ratonrat | 0a0b1ed195cdd3c71890b6160e7b6b1503706261b88735f80dd691dfe90b582f

Analysis

user interaction
yes
max time kernel
429s
max time network
434s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
test.exe
Size 2.4MB
Sample260823-phyeeawfqg
SHA256 0a0b1ed195cdd3c71890b6160e7b6b1503706261b88735f80dd691dfe90b582f
MD5 8623fe4a4d13e9305cbd17c5d295b0d2
SHA1 e26466f0a06f01b352197245cbdea062c9caac8b
SHA512 5d2704b370081be69350bfcc4af153c8a1e72ff13b506603b70187810a9bcc26f8e3aa0a4d84a8e3378acff63851d8a69e56b657efc5018608d47c6813f53911
SSDEEP 49152:b6sgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw49KK:bLgVUuHjkDGjYQDGuRxzew
TLSH
T1A7C5016833F98A0CF1BF0BF4A4B149664B71FC079C96D76D18A579DE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution ratonrat ransomware stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

84.98.112.243:40000

Mutex

nvDiaKgx4GmlqSyVG2Iz6c8

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
password
t.me/junk_code
process_critical
false
raw
silly21
reconnect
3
startup
false
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/5848-1-0x0000022A092D0000-0x0000022A09546000-memory.dmp	family_ratonrat

Renames multiple (122) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\wallpaper.jpg"	test.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1084	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3448	chrome.exe
4792	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319612923621408"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5848	test.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2668	chrome.exe
2668	chrome.exe
5848	test.exe
5848	test.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	test.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe
Token: SeCreatePagefilePrivilege	3620	chrome.exe
Token: SeShutdownPrivilege	3620	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
3620	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3760	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1860	3620	chrome.exe	91
PID 3620 wrote to memory of 1956	3620	chrome.exe	92
PID 3620 wrote to memory of 1956	3620	chrome.exe	92
PID 3620 wrote to memory of 3448	3620	chrome.exe	93
PID 3620 wrote to memory of 4344	3620	chrome.exe	94
PID 3620 wrote to memory of 4344	3620	chrome.exe	94
PID 3620 wrote to memory of 4936	3620	chrome.exe	96
PID 3620 wrote to memory of 4936	3620	chrome.exe	96
PID 3620 wrote to memory of 4448	3620	chrome.exe	97
PID 3620 wrote to memory of 4448	3620	chrome.exe	97
PID 3556 wrote to memory of 5636	3556	chrome.exe	99
PID 3620 wrote to memory of 2940	3620	chrome.exe	100
PID 3620 wrote to memory of 2940	3620	chrome.exe	100
PID 3620 wrote to memory of 1732	3620	chrome.exe	101
PID 3620 wrote to memory of 2852	3620	chrome.exe	102
PID 3620 wrote to memory of 2852	3620	chrome.exe	102
PID 3620 wrote to memory of 6008	3620	chrome.exe	103
PID 3620 wrote to memory of 6008	3620	chrome.exe	103
PID 3620 wrote to memory of 5320	3620	chrome.exe	106
PID 3620 wrote to memory of 5320	3620	chrome.exe	106
PID 3620 wrote to memory of 5972	3620	chrome.exe	107
PID 3620 wrote to memory of 5972	3620	chrome.exe	107
PID 3620 wrote to memory of 4760	3620	chrome.exe	109
PID 3620 wrote to memory of 748	3620	chrome.exe	108
PID 3620 wrote to memory of 4760	3620	chrome.exe	109
PID 3620 wrote to memory of 748	3620	chrome.exe	108
PID 3620 wrote to memory of 2504	3620	chrome.exe	111
PID 3620 wrote to memory of 3444	3620	chrome.exe	110
PID 3620 wrote to memory of 3444	3620	chrome.exe	110
PID 3620 wrote to memory of 2504	3620	chrome.exe	111
PID 3620 wrote to memory of 3040	3620	chrome.exe	113
PID 3620 wrote to memory of 3040	3620	chrome.exe	113
PID 3620 wrote to memory of 4800	3620	chrome.exe	114
PID 3620 wrote to memory of 4800	3620	chrome.exe	114
PID 3620 wrote to memory of 5284	3620	chrome.exe	115
PID 3620 wrote to memory of 5284	3620	chrome.exe	115
PID 3620 wrote to memory of 3608	3620	chrome.exe	116
PID 3620 wrote to memory of 3608	3620	chrome.exe	116
PID 3620 wrote to memory of 2164	3620	chrome.exe	117
PID 3620 wrote to memory of 2164	3620	chrome.exe	117
PID 3620 wrote to memory of 1756	3620	chrome.exe	118
PID 3620 wrote to memory of 1756	3620	chrome.exe	118
PID 3620 wrote to memory of 4568	3620	chrome.exe	119
PID 3620 wrote to memory of 5740	3620	chrome.exe	120
PID 3620 wrote to memory of 5724	3620	chrome.exe	121
PID 2308 wrote to memory of 3008	2308	chrome.exe	123
PID 2308 wrote to memory of 4792	2308	chrome.exe	124
PID 2308 wrote to memory of 5772	2308	chrome.exe	125
PID 2308 wrote to memory of 5772	2308	chrome.exe	125
PID 2308 wrote to memory of 4416	2308	chrome.exe	128
PID 2308 wrote to memory of 4416	2308	chrome.exe	128
PID 5032 wrote to memory of 3860	5032	chrome.exe	129
PID 2308 wrote to memory of 1500	2308	chrome.exe	130
PID 2308 wrote to memory of 1500	2308	chrome.exe	130
PID 2308 wrote to memory of 6052	2308	chrome.exe	131
PID 2308 wrote to memory of 6052	2308	chrome.exe	131
PID 2308 wrote to memory of 1732	2308	chrome.exe	132
PID 2308 wrote to memory of 1732	2308	chrome.exe	132
PID 2308 wrote to memory of 4336	2308	chrome.exe	133
PID 2308 wrote to memory of 4808	2308	chrome.exe	134
PID 2308 wrote to memory of 412	2308	chrome.exe	135
PID 2308 wrote to memory of 1484	2308	chrome.exe	136
PID 2308 wrote to memory of 2668	2308	chrome.exe	138
PID 2308 wrote to memory of 2752	2308	chrome.exe	139

