome.exe	109
PID 5972 wrote to memory of 2456	5972	chrome.exe	110
PID 5972 wrote to memory of 2456	5972	chrome.exe	110
PID 5972 wrote to memory of 2960	5972	chrome.exe	111
PID 5972 wrote to memory of 2960	5972	chrome.exe	111
PID 5972 wrote to memory of 5764	5972	chrome.exe	113
PID 5972 wrote to memory of 5764	5972	chrome.exe	113
PID 5972 wrote to memory of 1248	5972	chrome.exe	112
PID 5972 wrote to memory of 1248	5972	chrome.exe	112
PID 5972 wrote to memory of 460	5972	chrome.exe	114
PID 5972 wrote to memory of 460	5972	chrome.exe	114
PID 5972 wrote to memory of 5452	5972	chrome.exe	115
PID 5972 wrote to memory of 5452	5972	chrome.exe	115
PID 5972 wrote to memory of 4296	5972	chrome.exe	116
PID 5972 wrote to memory of 4296	5972	chrome.exe	116
PID 5972 wrote to memory of 2452	5972	chrome.exe	117
PID 5972 wrote to memory of 2452	5972	chrome.exe	117
PID 5972 wrote to memory of 6108	5972	chrome.exe	119
PID 5972 wrote to memory of 5448	5972	chrome.exe	120
PID 5972 wrote to memory of 5832	5972	chrome.exe	121
PID 5972 wrote to memory of 4736	5972	chrome.exe	122

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Dopamina Rust Project Customer\Dopamina Rust Project\Dopamina Rust Project\Src\Main.js"
1⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7fff2f6cc728,0x7fff2f6cc734,0x7fff2f6cc740
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,3951000862857958430,17214881662940807342,262144 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,15664995464177115114,816843938444971899,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,13185744390770139270,17352080843114600559,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,14048963304122096465,12492066563506247945,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,6190249973856537085,10119941568556333454,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,9710367646792188983,16951309508669473024,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,297963670970609597,3635296911279776942,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,15768512811974901355,6090809745880188485,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,3594690100609500974,16929653378499867380,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,726217157861320751,14712316519252495513,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,10124125854082804884,14430576480105244961,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,8850936036128998830,80866990180533726,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6040,i,16422280895407841925,6024173159670858518,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5996,i,17786389365381294486,15432650194792746764,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5732,i,148744429001489291,17791704336597890155,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,15757990966282988377,8748111553248046229,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,916207815512920012,1617327272168807831,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6128,i,14212477649091399739,6852236548722504033,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5768,i,10312660851723254101,18161287922698486583,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6076,i,2325314528643526086,12065142974086526282,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:9
