d136984b2935ad351b0cc7939b375dc902f627cbae75f81fa0d331b28ffb52ca

Resubmissions

20/08/2026, 12:37

260820-ptrq1azzas3

20/08/2026, 12:26

260820-pmn2jadd448

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-07-02 132359.png
Size 37KB
Sample260820-ptrq1azzas
SHA256 d136984b2935ad351b0cc7939b375dc902f627cbae75f81fa0d331b28ffb52ca
MD5 b2b181318ae27c03eb90071083b51a74
SHA1 26eb7853c05d10fd0b7f02dbee81becd6319650a
SHA512 7c1623cc8b83f3eb1cd83dfcec7da4165d0befbb50d441800030e738bfafa4a6d05882721f43ee06f2560fa85af471b0697dd8a86a8256fca4bf58a97cd5f8d3
SSDEEP 768:bfowD0ea1HvaTwpDptLUDUmmJ2cD0pOm/Hy0hrjeY:bEdaQjJ2SZmPyEfL
TLSH
T1BA03F1F63399CAEAFE01C3C551DC62E681B312C8DD6A1A5DA5B91A4518CCF384873EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4456	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317030810320108"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3116	mspaint.exe
3116	mspaint.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe
Token: SeShutdownPrivilege	1532	chrome.exe
Token: SeCreatePagefilePrivilege	1532	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe
1532	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3116	mspaint.exe
3116	mspaint.exe
3116	mspaint.exe
3116	mspaint.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3800	1532	chrome.exe	94
PID 1532 wrote to memory of 4240	1532	chrome.exe	95
PID 1532 wrote to memory of 4240	1532	chrome.exe	95
PID 1532 wrote to memory of 4456	1532	chrome.exe	96
PID 1532 wrote to memory of 4156	1532	chrome.exe	98
PID 1532 wrote to memory of 4156	1532	chrome.exe	98
PID 1532 wrote to memory of 1456	1532	chrome.exe	99
PID 1532 wrote to memory of 1456	1532	chrome.exe	99
PID 1532 wrote to memory of 1688	1532	chrome.exe	100
PID 1532 wrote to memory of 1688	1532	chrome.exe	100
PID 1532 wrote to memory of 1932	1532	chrome.exe	101
PID 1532 wrote to memory of 1932	1532	chrome.exe	101
PID 1532 wrote to memory of 1892	1532	chrome.exe	102
PID 1532 wrote to memory of 1892	1532	chrome.exe	102
PID 1532 wrote to memory of 1312	1532	chrome.exe	103
PID 1532 wrote to memory of 5912	1532	chrome.exe	104
PID 1532 wrote to memory of 2548	1532	chrome.exe	105
PID 1532 wrote to memory of 5912	1532	chrome.exe	104
PID 1532 wrote to memory of 2548	1532	chrome.exe	105
PID 1532 wrote to memory of 4296	1532	chrome.exe	109
PID 1532 wrote to memory of 1696	1532	chrome.exe	110
PID 1532 wrote to memory of 4296	1532	chrome.exe	109
PID 1532 wrote to memory of 1696	1532	chrome.exe	110
PID 1532 wrote to memory of 2920	1532	chrome.exe	111
PID 1532 wrote to memory of 2920	1532	chrome.exe	111
PID 1532 wrote to memory of 4524	1532	chrome.exe	112
PID 1532 wrote to memory of 4108	1532	chrome.exe	113
PID 1532 wrote to memory of 3328	1532	chrome.exe	114
PID 1532 wrote to memory of 4524	1532	chrome.exe	112
PID 1532 wrote to memory of 4108	1532	chrome.exe	113
PID 1532 wrote to memory of 3328	1532	chrome.exe	114
PID 1532 wrote to memory of 1808	1532	chrome.exe	116
PID 1532 wrote to memory of 1908	1532	chrome.exe	115
PID 1532 wrote to memory of 1808	1532	chrome.exe	116
PID 1532 wrote to memory of 2632	1532	chrome.exe	117
PID 1532 wrote to memory of 1908	1532	chrome.exe	115
PID 1532 wrote to memory of 2632	1532	chrome.exe	117
PID 1532 wrote to memory of 5752	1532	chrome.exe	119
PID 1532 wrote to memory of 2832	1532	chrome.exe	118
PID 1532 wrote to memory of 5752	1532	chrome.exe	119