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Executes a command shell one-liner
  PID:1084
- - C:\Windows\system32\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    PID:5852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe3210c728,0x7ffe3210c734,0x7ffe3210c740
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,10077034921938500316,3105089226307859719,262144 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,6073421731559426179,11255887590616016291,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,14576895904219640044,4456750359160343066,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,347383944050925621,711260781079871450,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16250924934349551458,8958187555080640845,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,7624718859139671057,7664189269137932859,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,14394178956650052791,7691621954555249718,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5444,i,17900293260147302338,12717102977087866048,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5576,i,17765239869412177547,8383122231711857946,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5860,i,5470879191791964285,7895056604227472355,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6028,i,1350828995398159875,4910446075015084234,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5580,i,16463701319193777877,1026545301189894791,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5864,i,16428886726599146634,10400342245868791984,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5816,i,5157927550895065782,7971360021412679443,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5708,i,12608832558536980013,4327066077609517013,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,256722715265463462,10981287945578677157,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,14552256017631963437,10884540438292255599,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,2873827103509117766,7411366476083690363,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,6598668098347943593,13477916579307154201,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5436,i,7878457788791679849,12171037235131657916,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5824,i,14217086082719774306,623637971010789098,2097152 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:9
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,17525003209584365946,16915429378935283060,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,9304505628339550416,1100337026101293389,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,9747237065636979195,12691122239618940921,524288 --field-trial-handle=1828,i,7255631383360427397,15714746410310115166,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:5724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffe3210c728,0x7ffe3210c734,0x7ffe3210c740
  2⤵
  PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe3210c728,0x7ffe3210c734,0x7ffe3210c740
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,13797616679046940639,10450993149003743136,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=1972 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,12248021405605802693,12880107919754916879,262144 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,6462016658078051435,10211425232203960275,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,15984373501247211826,13149398692458006262,2097152 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,14032899859964747792,11855238980365914096,2097152 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,12125809160823250003,10433502806944518142,2097152 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,6584240404310124975,4704774001054421621,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1955938529759467502,4375168479310286542,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,5013174840141845893,8384720666114566579,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,8903422425168763111,8642262898676888096,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,16420085458906237374,6050880025815845217,262144 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=4336 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,164123293749689314,17934540587109142341,524288 --field-trial-handle=1944,i,6063094448571877596,14900956907672436119,262144 --variations-seed-version=20260822-030035.794000-production --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:2752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe3210c728,0x7ffe3210c734,0x7ffe3210c740
  2⤵
  PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:52

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cb855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 8126bb1b329ac91b0c52e8160cc2304fe3ada1e7bb177f3e1b0412a8bdfb5b83
MD5 bcbdd0a30e8801385eb278c43a30a977
SHA1 40d9d1d9c18e6bdbf629cf641662ca50f6a07989
SHA512 2c03b6563e7586abfde2a5b337f706658fe250e62bf4d705bd4c144b1a1e0c5af84e482c9fec50f2acefd102c761d4197edebc15f5e2b1347b89289411fda280
MD5 SHA1 SHA512

