6aa88429f1559147c679a15fb0a25f6bbba6de8a29abaf995ede4dd6cbb09960

Resubmissions

25/08/2026, 23:46

260825-3sstkaxtes3

25/08/2026, 23:00

260825-2zed3sw1dy3

Analysis

user interaction
yes
max time kernel
600s
max time network
600s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
m0nkrus.nfo
Size 1KB
Sample260825-3sstkaxtes
SHA256 6aa88429f1559147c679a15fb0a25f6bbba6de8a29abaf995ede4dd6cbb09960
MD5 f4d837dca0de92b0fdd59a52c1b4d5db
SHA1 8196628d949ed5d1a9f198fe6838b647f0d9c14f
SHA512 4b93cff8f40c094461c75e5b1ac0392b318699ecf240641e75997473083b27d2e05a3aeb3f2c636acadeb45d56ebbbe629e32b8d4460803f5f6b6d5d1f81c2c9
TLSH
T16E2124073406758B0E3D8D81679DCE34DF0109A78B2A99F1376EA7D89B61314659841C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	chrome.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321752819212023"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
3560	chrome.exe
3560	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	msinfo32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe
Token: SeShutdownPrivilege	4704	chrome.exe
Token: SeCreatePagefilePrivilege	4704	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe
4704	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5312	4704	chrome.exe	92
PID 4704 wrote to memory of 2500	4704	chrome.exe	93
PID 4704 wrote to memory of 4228	4704	chrome.exe	94
PID 4704 wrote to memory of 2500	4704	chrome.exe	93
PID 4704 wrote to memory of 5580	4704	chrome.exe	95
PID 4704 wrote to memory of 5580	4704	chrome.exe	95
PID 4704 wrote to memory of 1124	4704	chrome.exe	97
PID 4704 wrote to memory of 1320	4704	chrome.exe	98
PID 4704 wrote to memory of 1124	4704	chrome.exe	97
PID 4704 wrote to memory of 1320	4704	chrome.exe	98
PID 4704 wrote to memory of 1384	4704	chrome.exe	99
PID 4704 wrote to memory of 1384	4704	chrome.exe	99
PID 4704 wrote to memory of 5952	4704	chrome.exe	100
PID 4704 wrote to memory of 5952	4704	chrome.exe	100
PID 4704 wrote to memory of 4928	4704	chrome.exe	101
PID 4704 wrote to memory of 2672	4704	chrome.exe	102
PID 4704 wrote to memory of 2672	4704	chrome.exe	102
PID 4704 wrote to memory of 1472	4704	chrome.exe	103
PID 4704 wrote to memory of 1472	4704	chrome.exe	103
PID 4704 wrote to memory of 4284	4704	chrome.exe	104
PID 4704 wrote to memory of 4284	4704	chrome.exe	104
PID 4704 wrote to memory of 2548	4704	chrome.exe	105
PID 4704 wrote to memory of 2548	4704	chrome.exe	105
PID 4704 wrote to memory of 3012	4704	chrome.exe	106
PID 4704 wrote to memory of 3012	4704	chrome.exe	106
PID 4704 wrote to memory of 1880	4704	chrome.exe	107
PID 4704 wrote to memory of 1880	4704	chrome.exe	107
PID 4704 wrote to memory of 1572	4704	chrome.exe	108
PID 4704 wrote to memory of 1572	4704	chrome.exe	108
PID 4704 wrote to memory of 3332	4704	chrome.exe	109
PID 4704 wrote to memory of 3332	4704	chrome.exe	109
PID 4704 wrote to memory of 4556	4704	chrome.exe	110
PID 4704 wrote to memory of 4556	4704	chrome.exe	110
PID 4704 wrote to memory of 5272	4704	chrome.exe	111
PID 4704 wrote to memory of 5272	4704	chrome.exe	111
PID 4704 wrote to memory of 2040	4704	chrome.exe	114
PID 4704 wrote to memory of 2040	4704	chrome.exe	114
PID 4704 wrote to memory of 3448	4704	chrome.exe	115
PID 4704 wrote to memory of 3448	4704	chrome.exe	115
PID 4704 wrote to memory of 2968	4704	chrome.exe	116
PID 4704 wrote to memory of 2968	4704	chrome.exe	116
PID 4704 wrote to memory of 3440	4704	chrome.exe	117
PID 4704 wrote to memory of 784	4704	chrome.exe	118
PID 4704 wrote to memory of 3440	4704	chrome.exe	117
PID 4704 wrote to memory of 784	4704	chrome.exe	118
PID 4704 wrote to memory of 2112	4704	chrome.exe	121
PID 4704 wrote to memory of 2100	4704	chrome.exe	122
PID 4704 wrote to memory of 932	4704	chrome.exe	123
PID 4704 wrote to memory of 3560	4704	chrome.exe	124
PID 4704 wrote to memory of 2472	4704	chrome.exe	128
PID 4704 wrote to memory of 2472	4704	chrome.exe	128