PID 1532 wrote to memory of 2832	1532	chrome.exe	118
PID 1532 wrote to memory of 3412	1532	chrome.exe	120
PID 1532 wrote to memory of 3412	1532	chrome.exe	120
PID 1532 wrote to memory of 5912	1532	chrome.exe	121
PID 1532 wrote to memory of 5912	1532	chrome.exe	121
PID 1532 wrote to memory of 1080	1532	chrome.exe	123
PID 1532 wrote to memory of 3084	1532	chrome.exe	124
PID 1532 wrote to memory of 5992	1532	chrome.exe	125
PID 1532 wrote to memory of 4988	1532	chrome.exe	126
PID 1532 wrote to memory of 3468	1532	chrome.exe	127
PID 1532 wrote to memory of 3468	1532	chrome.exe	127
PID 1532 wrote to memory of 4504	1532	chrome.exe	128
PID 1532 wrote to memory of 4504	1532	chrome.exe	128
PID 1532 wrote to memory of 2760	1532	chrome.exe	129
PID 1532 wrote to memory of 2760	1532	chrome.exe	129

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-07-02 132359.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe5216c728,0x7ffe5216c734,0x7ffe5216c740
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,4284126466862215366,4282695551499858507,262144 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,18021154025440503370,2934327037322516006,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6800255776864209570,9409244929831824463,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,659444653393721317,3034293918456852956,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,516452245520779125,3868162289936875619,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,11852753506658399940,6719471901847494537,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,11181123538039806138,14581209285393206078,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,3102146294899717660,8492041178057672331,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5476,i,14182070943540931632,4192948231871621951,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,10877749715338028000,11782838050748863528,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,4095522341502431556,9439645149037971356,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,2377852054307269230,4156341286838115124,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5932,i,10404006618708436307,6519221110776757066,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5496,i,7876694924059030284,8569846364812906593,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,6436316346508340518,5235082852679808494,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5376,i,2482568638149696099,10417150966089345367,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6180,i,13184054607862181261,13023404106207015384,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,2816948249698467027,7252503476495867714,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5532,i,13891819042839740037,4729951310158830386,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5488,i,4220681802509767458,9008999397978270476,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5596,i,13621092167116228038,4077224354957552476,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:9
