aac8a410bc1e6b0d9141c2e45dd35324a485a750c6000c0779171f9559fc40f4

Resubmissions

20/08/2026, 18:00

260820-wlk2tasfrd6

20/08/2026, 17:53

20/08/2026, 17:50

20/08/2026, 17:35

20/08/2026, 17:01

20/08/2026, 16:05

Analysis

user interaction
yes
max time kernel
184s
max time network
188s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
minedungeo-fabric-1201-1.0.0-release.jar
Size 4.2MB
Sample260820-wlk2tasfrd
SHA256 aac8a410bc1e6b0d9141c2e45dd35324a485a750c6000c0779171f9559fc40f4
MD5 3b5f3dee33cd49027ce0d345fea36892
SHA1 d5b421e0ac783953e39dc1075acc7cd614553ecb
SHA512 1b7b2ac9a6c8a4c3c3962daca0a1c447ca5f1775e6a38f79416529d143090ed5c3090e3d4768a715e079a8109f41711cce63f7cc314a28bae7ec250047872e86
SSDEEP 98304:ThKiQJuliSX+2NuXoFGpAX7QL9/S71u9xwihfanpXKH0PxJsHaJp:TkfEl1RAogAXC2Sw+Ip6HzA
TLSH
T19626334E9376CCAB9679C6A98616E4513406360DDCE8AFEF41DE1F1E78071BD0CB8326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
42	discord.com
47	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317224929899291"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
6108	chrome.exe
6108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 4156	5760	chrome.exe	92
PID 5760 wrote to memory of 5424	5760	chrome.exe	93
PID 5760 wrote to memory of 5424	5760	chrome.exe	93
PID 5760 wrote to memory of 1784	5760	chrome.exe	94
PID 5760 wrote to memory of 244	5760	chrome.exe	96
PID 5760 wrote to memory of 244	5760	chrome.exe	96
PID 5760 wrote to memory of 3276	5760	chrome.exe	97
PID 5760 wrote to memory of 3276	5760	chrome.exe	97
PID 5760 wrote to memory of 3408	5760	chrome.exe	98
PID 5760 wrote to memory of 3408	5760	chrome.exe	98
PID 5760 wrote to memory of 3400	5760	chrome.exe	99
PID 5760 wrote to memory of 3400	5760	chrome.exe	99
PID 5760 wrote to memory of 2824	5760	chrome.exe	100
PID 5760 wrote to memory of 2824	5760	chrome.exe	100
PID 5760 wrote to memory of 540	5760	chrome.exe	101
PID 5760 wrote to memory of 3136	5760	chrome.exe	103
PID 5760 wrote to memory of 3280	5760	chrome.exe	102
PID 5760 wrote to memory of 3136	5760	chrome.exe	103
PID 5760 wrote to memory of 3280	5760	chrome.exe	102
PID 5760 wrote to memory of 568	5760	chrome.exe	104
PID 5760 wrote to memory of 568	5760	chrome.exe	104
PID 5760 wrote to memory of 2544	5760	chrome.exe	106
PID 5760 wrote to memory of 2544	5760	chrome.exe	106
PID 5760 wrote to memory of 1456	5760	chrome.exe	107
PID 5760 wrote to memory of 1456	5760	chrome.exe	107
PID 5760 wrote to memory of 4852	5760	chrome.exe	108
PID 5760 wrote to memory of 4852	5760	chrome.exe	108
PID 5760 wrote to memory of 1288	5760	chrome.exe	109
PID 5760 wrote to memory of 1288	5760	chrome.exe	109
PID 5760 wrote to memory of 4856	5760	chrome.exe	110
PID 5760 wrote to memory of 4856	5760	chrome.exe	110
PID 5760 wrote to memory of 6020	5760	chrome.exe	113
PID 5760 wrote to memory of 6020	5760	chrome.exe	113
PID 5760 wrote to memory of 4424	5760	chrome.exe	114
PID 5760 wrote to memory of 4424	5760	chrome.exe	114
PID 5760 wrote to memory of 1796	5760	chrome.exe	115
PID 5760 wrote to memory of 1796	5760	chrome.exe	115
PID 5760 wrote to memory of 3896	5760	chrome.exe	116
PID 5760 wrote to memory of 3896	5760	chrome.exe	116
PID 5760 wrote to memory of 5344	5760	chrome.exe	117
PID 5760 wrote to memory of 5344	5760	chrome.exe	117
PID 5760 wrote to memory of 4244	5760	chrome.exe	118
PID 5760 wrote to memory of 4244	5760	chrome.exe	118
PID 5760 wrote to memory of 1580	5760	chrome.exe	119
PID 5760 wrote to memory of 1580	5760	chrome.exe	119
PID 5760 wrote to memory of 2824	5760	chrome.exe	120
PID 5760 wrote to memory of 2824	5760	chrome.exe	120
PID 5760 wrote to memory of 5604	5760	chrome.exe	121
PID 5760 wrote to memory of 5960	5760	chrome.exe	122
PID 5760 wrote to memory of 4444	5760	chrome.exe	123
PID 5760 wrote to memory of 5584	5760	chrome.exe	124
PID 5760 wrote to memory of 6108	5760	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\minedungeo-fabric-1201-1.0.0-release.jar
1⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcca32c728,0x7ffcca32c734,0x7ffcca32c740
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,6417506040579095113,5393983319542891673,262144 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,2760634277943773830,509812158056860319,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,4480206877572341786,10361776967001692485,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:13
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,15229502097645072354,4656163884956225935,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,16323007994483487813,14292166969290271314,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,8503342772872466771,9140338319069634109,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,11818984362274111477,2154642387264271352,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,16988033471967588892,5263937020672810507,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,3789872589459257216,5044498550623901452,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5496,i,10467045453022235997,16849781377724551792,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5484,i,14554328795222354021,4118529186448876314,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5488,i,329201988878660763,7132193921448504927,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5492,i,9410603997303720267,5279536158854277112,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6044,i,15631310341227422190,18135566533367402474,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6100,i,1856013323164054407,12515037662649966410,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5472,i,17811225189032202064,6879380628917709062,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,14671033671047139524,5283552276509625429,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,7114704826308651386,3327892499104752842,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,9504041834884408360,9143155200879421714,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5724,i,2611602100221821170,8863330956931003151,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:9
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6476,i,17181564090675366459,13202675038835336533,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6536,i,7489233461477064950,12275567904177765429,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6372,i,7416634758649465935,13595336899869622475,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4892,i,1637014776023271151,4078594704044710875,2097152 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,9659069546907668530,9033308555856937758,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,9117290589651133223,16066409310764327983,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,7044601187641700992,10768934191605798930,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,18376748930813743202,9721079694574024810,524288 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5856,i,5891997548244785275,3719151649004341314,262144 --field-trial-handle=1892,i,8607259608737127961,6926022135005126453,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1848