Submit Download

5c6021c3-a68e-4286-a4f2-c9602196ae8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5c6021c3-a68e-4286-a4f2-c9602196ae8e.tmp
Size 414B
SHA256 f000ab7f9e29bbd48088c5cd4835f246341f16b63d8db3a836960e5cd7492bcd
MD5 345f033989a9be9587c7297499f3f997
SHA1 c5b84f8bda7809da7c60cf4ec366ed95ea9c6d08
SHA512 24961e131007546ddd8b2dc2bb11cf0dd7cf3d95c6e696b9e385029fdf4fb3cc433957371f814801eba7f9cc53b4a2d31c0982f8ad3bd4551bb929997fd4de54
TLSH
T1B7E02BE5C921EC2718FD071D50544B47EB91235B3B404A4F3A3D811D8FB163A598AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 0963790aacf661fe479178a1bcc3493549d03dc72d45ffd2e6044b3ecfbf9ec6
MD5 81aba04f7a9eae18a71c2fdc55c1c53c
SHA1 81c88d5a93ec3b48ca1705489000d806e6fd9f30
SHA512 878ed6441114c4766a01aea6718bf5aded12c58d54f7511581d985c6b2ae12006b3f6b9011f698f664f7288763d6c83059d2c9fbf831b78d9a6b57f0c751fe97
SSDEEP 3:MsEllllkEthXllkl2zE/lxK:/M/xT02zz
TLSH
T17B440214AB80090BC5001130515183542370F41506135743349148339C8A6441C10404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 c8a81c4bb83da334caf01af2b785497e27858f0025f1b1be6f4a7f4daaeb52f9
MD5 f81a4d65538cef512c2955783b1c3d72
SHA1 ef46c00f20b3d69d0154c3672f63b2aec25486dc
SHA512 cd3aa4d58b69b05bf2c4ab7e84331dc26d70e6a665b258edfa5a3d5e63c1d5e49fa34d11d7addbac0b32bb32a3b3c85750f54058c2d9193da35e92a5130e628e
TLSH
T128E0868A24D9C16D58A4D46393A8631CCFD13408B6CB78471B09A49132D6D487194E50
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 e766d4e456d8efbb0edf62d01223248f4e902466cb1c71fa33950f3bb745ce7f
MD5 7941f0b21f64ab5b4dcb1aa09af417e8
SHA1 d2575fcc4a2bf5e240e4b6896bd7947ae6df3901
SHA512 5ac3ce8e92efbb6a57254c7535b34777f7364e229b4df8e5bf72e3ffe623c69c14cc12e34c9e2dba4dd65efa0194a8880128885295e926202a65f50337805537
SSDEEP 96:FY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:FY/tH+bF+UI3iWGVYWNkqp3
TLSH
T16DF3FB1E5F243712CDBD923668E745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3cef189afd9cc8f4647e124d2bd80c5510ffbd0fa00dae55535eecae45021b34
MD5 62677b1c2c40eac4c14053df6aa51dd4
SHA1 0488285794a5f7ed83776c31ae8c7c97aa3b2774
SHA512 62bc7ef007e0c19ec979c016ede0927b7914fa64fdc556111347d67b9b38f9015e58d388c88aad7c72182f41ce53699bff38015dc367c9b02535fe8c0c73afcc
TLSH
T1815179F7C3D88A6D851152E4EA216E1FDD2A0A24121D3C6688E8EF5B53F2972D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d7bb4ad504af47d6e80e1a947ccc4fce9136e10152945370a6a443a035224bc
MD5 4c46797ec42b79f6497209f401998a40
SHA1 975b18a12e475ea6b63b07799f5d718f8e9c5671
SHA512 134ae02d794024f1b10343dded223f118b358af919b00a0382d9fa481a157e2969410bc4ea24143fa08f4349627f7fa1c75a2c5dec0ac4bcd302ca25d1e12b3f
TLSH
T127419AF793E48A7D851092E4DA21AF1FDD790A24031C3C7288D4AE1B43E2973D21079E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e8bd002a666f357acab1728a87a7c3ce33a56a5a08945d29261a24a03f11628e
MD5 1e5e24b7634b7e055c46965f2af1bf02
SHA1 064d4ba823a3b935b8fc4bcb819ac93b00f5645d
SHA512 b7856449bd71eaa45b895c4bce0d61937d70c04178ba861e7d286c5581af6a50d4118f246614903723e5771ab0bff2ec2c23eb45a6724187bfd4c72bdd9b25a0
TLSH
T1A4F059E7E66A787310B986AE0E14BD062976A435054298E4CF9AA12CE0925A71B02863
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 93dbb3c11c8e7684036f335edb4d520d8971febf33e2da1a06fa9e5eb2c66454
MD5 08226cc96efc13da5adc447391b21157
SHA1 f12b2f28165676097b251226184124d803f31fec
SHA512 c3dd44ef38c83395bcbe81abd2d5cac2ca8f9eb557a904a58fe1af49d74ea28c6f8902f8c8bf36f4a090a5863ba87b54a51cbae53d0302b60a9ef11234c124fd