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5400,i,11886121600514182138,9856469303087917367,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5424,i,15610239577524130399,10286299248791634038,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,16232537549567982860,5801032922610521034,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,16960434655938952769,17776045430608185922,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4448,i,16458290901616991608,138609635405493309,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6508,i,18339787384028426009,11398010589554246202,262144 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4600,i,4748573036695269252,10382980398664933121,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6508,i,2173468594083190540,3160951837715259780,2097152 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,3530766004128032108,9240716250613431511,524288 --field-trial-handle=1964,i,5309374457232800048,4604879131798302362,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14
  2⤵
  PID:2760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cdc4fc4b87f852719195ae3d8a0d1e4ed771a71e7b694f369180bd4879525369
MD5 bd39089aa1d269880970afbb4a3b5919
SHA1 d309ad4a81bb740f8543c4e24c932e3f6f33ecee
SHA512 35aebdc30dadca64bbd49027de1c4d7a18c5e63f685933f2020727799c6c3b957d5e9a916c266a6045768cecd809c5544d6880c1f2a980c034f5f33fc36dd3d8
TLSH
T1A95184DAD22C190DEF1E9DF1FCD507A775368E29642B3F43468BC1385DA67C6B201180
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a4c024a3f992f9274b331c6cd950799b5f68f2a33a1df97980bf3bd163741542
MD5 6c230e53582bb4615cdfce1b588ad8e4
SHA1 f9fd2def7ec62bd13b2b60b1ac0f79dc349c352e
SHA512 a24bdd812e7a16401346e95f33152fdceda14537a448a827c836dbed1fe9263ace0c926dca964427c3dfc3d8a974124e9d100a0e7318fa6f299c59cc5f5f5fed
TLSH
T1D5219BF7C3D8A63D894156F4A7166F1BCE690D18431C3C67C8D4AE1B97E1871D20015F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d0fe51b60b1e73ae17650abaa4e0df89b13f678bbc1b8664152639927517c085
MD5 ab1a852e3dc18547b51d430d4455dcb4
SHA1 500e5a55af0cd5d58eba4ce98b88ee07dfd2cfdb
SHA512 237bd1d6e069cf45a631861bdcbeda05e3a32867f3f9c7896b350cc13272bf95de73588da593909edaef527c2e5a94b113a4ecc98a23950f8e65220a80ef0962
TLSH
T19481AEF787E5956D8A1156F0EB14AE1FCE290A14431D3C6AC8E4BF5B93E2872E20135E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2107810df347cc36549262696126ae8335de61e003c1af94d3f5f70a189e47f1
MD5 11afab3b0e085b8c7cb8beca509b72f0
SHA1 a170cf943db215a6edd4a962ddfcee2f58a9cdfa
SHA512 99c3a79aeb6251098488d176cb7cb69d33e9eb92ebcbd176a17cb9fcde30fb95acb2086a63ff415dc3343dbf2f90b1ee656e63e2d442cca16e2758733277d72f
SSDEEP 192:nRqLsY6Iv7LAPRp2b9rHsb+WNnzJ0sY2kAv7HLaIG4VyIsnAUge:nRqLsvUKXw5w90h2kATraTce
TLSH
T1E042C72EA9257D7B6DDBD229F9257B53D3F6202131D42E84EAFC892C15E75CC221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 35a575046133e0ca3bef10ec2aaced03be8b0fad889ab9a74748e18d6519d8bf
MD5 d8e4be1cd7baed012bc8a1102213924e
SHA1 ab4b0013bed8122c2b78566397928836f4149874
SHA512 bb8748bc49ae5259dc2b68b4178f1bd041e21e65bf1d8e3e1f25b906e515b912c9b76d2964a2744fe276447bb7b6dd629ebf2b627d24bdfd906afae2b3f88b2d
SSDEEP 192:nRqLsYJev7LFQPRpgBAyF9rHsb+WNnzJvsre4Y2kAv7HLaIJ4VyIsnAUgE:nRqLs8aNyXgt5w9oet2kATraWcE
TLSH
T13B52D82AA8253D7B5DDBD269F9257B67E3F6203125D02E84EBFC892C15E75CC221B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eea4ab60b0136d96c0a3827cc268155115fc55332c4b0c793e902c45ccec12a7
MD5 04e85e81ec900d6f6f94b9106077f56a
SHA1 03ef63eb392b4738b4ea5e5e054a04b13e585e7e
SHA512 e931b610c917f403bfdb97a8b2ece244d5a9a68e0bad974229ee95d39550c0af7654653dbefefea1c26355a9960fdb65739211f94cebf9e97812bf630ca57260
SSDEEP 192:nRqLsYJIv7LAPRp2AyiS9rHsb+WNnzJvRX2KY2kAv7HLaIG4VyIsnAUge:nRqLs8UKXdS5w9p2r2kATraTce