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6128,i,13154175761933202665,434038738262464149,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5500,i,13584595160322880532,1329035833106992385,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6136,i,2003467816655239980,17553516635038941707,2097152 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,46533158124823926,2370597285767137228,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,16303736572693628357,17316732118318467490,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,4078804681527247168,5703321633914002076,524288 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5928,i,15082259953909793156,15753309142038613515,262144 --field-trial-handle=1836,i,7692984506995263489,15989859703663187669,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 e404f0f8278c7470ef9e7d3b3d1bf993729f976aa26b6613d294b7f8f0561068
MD5 fc56b5635ba0f31e9d7378a2436ed90a
SHA1 4b9993746a3c59d1a2e7cdae4f8b50d9c5df5cb4
SHA512 6db6eea621ca3e5f999a6f6f504ba2a6f355fbe4fcef018ee44fd0ab5d26735b06f6091efb5f2150cb05024789202228b4c4781f2d7d5717794e959937b93053
TLSH
T135B011A023E0880ACFA8023820A20C0222208BB382220282A2A000B888232A0B08CA00
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c8ec1de0e4f05f43d666e770a5571f189b453100e41036e6f35d0a4e21e18646
MD5 5160c044ad57dcaf23bf6ac3d5039d21
SHA1 26066c049ded9625ed51b2c5745fee7eb7e3c570
SHA512 d9616129c3a551cea52c458eb0526bf9f45d62b1fb33c9fe6bfb298feeb2f1034cd1ed8227e9ae365be97fe98a87ef7eaf3bc2a52bad2bbf3b5a2bbeda06c4d3
TLSH
T187519DF7D3E48A7DC51152F4AB206E1FCE290A18531C3D52C8E4EE1B53E2972D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9f6ce0e65d744b25bc774243ab029305bfcf5d7adc4ff1d26b37fb719786b192
MD5 6ab55a58f91a5ecc642425b2ca19bc4a
SHA1 4be819cfa9b3e8b102531b3b2b72ae4a780815b6
SHA512 6195b5265c40ad2a91e9c308e0cdc173fb0cd7a7b0b5d7d8d37c0ad7b75cf5decebf6ff00569f61513f9ccb697279916e05987aa6937196a13f7b012c0426764
SSDEEP 192:wRXlCRHv7dAPRp23898Hsb+WNnpmtax24O2+OJaAVyIsnAUgE:wRXlqPsX3uwQG2T2+ZEE
TLSH
T18042B52EBA5479BB5CDBD229F9217B53E7F5102161D42E84EBFC8A2C15E79CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b1d5886e251b886ba80d24515079b451f1a8ab4b15d15bd8c9e7c1509b6a3101
MD5 0c2011fc518db82856554322a3c6433c
SHA1 403f8ff064fece03a527516bdeaa2354ef4f8253
SHA512 130748cad742014b361daf26b292a6bab679710be36e3876a4753e8d91c73dd0779afe030f690c32cc68377ff1e9da605d13529c9de37c49d02fdd465c6cea7f
SSDEEP 192:wRXlCRmv7dXPRpj3898Hsb+WNnpmtax2vO2+OJmAVyIsnAUgE:wRXlqShXYuwQG2G2+rEE
TLSH
T18542B62EBA5479BB5CDBD229F9217B53E7F5102161942E84EBFC8A2C15F79CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 82ff3cfb93d3b867b23ea9d866f2708aa30363a3f0f30e5f75d06fd071bf2083
MD5 4fd998f0056bcf87ff3debc2f6dc62da
SHA1 4b0dbd269edacc630e8b8f0403aeee954c9549eb
SHA512 f03b0e3ca989a3ae0e0c02ac503883f3c4832ab701df11cea3cd6f790c88dba989a11d271f3143391e8f2254caddb1c59ec829a5d23c4f730307889e938d2be7
SSDEEP 192:wRXlCRCv7dAPRp2l98Hsb+WNnpm0SO2+OJ0AVyIsnAUge:wRXlqOsXauwQ0R2+TEe
TLSH
T17F42B52EBA5479BB5CDBD229F9217B43D7F5102161D42E84EBFC8A2C15E79CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 e05ed8401324a16d1e2b10d6ae503ae4267c05c9f7d4c2c3e3ab10cb569ff294
MD5 1efee33874a49ecbdcdcc577ec4c5f8f
SHA1 6d48e37c28dc63624c5065eef7a7b8a785e4cf63
SHA512 3e88ce28565300534cd18258d9c3a2394868acdca8b36900dd45bceac2fd225a94ef9f68887dd6ae02f886cb962a70f20c59f1937d8c7003c1b483da2c8f2399
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3kzHG8t2r/dgD:MKm97KxkXqKf/pUZNCgVLH2HfgsLROq5
TLSH