TLSH
T1CDF050A7D22A7D97507D45BE0D08BC4A147AB835064158E4CE5A823DE0415EB1F13C07
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b93f84398c3638ebc8ba868227a035b811693dedfc588b2b8b6c707818927388
MD5 c52d5bfcfc62b6deaaee6185f085736d
SHA1 a71dd1aa52f7267b4ea82d6c5ea49a712e0ed30b
SHA512 61d767ad4cd957e1f3644ee1abaf8636f39ca397c71b03471a9ab8a309b08270e1877834c5bbb7970aadd0bdefee121e9d5615964b4c2d442ed7fe67b42be79e
SSDEEP 192:9RHbowmv7xRAPRp2T9GHsb+WNn7yfnWxg2ze4AankecVyIsnAUge:9RHbLSuXMgwmnn2oanH4e
TLSH
T14332C72EA924793B6CDBD219FE267753D7F5102171D42E84EAFC892C14D75CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b74574f0c64adf9d28ad10ed8c5635e434cca094f5eb524f94041be28bec54ed
MD5 2180fb805098c2fcc3b19afc81292698
SHA1 939a1e34a7f11325170ba2d631fc5f616e611967
SHA512 6c1f3bcf589f4d064a530ccc03e96a7cb33046cc48fde09b666344c323fb92dae7a65a92ab8d8c300cc917f6afb1d95379e54e2b2c1b342e04628d5b63d67226
SSDEEP 192:9RPbow4v7xRsPRpaT9GHsb+WNnwyHe8Pg2ze4Aank5xPyIsnAUgE:9RPbLkyXggwlev2oanmFE
TLSH
T10B42C82EA914693BBCD7D219FE667B53D7F5102131902E84EBFC892C15D76CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6080c37fce40fb2f0bf41d7dd2bf9289f6c3c6d390335028a2a08fe9fd93f99b
MD5 782fb2fb7891baa2147a9ae5aa85c576
SHA1 75e4ed2828890c07ad92012f64206fe633650179
SHA512 78aaab332617750d70caf0bd4f5f84dff48da2e009e2565cbb67ca49f8bd0d80889df92181669178f1754ab1fd99b7863594c853a4b3da0e9fd29d37034194f7
SSDEEP 192:xRHbomPv7xRsPRpaT9GHsb+WNntyRTEHPg2ze4Aank5XVyIsnAUgraJ:xRHb1HyXggwkTEY2oanmxe
TLSH
T16142C82EA924693B7CD7D219F922B753D7F9102131902E84EFFC892C15E76CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ffa19feff86811fcce24ba8601c2a74bc652e4f108e8baa55eb1120be2eda8c
MD5 fb4acce47bd216c9a3b58049fb716bb6
SHA1 1e0e178a284116d3a37abb300fd6888a5c0de82c
SHA512 99953310819528c06e9f7443356d07b65a94140dc068d2487127de8a971067e8d475c0b230fe2e818530c49a66caef6524107f03488729160a26fc4c42b8eb91
SSDEEP 192:9RHbow5v7xRsPRpaT9GHsb+WNnwyHejPg2ze4Aank5cVyIsnAUgE:9RHbLZyXggwle02oanm4E
TLSH
T17C42C82EA914693BBCD7D219FA267B53E7F5102131902E84EBFC892C15D76CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 021c1b050383c3ba3254ada43251ab07ffb03f645cea7b7f181d262aef3c692f
MD5 0d5bd389293ed5553cefc3f9ef3f68db
SHA1 11eb4e720d03521cc1e503cdcd0263fc7152879e
SHA512 e160daf5d945361769ae60e231d1f032a7e1824779bed60b5d3fe08a9f52c936a16f8b6bdb1983961c0d97f862a43b00ae08699ece7eec684d946b2b887ea552
SSDEEP 192:xRHbom6v7xRsPRpaT9GHsb+WNntyRTEHPg2ze4Aank5XVyIsnAUgraJ:xRHb1WyXggwkTEY2oanmxe
TLSH
T1E242C82EA924693B7CD7D219F922B753D7F9102131902E84EFFC892C15E76CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fcfdd8a64f6ed4eac9336b28f3cc06dbd9c3158adf474e8c92e63bdc4c1814af
MD5 a2de2898acc40ef344f301fcd127cd6a
SHA1 cdf238143c0c112ab02475e0e9a5c29561647dbf
SHA512 90e4ff8a72f95fcfc428d15714b1b5d80afd0e6e967989429c4f33b48ffb15aa140469d6ca35e47cf4355d8d58e55bfc03572b5417cb503dc41ecff99bb557c6
SSDEEP 192:xRHbomSQ2v7xRsPRpaT9GHsb+WNntyRTEHPg2ze4Aank5XVyIsnAUgraJ:xRHb1dCyXggwkTEY2oanmxe
TLSH
T14B42C72EA924693B7CD7D219F962B753E7F9102171902E84EEFC892C15E76CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91cb53ee9232071e09edc218a09b31d1958653efa4839162a5681ab36ccca349
MD5 6874baea69fe32efcf29660033ca2cc0
SHA1 59f2d35f2106c42ac4192b24045227302561b1a1