TLSH
T12642D62AA9253D7B5DDBD229FA257763D3F6203135D42E84EAFC892C11E75CC221B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c833b8980b7f500e68a323c77618a783da3397ec0f43a72c90478c38ca4ccc25
MD5 2e887956fc040fabcb3911badfa6aa72
SHA1 40c8ba36a86fd1ae7d5e990574105f895d71221a
SHA512 f669f1b96bd64dac4312cd68a8191b08d41e2037b27369dc6dfeda2b04c6d9ab8c22e4dd7fc79ba09103f2f783a7339c0299d5bc2ae24605ea1defc310bfd9f4
SSDEEP 192:FRqLsYJjv7MFQPRpgBAyF9rHsb+WNnXvvgkYiY2kAv7HLaIJ4VyIsnAUgE:FRqLs8bGyXgt5wfbYz2kATraWcE
TLSH
T1EE52E92AA8253D7B5DDBD269F9557B67E3F6203121D02E84EBFC8A2C11E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7639675b135625ca6ee2ecadbf3a22e3f1d4c9c56d4fbc40511abf2b84a50521
MD5 47e29ee073f145fc2bd794badee32646
SHA1 1180adb67c1e532f05a5fd81b82c3891e2176cbb
SHA512 1bed61d2107ca43bf08576b05ee4038c9069237cac4be5d84a1a6416fee933ad7f863897aa5753ed83c844de83bf3c776fd624756165de6557e10b85a4b6d5a2
SSDEEP 192:KRqLsYJFv74FQPRpgBAyF9rHsb+WNnIh+sre1Y2kAv7HLaIJ4VyIsnAUgE:KRqLs81iyXgt5wEteK2kATraWcE
TLSH
T16952D82AA8253D7B5DDBD269F9257B67E3F6203125D02E84EBFC892C11E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ba9ae39254f4d06463d616c52fd1083f535cbd03c94a15608ac5a375d56180c5
MD5 a56d209236b67bc6ccd82f10e419691c
SHA1 757d72e95f6e109ee143e90b1e18a4e7e38afbee
SHA512 e99d4de81b36c799ea1923070d14bbd8ebfc1d09b8e11eb815f97a7ad09306ce83e0a7da432c3ca9e0328f701a05372c053e4da8da264b130145e2e809546f8b
SSDEEP 192:nRqLsYJwav7LAPRp2AyF9rHsb+WNnzJvsreAY2kAv7HLaIN4VyIsnAUgE:nRqLs8w2KXG5w9oel2kATrakcE
TLSH
T10E42D82AA9253D7B5DDBD229FA257757E3F6203125D42E84EBFC892C11E75CC221B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 03bb04080e88686991fb35e9f80be3b25c85ba1f04c6679ff042e6cf770b1276
MD5 2ffb04732480614b4a2a96ab055ea84d
SHA1 ec52283fc7921ab34b6da3915397a4b7d84782ba
SHA512 f24404b91c6edfafe6d8d264ea78167b56acc9dffbbf70c821cdc1203799caa619980d1501dd6853e31ca0ab484b238a7a897a6d7760c6b0d542b7f65d503f7e
SSDEEP 384:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsXODzi+ErU3Y/HGm2GrTu:vVzm7KxkXqKf/pUZNCgVLH2Hfgsr+OXv
TLSH
T1A2520967644E9A7B0FD8D65CDC12BF8FADF5014662A40D2892FBAC0903D57DB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 646ce812fe804a8bcacd8c05557115a46da31a1935e47bfe45f35bd8989c28f8
MD5 8e4a869e79e098ab9652421fed59e0e0
SHA1 dc517360fc6615ba05df136554f424fc77a0914b
SHA512 710cbe648bbf5fc699d22f7bf3ca77c1f17cda0ddf4721e06eb301fbe7e89745a8393f66d1276f8eaf9911e0450ef9ef5976d2387ca04d7516628a6cfad6a9aa
TLSH
T167A00214C6C44451DF1882B160A2054762765C1865F18F4756D224449E6F2D05511211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5995dd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5995dd.TMP
Size 48B
SHA256 4fe2ee7ca743b7af227e877987ce1fdc5f0eacfb82f9e1253bd3179b6e9db0d9
MD5 ee6f6e1185f90e3b9abb1b7ca3e42e50
SHA1 eefc091299c5703694f8f845fe025c1a6afd9194
SHA512 def2454ee07ad95bf57020ca0b55c7d196c4ba592a035f0164d8f423849ff2d7d5d166b60414426f99727b8c0f0be825c97346f726bb2015425e7e48d8493dbe
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59b164.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe59b164.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 28c6731c98fdaa66bb37a67ef9b05c86a92a28927c636decbe6eb22295436044
MD5 2e9c8b3e15333d6e846cab4808167d92
SHA1 485cb68224a90ae786142868929bf7e4d5dbef01