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\minedungeo-fabric-1201-1.0.0-release.jar"
1⤵
PID:3500

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\minedungeo-fabric-1201-1.0.0-release.jar"
1⤵
PID:4840

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\minedungeo-fabric-1201-1.0.0-release.jar"
1⤵
PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b311d97cba85df787deeae980053cf51cac51f09626b46eee50c46147ff407e8
MD5 1db160ee81cfb275b740f199f9ef96d6
SHA1 abe0d3897edd611f77ef2e8a99b17e77703df756
SHA512 6c9f2ea8138133925ef44e37c8aed552a9ef41556d1536ee94844f1c3c35a0e2ff1d7d7a3686ea3f2f2803696ac2bc08c04992a6efd3fbf40a311552024befb6
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 0f87a400bc90f6609e3018d47a14e53a7b108424ad5aa168bfda7978a59397eb
MD5 58df5de6f99e7cadd6aea74f7fa49086
SHA1 e53dd872a4a02e5ccc7a0971803c91af6be3ea46
SHA512 9997dc8feded97ed22569be153d934eb0e26e2ee0df165396591baff9bb09feeca97cfc2f31f4feb490a672f3956d32af4cd0eb67301391c583980752a9a1f1f
MD5 SHA1 SHA512

Submit Download

434bdbb6-b101-4a21-8e45-895b981f0d56.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\434bdbb6-b101-4a21-8e45-895b981f0d56.tmp
Size 13KB
SHA256 cc0a39f8f3ee6f560365d3fccef8a4649031b2b26cf1b486eb086cbd3dd4dc18
MD5 efd87c9fd1ed55d49e44227085af03b9
SHA1 96c05a2cdecd2a0d3be2640779a79a5b2b3a0d8a
SHA512 0ed67e09cc5a992d40f3667efcb807b77c2d73887582a6d1ef6e3e0251c02d14f5bd4a981e1f7f3f7bc4dcb7c0213464bd3c179f36305f12f321649d8eafb4ee
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU38fHGtJidmwian:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOv
TLSH
T16C52F867688C9A3B0FD8DA4CDC16BB4FACB50247A2A84C6457FB9C1903D57CB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 52048a5ae76c112df13b9307dd6cb0431f2c47722567468b562080b4d8c0c430
MD5 76120630dda7123f3f13a9ba3f865ea0
SHA1 9b98b9d07bfdd16fe9b6cbccfd370e13f4df46cb
SHA512 ede670a142e099dcd45aa8542bb27f40cd31392e210d9a79b64c2193adea3d100b10154579eebf6a8a5ff252ae58c863acb17bf9cea1e488bf94ab0d042d2a44
TLSH
T123D08C2362CDC020DBDCCFB107E082C67A30492A2EF38C0EB1D040B90921F2072182C9
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ad0ac224-090e-4f1f-b322-cb7e67fe9b48.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ad0ac224-090e-4f1f-b322-cb7e67fe9b48.tmp
Size 3KB
SHA256 7727351d79890d8de1a29bda55223fc1e0f5994ef5d3a9a02dc8ccd66708e4e8
MD5 42d0ba1611443f8f2969a76c0c2b34be
SHA1 8751fbe68c7614cde24c0d02a687800167395d69
SHA512 790f9ca75b87088898bbb3d8aa693c2157125fe186110c4a2ed2ff753c05f66ae0fe78ada75ca3bf83f4de1e8df2e8d773fb89f95e770589f84ec6ea768407d3