SHA512 3d37623fc691a2268030caf9b64c6e26cac449c83881ba7c31be4b60cb92186caf9c878be7dd0271e375e338a151a36ec4584dc7917496f2b704547dea2f1a1e
SSDEEP 192:xRPbomSQav7xRsPRpaT9GHsb+WNntyRTEHPg2ze4Aank5XVyIsnAUgraJ:xRPb1d2yXggwkTEY2oanmxe
TLSH
T1CF42C72EA924693B7CD7D219FD62B753E7F9102171902E84EEFC892C15E76CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a325a35e1f65c566712d1a3c89f117a7b050e5c40f64b2bd3c1748b3316bbb2b
MD5 049d42d18ca4a5957d526de3a200a617
SHA1 96211b68a487ac0efc6539e0c797070e98ba1373
SHA512 913926197de4ed1d0fe768b260ef8be6a014da5432bbab985a38b7384813182a91054337765032a706c1ee4d95d0e517fa3da3f4f317a1a04abf7060fb9f101a
SSDEEP 192:9RHbowAv7xRAPRp2T9GHsb+WNn7yfnWj0g2ze4AankFcVyIsnAUgE:9RHbLcuXMgwmnC2oanQ4E
TLSH
T1ED42B62EA914793BACDAD219FA267753D7F5102171D02E84EAFC8A2C15D76CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 708ac2637a46c31e6de3c9abf9fb328e22bc862351d4dd765692f8eaaa8af123
MD5 c5029205c731c04c74fd65ec72314d8e
SHA1 0957ae40d75eec174e750ee4d287eef3f38fea8e
SHA512 b8b0af66be6f7fa3f9333810124244f5dc4227306d3b102f5f45e3aeb93519068fac6e55989999ee9d0a9eed45f397330cc3359ed643d97796100f78af403898
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU3D8HGGJidmMa5:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOD
TLSH
T1E152F767644C9A3B0FD8DA4CDC16BF4FACB50246A2A84C6457FB9C1903D57CB120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
MD5 faa920e355b62c85f52f9a235ecb42d5
SHA1 a3bfc6e8d1f8dd900c0058622b3eb84b269a7195
SHA512 3db0845b5142132b4c40aa2a8486f431b162db89c8809ac45b105f1e293eb496efc21bae0393ff37e5bc5eea8ff4052e2db311c6061e12cfbd3d2759ad28acf9
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9QgJiMna1q:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFe
TLSH
T1FC32D867A48D9A3F0FE8D50DDC16AB8BACB4025672780C2457FB9D0803A57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 c7eb96fde6d32cf40e3924ebeb458666eb4267fb9b36db3823de2839eb8b02a6
MD5 f4e99a89b1906d430127b0faa457b673
SHA1 8aaf3a31c982e3a648abcbb3acf136da7d0c151b
SHA512 71971a3675e9255e32dbc38e6cd49f31ec754b5b1a51f4c010c2c9637517566fbc508bd529aaba8e53e8431ef91d4dbebaadf364b3ee4e49f6c176bec353b5cf
TLSH
T170E0728936CCC2BFA89AC003032CA34C8BE8741EE3CEBC8F9F05C88021D680C70E5640
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 66836fe59eb03feb545ac721cabc6fa02ca1a06d3b902b0ff54c3d3a66659f6a
MD5 cf0f6132706622bf167e895c548250bd
SHA1 4e6dc16deb485797e6d64758fd651804785f0fa8
SHA512 a3b61c7685214e2f99695e962dde668252d4ce96f9f40eaf40bd7ac4bbb58aa7bd4b06dbcd1a7d13a3e1cea5acc8d00e2b6f74084c6991f578c09eaba19012b3
TLSH
T192E0D86636CD866F648580576324F38C8DE17548E6DE98695F08A08072C658C7191A40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fceacc301441a243f216d905156834f858172a4016b3a1ec5caa5630d156cc87
MD5 429370afeff238e4719bfe2d4af9e5b9
SHA1 d241a43d19876c11369b71cfbd9c823a19ed34b7
SHA512 fa6cd5dbf7c47d11d4dad069cdb0e2b50c7d20b2aabbce8cb534f39298b29c072924253c46fed78feb7825665cfded1cd35c0afb7f1b01a8ae84cd04b101dabd
TLSH
T12AA0025441C51812CDB052757171CA41236DF9141993574764915C469C5F1C06142548
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0331f38a2f69024cd77df6908d48899785a4e71a1d9e85b268a7a39c260aa11d
MD5 280db2cf7e6e44aaed51e819bf7dd323
SHA1 1f5f4cd375d4a7749d6348df5a4a2d5ca86d967b
SHA512 5bc16eb15ab5d7a09be53073b783b4d5417ee0578c986c0055189583c29c9f8c1a3c33d8f82d8ff9e22c061f20f5398fcc2fec78931250dcd58c09443e95fc05