T1E552F867688D9A7B0FD8C98CDC176F8FACB5015662780D2456FB5D0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9e0e9b10faa6c2de2a98fbb5f0558a196f23df5800aedaa1b2dd53705951e72b
MD5 afd48cf8592f603bc1969299aa9a0cc4
SHA1 0c45d416cdb96681851ded79e0a8a837434a48e3
SHA512 036276d88f5188d016950fed3360ed562cbe910b454b16dd31e948a27afeda482e62a097c88e2b72daa11d97eaf6cdf2f036772b5e8dacd98503b427a1f825f0
TLSH
T11AB0120080865551C8C041B021855C8A71124F228400160283D0578998470E41113154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 da4d0c7c3c3cdc43232a35c543deac232a88695a35e32db4713afd546eb88269
MD5 fc7c7b62603e28977f1f73720d16ee1f
SHA1 0699616b51f4822b6f47eb3fcf5c48b58f3fed98
SHA512 4c5e5e6d419b1da54cc1d31459dc607bb5af5c52df2bf94ec5b6393eb8ce4a39d1d2b3519b31b8e1fbf706ece1ddc7a0410800f2aa746a525bf1542bc51813de
TLSH
T1A0A0029091C1492DCF254775647255812252AC7796565313659119A8895B1D4511F101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf3f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59bf3f.TMP
Size 48B
SHA256 495b26e08120cfd3dd777ea563730b8255f6fe3e441434b33edd2a6f5d25bb04
MD5 a32f978b80e4301ddc111224debcd0ae
SHA1 a9e062816cbc9dcea8a855f6b301ba4c767071f3
SHA512 d136ee9053731bae4015701ec09496ceb66b15408fa9317e296d93b4f54c1d9aeee769e28bc6fdb7682bf1d471e33b600f87dc3389ce4ae377019079962e3584
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 164KB
SHA256 b73d7b17cd59875d000d0ff29bee1d5eb788dbcce5cc67bdc65038a3dbac3dc4
MD5 dc9a31d38c7e922cc3e09268057c8551
SHA1 a385e2d985f0dc06c76b20f8360704e307fef209
SHA512 fa4c1ff20fd6ab4b50a6554246927569387b8c5dadabb86ec6cb6070a8c75d1a15f6fb32bfb389c3333c7501a8f657217a7b754e8427fdef6c605e30bcacb867
SSDEEP 3072:StEiESzhsq0ATY+NG9DfV7RNi4WPhWZwmLYnkI+vHsqPchYph97wO0hECA:StTzhsqZMSyz5RNi4KWZwmMkI+fs6QgD
TLSH
T175F312A39D970CBB6E35F78AE817B6091E94A2434758BD110CB5BB0D019BDCCC79BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 b10888737d2d90fa262f53f59773ae75437775603ad7ec5cc51418ab15f58bd0
MD5 c7470674bcc07fa4e8573caff712bfa4
SHA1 4f10288230324ca2b97f792c4d1ae64b37d5b42d
SHA512 119eb0dffc9af99b765d5a0f539bcdc6425d84cb4d214abe14922d81c1113f3c7ec0e03adfd9ea030c7a31c0f95cebc102b1839a93a53adf5f6db4f406459e2b
SSDEEP 3072:G9DfV7RNi4WPhWZwmLYnkI+vHsqPchYph97wO0hECA:yz5RNi4KWZwmMkI+fs6QgwO0JA
TLSH
T165D312C3DE654C7BC936F68BE45771092A24A2434358BE010EF9B61D46D3DEC838EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9df7ef667cd1b4197313e397ea0f30bb0249b5b8d7ecde1aa6daf85503393cea
MD5 13d9e311a58037469d00608b1fd163f8
SHA1 423cb4df680d776616a5068365da7a8a42d6cb86
SHA512 721d32d82e6677a8ea55e2961c15c947ba1574222822b942d6761aa65b7b6e77538c4a1708eff566f8d32dd4b9235a6341b87db5d25e7fe5d38ca4696fc76161
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok51HDvB6eGyvkonvob1v4a:MC0HJm5FHuPgXDUDNZW8nvobZ
TLSH
T14FA12AB1A4A94CB759B7D645F8822A83DEE4A22769A1EF80D9DD1E0C11F31D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 902379e210ccdd29480512f80db85b45c4337a47cdf78a4d30aab2845fee23d3
MD5 ed9cc4a1e8da463ad1c9c0eaa8d35907
SHA1 03557c82041a0f9984c546fd62454e53e1535d29
SHA512 39c19bda924ad3d7dce96ed4ac7af5ec88294261f9db1bc0da65bdbd23a5345fe7d737f1fdf67a4c2664b31f20fa80dcce3b911d5c139c9c6aafb0f731ffbf7e
SSDEEP 3072:p9DfV7RNi4WPhWZwmLYnkI+vHsqPchYph97wO0hECA:rz5RNi4KWZwmMkI+fs6QgwO0JA
TLSH
T168D312C3DE654C7BC936F68BE45771092A24A2434358BE010EF9BA1D46D3DEC878EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5972_782293380\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download