C:\Windows\system32\msinfo32.exe
C:\Windows\system32\msinfo32.exe "C:\Users\Admin\AppData\Local\Temp\m0nkrus.nfo"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffadd6ac728,0x7ffadd6ac734,0x7ffadd6ac740
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,13744468664573478136,706745745493754770,262144 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,3079065551750589662,10956510250465381413,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,7926983028718154630,2656857514691372816,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,8318944792622209346,14461000712101830648,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3824498134375697697,13793483578134996381,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4624,i,17730625784996636147,14166742242399981168,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,6346538757558737661,3893945990439379430,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,4714494130127820554,14797763056700677441,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,336752995162070571,7851860550129627069,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,9473167630508184190,7104119361452126464,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5628,i,18119552051922609828,16067033963361745576,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5520,i,15506805848775082302,3370906900409332375,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5872,i,11698416385309807835,18310799252704950380,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6008,i,5092104043749859269,7354431458025206234,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,15248104750734682484,4390130350233438659,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6412,i,12906080141132585190,3118718145191789363,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6312,i,674437080116174221,6050144598776479576,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5444,i,12794813971056581762,11306553197439153271,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,16600018348200539784,12746920716636846690,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7040,i,12175200348706751642,9555937716672687535,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7152,i,11353460017379634515,18080829640704456072,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5952,i,9350938902926864599,11874660315780258031,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:9
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6500,i,2947186533801249651,7764228235727958445,2097152 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,16625002090125705073,12802176904224924371,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,9437136657349100257,4983955083969949681,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,5455183001424516246,318077498272304630,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6820,i,11183581903901654007,9384671294298089614,262144 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,15269221271192304193,6740961765607376159,524288 --field-trial-handle=1832,i,10684113045333829672,16747675510072428788,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:2472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4496