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a83c8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a83c8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 cb769a9081bb524036186d156a40f256a7bbebacd0d1d7a8201cb9ca9754372f
MD5 45d3046102b0c32249474c4d55757ad6
SHA1 c9b00d6176acff37bb6c52677e8da8d65be28e04
SHA512 c76d78bc218828b9542d2fd4135106c9bdcf00ad78245a7c822e030429233d842e327f5ff939e31e4060cafd9826bcd112cf992ea7fe5e1a7cc8e07a7113b3b2
TLSH
T1A8E086F536DDC67E1CC5C0575368B75D8AF0FD08A7CAF9CA9F08548175D1508B1E4A90
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 051cb4cfb2b37755692cdb051a8aff7ea514f02604e7116ff5f0fc0ac4b8d2ad
MD5 baf55176b2685b362e40619e39e6a1cb
SHA1 a747ca04b1d4caa63b9db54d533e98d1fc4e3270
SHA512 ab14de740a3fbc1685ad193918f5d15737a71bd10a6880460e77cb2834e904736ba1e7f845727bd60bde3bca9b6098a6d66b3a7ddaefa9690533a6ffc124a285
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBulLUL2VL1LQ7:f7doKsKuKZKlZNmu46yjUus7
TLSH
T14003228E97B841F3C0F2C53EEEC256E5FC7C260CD7262DD115E903755D8C036516466A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 3913f9f78bd8984b9cf91e8b9f8e03e35a3b24a660949df391ee29a554bd5107
MD5 5cece3199742f5712f4919de1155dfcd
SHA1 369eabb5f5297ceec4692672ee5488032d86dd79
SHA512 18bd4e0dd456751f5b7dc4a2cec8161b4bd85e1424188b1f9a6e4a8a588fefd358a1412bf905ed1cfdf58f0935991c70e6664ae890950f6bf3dbb91d99bd2d17
SSDEEP 3:gl9lNllv/etXlxK+El+qg/G9TjffaXM/RuWGJpDEJ7KgJpDEJ7HBQATHvY:gMlgpMSCc/mLEJOgLEJLzHvY
TLSH
T152022289A1D84220C830183CCFCFF4803A2B1E6C3FCA230535E0401D7C9E00240B4BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 27KB
SHA256 590c765b7a0998e652e56497c59b12574ac2e7e8c4f8ff4d22de5e8dd2ee7600
MD5 ccdc3a7d7334ba65bb792e04476a8775
SHA1 373dac9c26df67a0f122824f942e4e7d8031005b
SHA512 bbea707a9274c7f9121a207f8b2095a45259da944c162b6cbdb68adff59e994d34b58adfbe8b1d0e57c15ec303b64f3eead241e63c071b16beeda2a590702433
SSDEEP 384:6vHJsdGCprtryIsrlsdGRHkFMsdGd3QXIIIWbmMIM9ByZpaosdGodGIexhMpXAMR:7ebv3QE4ukL
TLSH
T108C2A6A7E3B01BC1EC9B9BFBBDD9CD2E07739D8964561001B49266FE2833D07484179A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 177f0717c6be30259e29ebff5117caf3d6d8833de174305feff9a81c80748901
MD5 0b5e37a799bbb010d0687f4fe3e70aab
SHA1 8a533552b555d7fef75c86ba949dbc7ec4b864ef
SHA512 519e0777e887c6eb8aa8999c09c837c9bb258ca7df52299e6663e86315221b87c4628355ba9bf60e33c2a601e9f51055d358f3f6bbbe550c893d6341219c4018
TLSH
T162E086D679DDC1AFA894D05723E4636CCFD13809FADB648B1F05D8D562C99087194E50
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ea0ae26ef5681511ce74afeb0892bdc618ecf68ed11edf7d6f27d7e8d33c6ad3
MD5 5cae9b1ab71b6f49ef57e26357da1c38
SHA1 d8cc0f1360b15c52b6fba2aa64cc756773efef1b
SHA512 1b6362aeaf112e87c9b89f2ba8d100202e247f163b0c1bdac468d746dbfe00979173a79efb28a14889554fd4ca64821035e2a7141cd91d03351dfb19ea1bd303
TLSH
T101212866F330C145C14E867A597D6B250338C8169FF8ED0F15B624753EB6A150E072D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 437abde4d695098af9a8a3dbc65661cbd667801d192b55d67f9c2bfce9bebccf
MD5 2b64448cb7d7393157953c88741ce6b7
SHA1 84176176112946001633e0dfc2529dbf68e58e88
SHA512 ddbce3ee148c4c9218bba8fc399dcfee835dfc60cdb9270053b8c2896e86da05bbb3e3648434fc02d028ca835afb4031af86eb26b80da1bd2fa24c4510545f45
TLSH
T143E0268779C8C1AF4890D01313A4A34CCFD13808FADB7E4B0F08D88562C98487189E40
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 fbec9a8a4df76afa410875912fee3efe075c17dfb4e646c06f13395380b58e89