SHA512 1f00c15df60a40cc004123bff86da1a78fb21373b3321854d090dfe6fc2207e1286e3e5617003e8f81e482bf78d1bb7eb38c92a1a2b4cf1f0f535ffee70ca89a
SSDEEP 3072:QjmVl7DLFoKGNcZmQz9oEmsp3jaMhOCPll4g/tmcecW+X:QjwZLFuAXBoEmA3+eOE4iYceS
TLSH
T106D312B7EA04DE31EBF4659DB0AB2B0FD61C7B1BD598846CFA847D8941158E8270F2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 6f7b703c1358434245de04f028721061fd5c2425fe30e60d18c56c6bd0a80098
MD5 abf71e0e35fa6819e2cbfd4f98fe652c
SHA1 d64e23800abb45effb34cde6755ff700c0936ba4
SHA512 d407d6de6ebe343d2b241fe304edd10bb956a99ff5fd10fd5d58637b0f8fca85038b34bf27834b04c3a01a2b8beba7a7291c2615b7c3c9bb4d792f4c622c8feb
SSDEEP 3072:QKVl7DLFoKGNcZmQz9oEmsp3jaMhOCPll4g/tmcecW+X:QcZLFuAXBoEmA3+eOE4iYceS
TLSH
T18BD312A7EB04DF31FBB86299F0EF1B4FE21D6B1AA5D84478DB806D8541249E4334B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 9e624a385bf8d6f408e789ca30bf5c2546f2872321ac843c57a2343909d4f9ff
MD5 3754fffed1688018009fda6fd4d4d6c0
SHA1 2cac2715dd9660fd9c64ebfbffd87a0516fd2d79
SHA512 2c76b90f07cb59523258eea3c3fd340df68fbc8b1b4a18a73a71c6896fee19dcdcf5ff6a29a484d7ef230ff5ad4fe8fd3f79848c902fe0cb76e8137ac1b98735
SSDEEP 3072:fKVl7DLFoKGNcZmQz9oEmsp3jaMhOCPll4g/tmcecW+X:fcZLFuAXBoEmA3+eOE4iYceS
TLSH
T11AD312A7EB44DF31FBB86299F0EF1B4FE21D6F1AA5D84478DA806D8541249E4334B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 181730e314c8805aa1a5b88229ff38b6b943d0cea4a0671445c35eec42722082
MD5 b9d3e2a0af56c75a4eee721539a293c4
SHA1 2f1b8d01c17f1b30f1561cc325a687fc02b45b5f
SHA512 ef254510e0f2ef50c8884280b3de3246ed05c00293784ff40fecaf372dab67da220c89d09c5e2428ad8174623a8622a71c156456608e4f03c5a075401a3373bc
SSDEEP 3072:QimVl7DLFoKGNcZmQz9oEmsp3jaMhOCPll4g/tmcecW+X:QiwZLFuAXBoEmA3+eOE4iYceS
TLSH
T104D312B7EA04DE31EBF4659DB0AB2B0FD61C7B1BD598846CFA847D8941158E8270F2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 31f1b8700e3afa39f8dab3cfa8f89ca2afbf6ddebc397fe1cbd30d59aad1d7ac
MD5 bfa50df281e8722adac7d6af8a1930b5
SHA1 d4ab45f3d68725b76e9b6e35d282e0576651878a
SHA512 45783de672991d0f86ca19d43ecc8197a83ec2c144ba08c09ef163ced6186e30541d7c24c5350f8daccb54e24b10c77f5ddfe0c72f2cd8606ea40db4ed1b22a1
SSDEEP 3072:EimVl7DLFoKGNcZmQz9oEmsp3jaMhOCPll4g/tmcecW+X:EiwZLFuAXBoEmA3+eOE4iYceS
TLSH
T102D312B7EA04DE31EBB5659DB0EB2B0FD61C7B1BD588846CFA847D8941158E8270F2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 38c126aa8fa627081a96247d0d039d2747230861fff456c047709d954cae1ac9
MD5 cfe3b5ede4cc8ccf1d2e73c60dc018af
SHA1 0d7d485ceda9ebbb7b4207a5f10ddd14e8f4842f
SHA512 7b26dd47d587bf132531ff26770e96999a68b55ad7c984c260fe71cf2d8a6d81c4425d9a2e3553b54db75ab70767ff60c1d33b4a24d1899b4380c287b546c5cd
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5iFADrB6xGyv4YR5gCEObETev7:TC0cTkJaRZi/CF2lIDUDu2VZIR5gtObV
TLSH
T17BA13B32646A9DB76976D989B4423A43CFBD722B7950AE84E9DD1E0C19FB0EC1342027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 e0b4a8c94e7424f0a93c95b5c599099e615f00f27e4505cc28df5adfa75d5b23
MD5 0d6c43bd4e5c5f60777213e344a3f54b
SHA1 10396c3c6a8c0633b34f7b90c6864102db9a51ca
SHA512 8b05dbb96a0842be614ed0179a5c6acb7a2cfcc64a9b42363013e0ab0fc175b5898600344f546713821720dd089b8d053c0e0d3c2b84408bc395acc00f6a2eb3
SSDEEP 3072:EdmVl7DLFoKGNcZmQz9oEmsp3jaMhOCPll4g/tmcecW+X:EdwZLFuAXBoEmA3+eOE4iYceS
TLSH
T1EFD312B7EA04DE31EBB5659DB0EB2B0FD61C7B1BD588846CFA847D8941158E8270F2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1532_1186657390\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download