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5044

C:\Windows\System32\msinfo32.exe
"C:\Windows\System32\msinfo32.exe"
1⤵
- Enumerates system info in registry
PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 94ea08521e5ffa616c03b3819d69902f3f781aba152f7dfb3951d7727825d0fc
MD5 22567b5079a44ebff5086398845faf56
SHA1 9344d16dc46ca9270e4678ecbc5fd0fca46028f9
SHA512 c166e3dd143c475b86ab513d4662f4e3b29acd882bc18389effa5329b31af8ba06e45dd77b477a1e29bb7124dd075da6228934045b7d51cdc10463b3a0c1bc34
TLSH
T172D0A73BD38409F1CB24537F146650CDBE3026185EB5231493F810EB69469E728030C4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a9e33895b20b809cf2c2042d0679635231d30e09d2ea1d50d5b0266d00aee40e
MD5 3313a326cd30f87962df7dc75bde304d
SHA1 a43192c96a6230fefd6e6eb6a80e99af4476be9d
SHA512 527d9065b82924ddd11914aab8b944459ea184d4be7d184628e9d71f8678ef6a5562ce6aebc286a8ef7a59ce403dc33bb9a95b9d1d85813d9994dfef4dc36f01
SSDEEP 48:YALlqMqoh6h1hwhrhThMVXYfoKsWRs1fskosJKsxts+cs3qzsjBsEFs9+sBrsMqf:DjhA/O9B6VIlCF5jBTDbSr96RCE
TLSH
T1D7C17BF7C3D8C52D885166F49B156F1FCE2A1A18431C3C26C8D8AF5B93E2872E21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5ec3e0d4f068d70febb40146fde658ea9b7d478bc266ebc80c6dff26b38e9f64
MD5 7911418812b98a17196e87caa2c502ff
SHA1 e9fdca8ae5185843fafb396a906336d029449671
SHA512 13b9e06cce1efe70e3f78c9441fc542dae1f744f45cf579c42775a0cbcf655514783393b72c3a8326a812b56d5d02faec645b477822acfa4563be4cfb0e56ce9
SSDEEP 48:YALlqfqXhAhYh2hfhXhzNh+XYfoKsWRs1EdKsxucs3qgqFscfwsRUrsoVqsNn4sx:D0umi0tx1NwIlCEdjuTtqjRUHVLA/K
TLSH
T1E3A18AF7C3E4862D894156F4DB15AF1FCE291A24432C3C7688D4AE5B93E2872E21539E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9930ae8c5de87e5d362f682795fd05e15532e75f2c6a42017e8abd1c14387207
MD5 b532ff7248e9c468e4093f1f2abae04d
SHA1 3ef1255887b0836c397d311732f426a56adae36c
SHA512 4cba183deae9361d7612b01ce455434e6003dcc8c9ed83414f1e2ed9d86c977ac6e6cd05c4fccdc915e0f35f7fa85f02c99eba7c2d8361f2d69a779b66b6d942
SSDEEP 48:YALlqMqoh6h1hwhrhThMNh+XYfoKsWRs1fskosJKsxts+cs3qzsjBsEFscfwsRPx:DjhA/O9B6NwIlCF5jBTDbjRbjoFHV3K
TLSH
T18FC17BF7C3D9C52D885166F49B156F1FCE3A1A24432C3C26C8D8AF5B93E2872E21525E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b987d4976450a9e2030bfb69050c152bc328515e49a65a8b5b8b2d10b62f32d0
MD5 d4ee5c4fbfaf702dcdd34354170cac27
SHA1 027afe1b048f1f99ddba9d023e3fa4b1b3f0419f
SHA512 f72b418eb3203b5191e37823800aea75580eaae807a3f457ba6eccd0cb84e2cdee3416c702ce73f8b77b756f6ac06e37977bd94dfcb3af4b8fb520436f875ac5
SSDEEP 48:YALlqfqXhAhYhfhXhzNhihdXYfoKsWRs1EdKsxucs3qgqFscfwsRU4qsNSn/+s8E:D0umitx1NE3IlCEdjuTtqjRU4+/uE
TLSH
T10DA199F7C3E4862D894156F4DB11AF1FCE390A24432C3C7688D4AE1B93E2872E21139E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 97827adc834b9fe5b9462391e1a7f334318130d346d391077b6fd0ed0aded2b9
MD5 1e384ec194cb4a449239577e1a1bcd2e
SHA1 aafa3d3206461a73038f53546cf2aac15ed32874
SHA512 2e3cbadf532c4e087357ddf7d3688f47015028d67a9b77eac931bebcdbbeb412d259c57e073ce599715562c81db0aed542d0fe83ca48c5ab4813947102020621
SSDEEP 48:YALlqMqoh6h1hwhrhnXYfoKsWRs1fskosJKsCrsxts+cs3qzsjBsEFsp4sy3a:DjhA/O9ZIlCF5cwBTDbyyK
TLSH
T128A169F7C3D8C62D895166F49B116F1FCE3A1A14431D3C2688D8AF5B93E2872E21525E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ae256004a8535dda57623b37636e0f5f18a762c4375fc0909ed4b9831c596634