MD5 352c9c60ca0d77d8a9bf427903210a7f
SHA1 f7c7e1e888bcd8bdcf2408827d92f4f4168ee104
SHA512 dd6c6c372c296a16160a046962f26a360a74e56dd5f0c8df8f74954313714fbb2d28824989eee9ad6ad0553ffe8808ddd3e3ca7eb8dc51457d30d4d2910eb7fb
SSDEEP 3072:046SexVzlBujtO/vSViH3ekjL88yRfgz7pbMa3a:046zzlcsQuukjByKz7h5K
TLSH
T1ADD312B5607B98E91FF26698E6CB2D0C4C8DD64FA69D564CAFE31F8C8035485030BA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 bbe7f2870114cab0983a18f72b193ad9a99886f3cf0f1beb7dda8261b6c82dfd
MD5 8a8052540f5d364e59fbeb9d3be6e628
SHA1 66dd50b31fa6c0264a0adbd31bc8b2f1db28dbf4
SHA512 8085500ce6538498d0aaaa43430b2dc598afad550614fe2641e1d3d60c4128bf60d0a935655a360abd21fae0921c9cd6dcb27fbc83943e01f9ddcd1ad519a312
SSDEEP 3072:0T6SexVzlBujtO/vSViH3ekjL88yRfgz7pbMa3a:0T6zzlcsQuukjByKz7h5K
TLSH
T13CD312B5607B98E91FF26698E6CB2D0C4C8DD64FA69D564CAFE31F8C8035485030BA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 61b44596a97f17e1b091bb32c14352c70b09f5ecb6df1e16499201c7ce4fe8f1
MD5 9c84f6d3ac3ed057e5b407cbb9a2da98
SHA1 29cf2065e52e25eb1ce5fd1f068284d675e956ad
SHA512 8524c13d24592ec563f48ed5678d100b0929bb7482a6f1e3c2a023fbf8e0b644b1d2186de45c0ddf39b6c223e25246d2e9460d09934ccc3b6ad41aef28d94647
SSDEEP 6144:+sO3wYlpPt9cudDvIyoPgI6zzlcsQuukjByKz7h52:+sOTlp11jIy/zes5ukjByW2
TLSH
T1E1442271747B99682EEAB37CB7EB0D2D0D4ADB1DD16D8264ABE30B18E1720A50313573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 d194ec0b83402b4de7e6f34d1c857aa9f95cd7e50b32d293f72b0d39a370d8de
MD5 50adfb8d931b6c9728266d59be1236c4
SHA1 ef3848fa4b6db4024ef201f2daa491ff55b85ed9
SHA512 66a89ab6a55de9ed328c999897d0e76cc6d0f3368143f050e2714812ab2c1c3cc04a0eb957709af5b1a2bbcd19cbb668418bddb8298a9bfd3aa5b231108fbba6
SSDEEP 6144:+op3wYlpPt9cudDvIyoPgI6zzlcsQuukjByKz7h52:+opTlp11jIy/zes5ukjByW2
TLSH
T18D442371347B59682EFAB3A8A7EB0E1D0C89D75FD12DC268ABE31B5D91320A50313573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 b77ccd4c6e1be5efeef5500a293a6e08d920551af014ff49d74c8bf07c35dabf
MD5 f35820126b669c5f6bd02eb57d14d648
SHA1 70252aa423eb463c192d155c1fa6ac50aff40972
SHA512 4cd18d66bc1cc15d0ad298e5ccaedac3996308b7ba8095156f8236ac3d213b2eed321a125131946188d1d8feef3cf93cb7f32522d4a89fbf044f0df7db194d66
SSDEEP 3072:0m6SexVzlBujtO/vSViH3ekjL88yRfgz7pbMa3a:0m6zzlcsQuukjByKz7h5K
TLSH
T17BD312B5607B9CA92FE6A75CE6DF2D0C884D864DA1DD4594AFE30F8C9071885030BB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 253KB
SHA256 941fd1e7e4ea348a3fc3044f079125cbd1f94d02c021becbe3fc696b569fce2b
MD5 365e8c2f7e21f2998c53a9b2f09deb46
SHA1 6bb2d7cc131a0572920f9327487779348829a4b9
SHA512 f5e0d962bcfedfe22f9eb74e8b50785a928df82421a95d96d2114df6e21a06d4c45e62543b94c350eb7d2057b55d6237bbde5848b1391bcd8922aa1a6ee01953
SSDEEP 6144:eV3wYlpPt9cudDvIyoPgI6zzlcsQuukjByKz7h52:eVTlp11jIy/zes5ukjByW2
TLSH
T174442371346B59682EFAB3A867EB0E1D0C85D71FD22DC268ABE30F58D1720A50313573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 12cb7211a5030d4eb8953cbbb87eae3438f435e2708b8f6ca00000691caa567e
MD5 5a0a629f15850ce8016cfab126f6d2bb
SHA1 0bac0e235f07889c783d0a23e611a0f819d87ef5
SHA512 c7a87545527ea1560e86f878a84cc1630133bb43efeaf7a3f78b60c028c69883548bb142cca4af6bc48302e1be158d0a5cb2af1ab2a8065f112c610e371db58e
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5LHcDLRB6gGyvhyLfOLWzEbZP9v4a:SC0JeGnpDUD2TE1mLMEbj
TLSH