TLSH
T1CE71A0F7D3E89A7D881162F4EB252E1FCE290A14132C3C16C9D5AF1B53E2872D24168F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 69a9f9c53e4d733c5acf3e7527e34d9a048fc06db78082b46335125161ef2b3e
MD5 72e355b2ed251e371fedc97f11a8b812
SHA1 31da3e5abbbd4b11f6f8bbb70e4cfea41cef90ff
SHA512 6485e4d10838651a6efd367521fca6316b18eb4e2aff9f0805724a79be3314cabeb12771f40d6cfdd4f9dca1a5a36dfd68b0d622a276aa11c288e378bff8ee1e
SSDEEP 192:qRhdoyjv7x4APRp2T9GHsb+WNn5n0EhB3aohscN3VyIsnAUge:qRhdLb3XMgwJ0G1aJaRe
TLSH
T18242B62EAA147D3B6CDBD229FE227753D7F5106171942E84EAFC892C14EB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7d5d0fa685631d9811ca4305c6dfdf5e86f847036a165123e9088e721c394b51
MD5 9bebf2aa6fe6340dac3c38cdb87afb92
SHA1 2d86a975454860e6897d32c04bc4ed477e54d0c2
SHA512 b7ac57ac6bf80220f65af14767513a5250bd1b882c8586a87ed3b7abb8969879bb240933f9c34dd9c5bb010ad9ab54783ed0a0011c42f950baeb5615f5266f55
SSDEEP 192:qR+toy9v7x4APRp2pj9GHsb+WNn5nBcqeHhB3aohsco3VyIsnAUgvaw:qR+tL93XKgwJ7eB1aJvRvaw
TLSH
T17142A62EA9246D3B6CDBD219FE62B753D7F5106271D42E84EAFC892C11E75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7f69995b167f0070f383c6f38cb8b8a1a586767ce8a5eac2ee799407053d73b6
MD5 3a0dc3dc2a823a38e666453c760b8c94
SHA1 51f2eb0b89742fedbed8a3fea6be5602942b0f8c
SHA512 d54c2809e52561367230da9a656f80de3d83e7fa0bbaac9d26ba4a27a847a9895e4c6a111b948eb410e3893ad5449e0715010d0bafe52d51bf6598f0897def74
SSDEEP 192:qRhdoy9v7x4APRp2pj9GHsb+WNn5nBfN2uhB3aohscN3VyIsnAUge:qRhdL93XKgwJn201aJaRe
TLSH
T1F142B72EA9247D3B6CDBD229FE627753D7F5106271942E84EAFC892C10E75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 09f0839502a10e49b9f6dbd8b139fb21a5d06b67c70b858385d13e54cc74f110
MD5 1182b5b1488f46468d84595c17ddc53b
SHA1 7f67e39b08a6131b6b86a8140e2083c5a2e7141f
SHA512 6a710eda4521084c7a7ca0f8e7dfbbfde02fff134c2479052e3ae146552cbb28941384b2968ce41339ed96c95c6216a04da42753e70634fdffbe21f66c09d114
SSDEEP 192:qR+toy9v7x43PRpcpj9GHsb+WNn5nBcqe1hB3aohsci3VyIsnAUgvaw:qR+tL92XIgwJ7eD1aJDRvaw
TLSH
T13442B72EA9246D3B6CDBD219FE62BB53D7F5106271942E84EBFC892C11E75CC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 548ff0ac40814a0e717b188ff7e3d435c6e1ea4d21e73ff18660ab493b9c3e59
MD5 307916350d18e04d2f0da095a869563a
SHA1 b38e9d87648d29187ceb51bde2d71b9ce88a5c60
SHA512 6b2e3f9d3d06d2386cb391f7200628515ab77ee9d992bf0c503e364c8d8278120b7ecffb148eb190abb9643224dc6820f198df49b5715d73e54d7d4b29fdefbc
TLSH
T13CA0025045C05513DD08677060661A8526B9482C3B97578375E504479C6B1C8A101110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd2a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59cd2a.TMP
Size 48B
SHA256 914246be5b928b5a2315de01547174b99821e44630ad62512efb3827cfbac98d
MD5 b326ea92cb761349b56e2bee72fb03bc
SHA1 8484fa3ca08f62eaa8c104a16f6d092191f81b1e
SHA512 7cb880d92bc6f51c73d927b1a81e86861634e08d5f2a116fabe2022c2e2a49f003a146c2f61e88e6dfe879fae6ee49e38e794ba352db5d96cc409a65f00645dd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1c7e41b66025c060f2719abf7d5796a304f59868a73396dfa69e68be9e5c616d
MD5 8ade8696d1ecae84bc7f546b06707306
SHA1 f2eff638c6562403e155f4b0e4e573bf5216cc77
SHA512 2cdfbb2c9a721a4525144134da80616ffaeac86bc26e95e3bc4130b2d1648bc0d7fdff8be914339b7181f8741f3f885d8464ad8d64aaddb8edce2dd92124ace9
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5kcDUB6gGyvhyLfOL5EbZP9v4a:SC0JeGnpDUD7YE1mL5Ebj
TLSH
T179A12C75F06C997344B6A989F9526B43CEA521ABDA71EE44EDC85F0C02FB0EC0342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 3b13e5f3720caaaaaf6265e2e3505badfa91cc72a5ac89d5bd30d34ec321062e
MD5 8af8ef1aaab0843f499d2e2c17afc544
SHA1 618ac1d81054d10980309190c48f0e9334a7a081
SHA512 4137e149ec03761474075ecb2ddbb7deffcf82b67e88582a7cdb3b7bbbd1d811af0f00b0a0cc752e69d034ff65d887a0e6eac467ad0f9fb5822bb3b2c831fbde
SSDEEP 3072:RgoMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW0U:yjkp9pQNRA8eEqZW0U
TLSH
T142D31221AD3AAD336DC3C566B25FBD5ACCE4347354EE16C8452CB7A081E32990B36C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 1fcc25740bd298e205b0ddab2067e243554eba048133fca4d30c70c5a0ccaddb
MD5 219391de3170a08281fcb86eb1461125
SHA1 34ff2c55fd57617d01ff78603e380a33971e1bf8
SHA512 90ddfe75a2a08dff230273d6945c84e406d08b32e2c61e0ebf5052c24680d7038b5b41444ca213505106757affcef8f6623f1fba2f20d35477113e25ca295ed6
SSDEEP 3072:kgoMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW0U:Rjkp9pQNRA8eEqZW0U
TLSH
T1C6D31221AD3AAD336DC3C566B25FBD5ACCE4347354EE16C8452CB7A181E32990B36C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 885a720b762d42a9f4021f8a9744f38da7ae6d15c658aa1e4eae7b1737a811b3
MD5 0d04fed0d699872c15ebeeb5c7ff37c2
SHA1 1ed6a4d1f3710e160fb2c9008362abd7211a34f3
SHA512 bfc8c9574c71a91fb2a8478818fb9cdb2789b80e2a3ba145603b5bcae4699b823dce291ccbaae4945b516f9b1a6474234279f0259a68da495bdda0193411bb98
SSDEEP 3072:ngoMMKfFse9kbuOUCauAMxFfQdrRMAQ8eSMiN01ZW0U:4jkp9pQNRA8eEqZW0U
TLSH
T1E0D31232AD26AD336D93C491724B7E5ACCD8347758EE2AC8492CBB9141D32990F36C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5760_1736929951\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

minedungeo-fabric-1201-mod.zip

Path C:\Users\Admin\Downloads\minedungeo-fabric-1201-mod.zip
Size 6.1MB
SHA256 4dc633a14e83fab9ed4f2a50bcedaa5cc0f065bace51d832dbee4395f4f03585
MD5 c1d6970d1d8dc0aded3060ddce68d772
SHA1 e2afc654b0d7c16c8773389874591e6871eb6f29
SHA512 46a70c69ec72066676e6571d87ede0ed1b990cba061536be18b2f4f17f39ff2adbb8badf0a2a7f7791b3750e6700bbbf69c07deb6cef694ef7cd5f3e1f2787f8
SSDEEP 196608:fPOO1CVb2F/GxYHX1KVIW7OXYayddYJ1lR7:3XC4F/Gx6cVL76gC7
TLSH
T17256337D5EFA8C53B13B8F5A528D69002C2BF22A9FD02B3178752F5BD1522BD41718CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-2-0x000001FCC7580000-0x000001FCC77F0000-memory.dmp

Download

memory/1212-12-0x000001FCC7580000-0x000001FCC77F0000-memory.dmp

Download

memory/1212-11-0x000001FCC5CA0000-0x000001FCC5CA1000-memory.dmp

Download

memory/3500-618-0x0000023D22AD0000-0x0000023D22AD1000-memory.dmp

Download

memory/3768-651-0x000001E119510000-0x000001E119511000-memory.dmp

Download

memory/4840-630-0x0000022C94550000-0x0000022C94551000-memory.dmp

Download