MD5 35a18bb3f1192c0e83019c757ab5a3de
SHA1 adbe9f97ab3ef6348d3ebb3bea633ef4ad479652
SHA512 9177b5e009653d6cb5c3b10c301d32c5c3a1eac1fdfd40ad0b730c9079ed69b8cf0e5ff9c4a5dfe879947dd9aff0cfb511dc4786dd780616a537317a2fe266eb
SSDEEP 192:hR0KIooM2Lv7xkAPRp2Qae9GHsb+WNnC44tT2mk83skwcGHaOwqVyIsnAUge:hR0KIoMzfX7gwpW2v8c8Qalqe
TLSH
T16842C72EAD24697B6CDAD219FA227757D7F9102171D02E84EBFC892C05D76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 604174bb774330b65638b28394e08cc93b08f3b4bcb9ecf46a20c2805a97fb29
MD5 3b4173d3185ab23a4c68034791d0ad6e
SHA1 9f0092a017789e4859b1e735e6e989f7ff675367
SHA512 09e012634e0469319940513d499b8a3e9862a3482aba09c9e763b0d63a81ec690fbbb4203b5bc8e9dc8af8ceba8b48a1d394c20ca74ccea635588966cde12b62
SSDEEP 192:hR0KIooM2kv7xkoPRpmQae9GHsb+WNnC44t81Ykk83skwcGHaOKqVyIsnAUgE:hR0KIoMATXLgwpR1Yt8c8Qa5qE
TLSH
T12242D92FB924697B6CDAD219FA12B757D7F9102231D02E84EBFC892C15D76CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 917570103b7b48cd381b769bffe07b9189c380b1da8e1ba3c1a93f60f3aa9bf4
MD5 e4df41920669843cfe42a69e5d8dd27c
SHA1 c6d38e64dc3f88f7076a07f6e050a29ab19a4fac
SHA512 8e31f8e4d2cd547a9355b7ed488feea091429aa89f9e816ea75af91aba9c451f39658efa82117d0d8167394cf1265828b6b245f0ca12fe8e660d06cb6b89d960
SSDEEP 192:hR0KIooM2Lv7xkoPRpmQae9GHsb+WNnC44tT2Ik83skwcGHaOKqVyIsnAUgE:hR0KIoMzTXLgwpW2x8c8Qa5qE
TLSH
T15D42D82FB924697B6CDAD219FA12B753D7F9102231D02E84EBFC892C15D76CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4ed856cfd82c6f9_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\a4ed856cfd82c6f9_0
Size 191KB
SHA256 567631f55322da4d8b7cf843a15908494cebb0d0fe547cd4f607c552e28317b3
MD5 284f9e2f1e943951131504cd7031033b
SHA1 3844fe9b0c2ace4cebae31cd825bd3c9611ab8df
SHA512 f0c6237a6bb95cfa7fd4b400a0d9bb7a31d82c3adf2c401c737bde0f04fb34355d95101b0d3480700c8e319b2cd27dd5c033d1b89b8a870a5ac02a67d602d664
SSDEEP 1536:ho/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:SSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T16B146B715200F47BB913DE60A27E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8ba93045ced5bce2f94b68affedbcb674fd462888c94aaa868ef593c8b9d7146
MD5 636cd0c49a4ea1b6f9161de3e915fc23
SHA1 cc443c5494c9e9256db94eba29561091e371a2c7
SHA512 bb4d586085e7bdb41ee0ce8add9c2693b2f427b0e91833fb3e0f15a453e45fbaaf8f51507bee044f9696c412c5107b1745fd7d2be4ac2987a05f769b14ed05e7
TLSH
T101A002A107D45932E8010AB420C203806760EC60A537C73390D14145DEB31D19A51001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c4c755b1089ca6fc60d7722ca8de6c6e200fc18f74ffe79ada8ec78cb6e60913
MD5 c494ef898af94d923947ec23585c7315
SHA1 c7ad871558687f2fdfbe6da7c17003294c986c22
SHA512 43bca2a1f0293ce78ea9395cd41c0773f4d91e175c96d8389342ad7fcdfdbd8814c98467aae7d7acd1ebb71eb5019fa53a76ca1082c838b7ca46ec0a31a26a02
TLSH
T1E2A0027641D09CB2DE0153F0E46205426A62D9185571974765AD44969B5B1C15122500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ee1f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59ee1f.TMP
Size 48B
SHA256 e55d108a6b1a6c340481e549d9fbf74306e32b51fcc293157bfaa84ba76b76d7
MD5 add71c0030b33ce7208da0711295cb35
SHA1 5184a7a9ca65888324a8fd41345887ae8d6db51a
SHA512 e567cbeedb57de3ddf61467e390ed187c4de996d3548e62b0d3c5d63026886ac06d2706b094f595e148f300413efc8cef1ed77fbedff41acc1934d0bff46af42
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a9aa7698-683b-4ef3-9dd3-4c6f0c6b0b96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a9aa7698-683b-4ef3-9dd3-4c6f0c6b0b96.tmp
Size 13KB
SHA256 c5f091f7af1c39d654659cedce9de238c54f7b6b1bf5ec63b696aa10fc32804c
MD5 af02ae3a685f46a933130a82b9eeab94
SHA1 4b919c9dbc7508d1f3acbdbfcc3d8fffdd95da45
SHA512 fce950be4b0e3e2147a876d0b05b50c302efafca23a4feca9440cda4616e231f7e4ca444e5f7752d7f2e4cb0d5f35d7811d10642b5cb49a859ef52b029c21f2f
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU3xEHGtJidmZaw:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOw
TLSH
T1D452F767684C9A3B0FD8DA4CDC16BB4FACB50156A6A44C6447FB9C1803D57CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 e602b5b0f04207aa7f40c490ae22fd27d8b26d3815b2965afe2dffc4cc163cc7
MD5 bd9c4487ec5ee5c62cc0fb7bfa2a9c66
SHA1 ad4842e74add20ccdfb4dc632a394e21b520b47f
SHA512 a99907169eeb9bed8e11c01df9c9dce0d25a980796701105266284b45e19c06804b9ce01cf7b30abb8365b5e199247fb629f89bc54000b342b1aec875c798665
SSDEEP 3072:DUXOxG9nuTy1heAuN95jxluGxqFZILHwL3iE:wPJuTkwD5jxluGxqFZILQL5
TLSH
T14ED312D2EB6EBDB754BFC91D71972552C8C48803986D6E807AC44F4C63CECD39326946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 9e9d0b69da67c7b46d5428e55df558c050a6919c9a2233d803fa3cc843624e76
MD5 f3ff1aa600967464080512142c15b670
SHA1 91121750c6b209f2e706133f801590a35f3f189e
SHA512 14d5dfae77d80f41e571620446659361fe0edf558d0496339a896670584bf3825e17918b041db7da1713bcfe9db9403d0baa633dafc4ed5857cc5f36bcd103b2
SSDEEP 3072:WUXOxG9nuTy1heAuN95jxluGxqFZILHwL3iE:9PJuTkwD5jxluGxqFZILQL5
TLSH
T10FD302F2EA6EADF7087BCD1931962652CCC8C8079C6D6E407AC04F49628EDD29726D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 da0d0c8df37b00ebf74b99b31faeca87deb513090594d5a3b14505b16ed3765d
MD5 0001d66c0fb3873a350d5054d4fc87fd
SHA1 5c1f2cdadc0a50fb3b08fdde3da6d2590568345e
SHA512 962633593a2f780b84693a9c6b07a145ab908020ba2377188b562e0bd3e4e53f7d2ecc405b1f09e8d528dbe89eb8dae790c21fbd51c35e5bcf45ed9a22902e8b
SSDEEP 3072:iUXOxG9nuTy1heAuN95jxluGxqFZILHwL3iE:ZPJuTkwD5jxluGxqFZILQL5
TLSH
T1ACD312F2EA6EADF7187BCD1931962652CCC8C8079C6D6E407AC00F4D628EDD29726D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b4c322283ce41c83086c111a89f43787f5c23fb7636f4f81332e81ab99c93f91
MD5 ec89d0b3f77ee56b1aa43ecbff146987
SHA1 7f6cf7bc7146d39fdb8f7426167a9631ce562530
SHA512 a86c17c2d8c0f26aab83e3cb549f5fc21e0352d47cd0e0716fa6c1c6666f83aa1846b056c3c2ecb4a231a5a9ef591abb84c19dfb46b477b1724c9ace808a19c3
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5QcDaB6gGyvhyLfOLLCEbZP9v4a:SC0JeGnpDUDnKE1mLLCEbj
TLSH
T14BA13D71B02CD9B344769849F5426B43CDA521ABD631AE84EDD81F0C02FB0EC034243B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 56b3199c7a5441d0cafaee67471d9614f90fd9d422fa1abf1a54105af6046a87
MD5 b6dc2567cc735121065227a350344501
SHA1 87ec4b6e3e096e2a0bcce4897642eeb197e091f1
SHA512 a1e0cdfec2ad2ff58ff62f1ac7c499524d98415cd9a65e4228902720e5139590022e44aece62c54cc958fd914a13d4a93401e6299847d92f9d608c799ab5bbd8
SSDEEP 3072:QUXOxG9nuTy1heAuN95jxluGxqFZILHwL3iE:jPJuTkwD5jxluGxqFZILQL5
TLSH
T184D312D2EB6EBDB754BFC92D71962552C8C4C803986D6E807AC44F4C63CECD39326946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4704_1640062625\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download