T1B0A12C71B02D997344BAA849F9527B43CDA561ABEA31AE44EDDC5F0C02FB0EC0346937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 851cc2468de7f6282544175a43695cca90161d26f300f5df7e27d19446cd4180
MD5 b06c17b01f028f171d3ed4555237c7a0
SHA1 b4e5a88f5e79c3d8c38bea1d11d7034b9a1346f1
SHA512 f21b3e8bc277b9351507dbe388b6a7394fbb072c7aeaa454ef6f2d997d64100b8540385a5d5cdb54e70eec31301c565e237815696e6f789c38fac15c2c5a7518
SSDEEP 96:89C0d+CVgOeTnnGBfYZSdLDR3/FSl8h4otop5LHADLRB6/ZGwvhyYMUGsakO0AGN:iC0JeGn5xiU2iT5sMUGspWiaMnUo
TLSH
T104C13B70B46DE87359F7B999B5062A47CDA061ABE652AE50EDE90F0C02EB0DC1343937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 5a0f297a8856bfc2f578f486f0dfd8f11248956c196a36d24099abdba50c5b8d
MD5 9c589cb49af16eaf7a47eae8f899217a
SHA1 58679fd33c614a64b7b2d0dc5ad5fef8404a4129
SHA512 0d8ab1c4820607a006dc62a7d53f32ea64f298c916e804bdefd2c155c6e24ba56ed3cd8713e27c9ad6caefbbc7b36fafe4b23ad509fdfd8e154a71915914eee6
SSDEEP 3072:0vAM6SexVzlBujtO/vSViH3ekjL88yRfgz7pbMa3a:0IM6zzlcsQuukjByKz7h5K
TLSH
T103D312B260779CE91FE26698E68B2D0C4C8DD64F669C568C6FE31F8D80354C5070BAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 212d99ad618f68a7bc7662b78e180342537d38c1d7179e1c568f10caf925f579
MD5 6bf506d722d4f5d2db15cc4f07c3382a
SHA1 fa95f8d43083464315927407f90a9d0869bd9902
SHA512 8d538d84a2aec50c6bcccb000922f7745d159f990768a6ab44c732744a5a8127ac512a851abdfe1b49e293cd0624ac672973cb164c40a8478d876c2e6373daa8
SSDEEP 3:MsEllllkEthXllkl2zE/lheXm:/M/xT02z
TLSH
T1044402046B800406C5001130416283501F70E41006176743659188325DC5A401D08000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 ee9d4824412be820607fa89e7e98fc3cc71c14a4c57d84499ead864b9a5d49e5
MD5 7b0ea8881a7850349a1640a8d1379c04
SHA1 141372e2e21379e748d99d9ab6bcf4233a2d9666
SHA512 5a4f1bd4f18b92cfc06b7f35d38404ebf5d29f6ce06b1633cb8e2f1d1875d041bdbcbcbd871d6e91eaef3f331eb9c037215a6fc872c2f262935b0eb2e89d56b3
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Jw:TkkhCU2QB2zbBxxZG
TLSH
T16A23884E1B6821E9D5D6083EFED24D617CBE0F588A2B689205E00C768CE20AE553E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3620_1383525470\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5848-80-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-49-0x0000022A23CD0000-0x0000022A23CDA000-memory.dmp

Download

memory/5848-57-0x0000022A23D80000-0x0000022A23D8A000-memory.dmp

Download

memory/5848-78-0x0000022A242B0000-0x0000022A242CA000-memory.dmp

Download

memory/5848-55-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-81-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-0-0x00007FFE37EDF000-0x00007FFE37EE0000-memory.dmp

Download

memory/5848-72-0x0000022A244B0000-0x0000022A244E2000-memory.dmp

Download

memory/5848-70-0x0000022A24260000-0x0000022A24282000-memory.dmp

Download

memory/5848-79-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-28-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-114-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-25-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-909-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-1006-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-5-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-64-0x0000022A242F0000-0x0000022A243A4000-memory.dmp

Download

memory/5848-1043-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-2-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/5848-1-0x0000022A092D0000-0x0000022A09546000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads