1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Analysis

user interaction
yes
max time kernel
270s
max time network
313s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker.exe
Size 1.1MB
Sample260826-13ectaff58
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
43	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3264	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322558344398595"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
4940	chrome.exe
4940	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AutoClicker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe
Token: SeShutdownPrivilege	1192	chrome.exe
Token: SeCreatePagefilePrivilege	1192	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe
1192	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2176	1192	chrome.exe	91
PID 1192 wrote to memory of 3264	1192	chrome.exe	92
PID 1192 wrote to memory of 2180	1192	chrome.exe	93
PID 1192 wrote to memory of 2180	1192	chrome.exe	93
PID 1192 wrote to memory of 4572	1192	chrome.exe	95
PID 1192 wrote to memory of 4572	1192	chrome.exe	95
PID 1192 wrote to memory of 4116	1192	chrome.exe	96
PID 1192 wrote to memory of 4116	1192	chrome.exe	96
PID 1192 wrote to memory of 6056	1192	chrome.exe	97
PID 1192 wrote to memory of 6056	1192	chrome.exe	97
PID 1192 wrote to memory of 3036	1192	chrome.exe	98
PID 1192 wrote to memory of 3036	1192	chrome.exe	98
PID 1192 wrote to memory of 3372	1192	chrome.exe	99
PID 1192 wrote to memory of 3372	1192	chrome.exe	99
PID 1192 wrote to memory of 4612	1192	chrome.exe	100
PID 1192 wrote to memory of 3948	1192	chrome.exe	102
PID 1192 wrote to memory of 3420	1192	chrome.exe	101
PID 1192 wrote to memory of 3948	1192	chrome.exe	102
PID 1192 wrote to memory of 3420	1192	chrome.exe	101
PID 1192 wrote to memory of 2408	1192	chrome.exe	103
PID 1192 wrote to memory of 2408	1192	chrome.exe	103
PID 1192 wrote to memory of 4472	1192	chrome.exe	104
PID 1192 wrote to memory of 4472	1192	chrome.exe	104
PID 1192 wrote to memory of 5712	1192	chrome.exe	105
PID 1192 wrote to memory of 5712	1192	chrome.exe	105
PID 1192 wrote to memory of 6072	1192	chrome.exe	106
PID 1192 wrote to memory of 6072	1192	chrome.exe	106
PID 1192 wrote to memory of 4540	1192	chrome.exe	107
PID 1192 wrote to memory of 4540	1192	chrome.exe	107
PID 1192 wrote to memory of 4724	1192	chrome.exe	108
PID 1192 wrote to memory of 4724	1192	chrome.exe	108
PID 1192 wrote to memory of 4352	1192	chrome.exe	109
PID 1192 wrote to memory of 4352	1192	chrome.exe	109
PID 1192 wrote to memory of 3348	1192	chrome.exe	112
PID 1192 wrote to memory of 3348	1192	chrome.exe	112
PID 1192 wrote to memory of 3276	1192	chrome.exe	113
PID 1192 wrote to memory of 3276	1192	chrome.exe	113
PID 1192 wrote to memory of 2512	1192	chrome.exe	114
PID 1192 wrote to memory of 3340	1192	chrome.exe	115
PID 1192 wrote to memory of 2512	1192	chrome.exe	114
PID 1192 wrote to memory of 3340	1192	chrome.exe	115
PID 1192 wrote to memory of 4372	1192	chrome.exe	117
PID 1192 wrote to memory of 3620	1192	chrome.exe	118
PID 1192 wrote to memory of 5556	1192	chrome.exe	119
PID 1192 wrote to memory of 4940	1192	chrome.exe	120
PID 1192 wrote to memory of 3348	1192	chrome.exe	121
PID 1192 wrote to memory of 3348	1192	chrome.exe	121
PID 1192 wrote to memory of 4124	1192	chrome.exe	122
PID 1192 wrote to memory of 4124	1192	chrome.exe	122
PID 1192 wrote to memory of 1452	1192	chrome.exe	123
PID 1192 wrote to memory of 1452	1192	chrome.exe	123
PID 1192 wrote to memory of 5760	1192	chrome.exe	124
PID 1192 wrote to memory of 5760	1192	chrome.exe	124

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffb49ac728,0x7fffb49ac734,0x7fffb49ac740
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,17490593487066791509,10920801569334404835,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,14899430680587018708,2689855621444870092,262144 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,14417589232813462838,13070685278080705151,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2840,i,2329756762932795038,11798292028686082379,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,1730960379083237470,14409346259527425141,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4584,i,12996867947097820276,12412144187452196901,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,7744555849651505559,2041322663909926852,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,827689663504986623,7938027346849308610,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,5378944460200066294,1846893625164968183,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,11007781038692742218,2168880588335370996,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,17925855935640657455,16321520161141930733,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5788,i,2737161884067428221,11831919327959799323,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,12339972656676273148,15799484069263258786,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,3399729525668307059,689693730133661948,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5476,i,297907740697012117,6902523082700665957,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6480,i,10829419106008244676,4781403674389790150,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6176,i,283128695436134165,14544077117016212825,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,10763133975447135708,17526666045455159677,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,4928119573040627751,14979412005057991170,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5536,i,509532337239567581,4760966557108220694,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6436,i,10502083116730151983,15767180564970536604,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:9
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,12376820973780588040,12900852751206784842,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6436,i,1425824864760953236,8729639095364787660,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,488449920780359513,6044401195642022141,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6616,i,17232855998591452167,16398571399596523049,262144 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4484,i,6014521026963842212,14407251908993190674,524288 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5804,i,2673351389488788427,2163117034922092430,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6132,i,7110130764084727742,9726906853821086386,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5788,i,12895224449444990020,10101049710891143605,2097152 --field-trial-handle=1880,i,13876912495866690409,4469013004992768235,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 26KB
SHA256 5c8a554490b939a8c1274d4b42cb06276182cfc9b70ea6396869b1569bc5e9b4
MD5 bd2ed07f2cbdb147db0f58fba570c0a4
SHA1 a55f05ca3fc6b18495e24b0eda90eb695f0ed03d
SHA512 c0beddcb3939ade985df2f2c16ebb4090e668d6a126d460f3ab9305a1fcb8ed6a04d093a4f697aefcc54d769ab26fa338b78764b6fe72f961e47692062e1ea1c
SSDEEP 384:nffXPoCpfcdmP1TTB6xuxsPTo5X9CVEB3JRlV3x8NY6Q4OrM142aUrz8br/RXtLA:fICdCmPZAxKsE5Xw2fQNYv4OjRbrw
TLSH
T1CAC2F1B3035F1E6A88F0016D967D02B7072165DF27D00B619D5989ACBA344B8E4B4EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7b46b3c51f1c002289df84a3bed3a8a1790a33632356cc1e627159f77a26cbd6
MD5 bad09f40c6f153145da53ca671410b3d
SHA1 fdc8b3099321df547adc289a88fb4b969b222b30
SHA512 787686b8ca9055219874e43aaab702a186e5624e4db8fbe7d71a9e10c1d79212e93fc19e066528b10d8019f98822d116d257c1d43ea57bb2239a94813767ae89
TLSH
T160218665617E2420CFA5CB7C74BB48AAAA3309E404CDFDEA436065ED3DC3B8E15C1983
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c83b3dcd5b7ef0f965031d1e974d3903e92ae6779d3ba9da4b897c5e660f654a
MD5 a5510c91a812a654b79162ebe67c14b1
SHA1 5e3a552e68f5c5b193a3c23998f037ffa454d2dd
SHA512 852e93a52cbe59d48be04ad5307968cb357863a7a4ca79854e9206f7b394b0cfc5e2d9f8896624b9e0afb2f84eaf57881ae4e61050ca699a23030c67c82463a2
TLSH
T1292140A6613D1421DF3A077D74FB849A2E330CC4040E3AEB4665717D36D379E19421D3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf803c4986f32dac5a9d95268b82f73d2a91fb775061ce132b555b29205528e3
MD5 b63bb5c22d3f21a71f4d9688d137a582
SHA1 6349cca9ee07be984efd63442d9636c9fc8ee6f2
SHA512 ef4287ead17c26a6faa86cd513fe4d413f7752595df29fb541cb64d47814fd61972a76a72925d16801b6eb1789682c35d960148e1b3e0a12bc950ab5ef035819
TLSH
T1125198F7D3E49A7DC41152E8DA207E1FCD2D0A28121D3C6688D8AF5B83E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e867b7945d19eef1a1715db5a85a50e0ae579b936c0c824660d78ba2fc452537
MD5 62851f12cff9c9caf693a9437f5b39e2
SHA1 1b6ad17e535db8249ac1f05d6c8cb38f786f618d
SHA512 c702c77cdf2096ff4b196f3c9ee2651b1e8b1aad7a2cad1a71b2d95d79cb29f29621f8e2c99030715553d2e1bd7d30d52bcc00eb14807da94bac1b35eee95721
TLSH
T16881DDFBC3E8957DC91152F8EB116E1FCD2D0925532C3D6689D4AE0B93E2972D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 be1436228119ba66a27d123eeb12c5045ae7a64fc2d62c53856830b48e712db1
MD5 94766a42c2f53ead050307760d94672c
SHA1 707d0e5428ea1824bc39f3e9cf6b30481c68b59f
SHA512 2f3d3e99f812b2ae5b31cf6cbed8972770b819beb31c424d3e8b63d35eeceea748e9a92d1122a700099c774d8cd664da6395bc1d7342a2c76db298fc21ddce74
SSDEEP 192:iRp9AwQv7JQAPRp2799Hsb+WNnTIdM6qBTwkwFaMVyIsnAUge:iRp9rMPXcvw0dOMlaoe
TLSH
T1BB32B52EA914393BADDAD219FE267793E7F5102171D82E44EAFC8A2C15E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a77479645292d0622f38cef8cdc8bac00314951d37f669d5061c9aefb51467f5
MD5 e4347ee5374e2bc2a65e835e893f8a99
SHA1 ad2accff56930ce152c2a3c7543f19449aa810f0
SHA512 295c0a68e09a9639511b5a81b42173e4ce5a28dc2cd6abafbf4c5531fa20729fdc0ffd0d30d66591ec900cf2ec5b3cb45583e1399bf4c267c06c09079c752179
SSDEEP 192:iRp9AwBv7JQDPRpz799Hsb+WNnTIdMJqBTwkwFawVyIsnAUgE:iRp9rRiX/vw0dTMla0E
TLSH
T10142D82EB914293BADDAD219FD16BB93E7F5202171D82E44EBFC8A2C11E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ed748985cf3e528ecbbe90c106f43081d29cdcf2dc55a8bf3c2c56a7676071ed
MD5 0decc81ecb9b12f64cb29914d7aeea06
SHA1 19e4718316b1513535d55246d5d38e0314b82305
SHA512 1c71de9d7970a21b9a4fbeb5a075b8e00d9c9edb479bee89890a567eea32f9d1629ad7d9568b22b189264a6b02942bdb535e32bba3a673c9a033be22ff027cb4
SSDEEP 192:iRp9A5Pv7JQDPRpz799Hsb+WNnTIdMJqBTwkwFawVyIsnAUgE:iRp9QHiX/vw0dTMla0E
TLSH
T1A342D72EB914293BADDAD219FD16BB93E7F5202171D82E44EBFC8A2C11E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8642eb6f0b067fddef7e2834fb91f9d327b2c23c131a04edd41f91b4b58bf0a7
MD5 a7eba7e4d16b150aa6eb0af55632ed06
SHA1 f1693a36b00b9e02cffaa02ba0266ebc226fd9e0
SHA512 279c1d93fdddb4aa226d9a270a884773c7bdd4c314e167ef644309c8c1e0a41d7ec402c53192efed6e8002d84e7e8d7a6c907988bb199f9f7e45856c1b4a675e
SSDEEP 192:iRp9ARov7JQDPRpzBl599Hsb+WNnTIuNp2MfqBTwkwFawVyIsnAUgE:iRp9c0iXJvw0m2JMla0E
TLSH
T1A842D62EB914293B9CDAD219FD16BBA7E3F5102171D42E44EBFC8A2C11E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 02577511222e317d5e91c97cd04bf798669a1e4ab7544d9f7f7b8799d8946704
MD5 ecc38c033ba5e309d702a53f4407ea51
SHA1 6c686f2380258c6b746fb873b18c136fd738c85b
SHA512 c5add8a845769b5ff117a5e61371212038e0081130845be255e94d3cdc4aeacceb28f2cfc8209243791dc5ecb38138e3055db004b450e1dd9ea631a1c4ef8ca3
SSDEEP 192:iRp9AgFv7JQDPRpzBlq99Hsb+WNnTIugsWMOqBTwkwFawVyIsnAUgE:iRp951iX6vw0eWUMla0E
TLSH
T17B42D72EA9143A3B9CDAD219FD16BBA7E7F5102171D42E44EBFC8A2C11E75CC2217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 935cd991e95aaeeb62bd481e99f2890fe8daa5b1e042d4c4f2993aadb01dea54
MD5 2e4b472607b663dfc30022e228573896
SHA1 14691d6e6968093bf467ee7ff755a3402fca3008
SHA512 81d3b24c56fdf3df6eefc0759d77a39281e13bb6044ca5516c9f2277864b1f43e0ccbd49cb0dde7bc357a38d2bbdaa5407f7ca8e9bf626fd19d33d8df94427da
SSDEEP 192:iRp90olv7JQDPRpzBl999Hsb+WNnTIuEoYMqqBTwkwFawVyIsnAUgE:iRp99ViXNvw0uYoMla0E
TLSH
T18242E72EA914293B9CDAD219FD16BBA7F3F5102171D42E44EBFC8A2C11E75CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 453e25934b620714406f517e18c06f58423b99855edee15aabe90125d3b8e8ca
MD5 a41ec4c828e1942f549555489157391c
SHA1 55764c54643f6b01bb490a9b663423d65aadfbb4
SHA512 901b57a8051102f23ce99ef0512ef511f2fb1841fce9e4ba3dd45ea2893911264e481a24d17cc97255971d9e326d189696c4ab555ad7059afb1da049e60deb77
SSDEEP 192:iRp9AzKv7JQDPRpzBlq99Hsb+WNnTIugsWMOqBTwkwFawVyIsnAUgE:iRp9eGiX6vw0eWUMla0E
TLSH
T1B942E72EA9143A3B9CDAD219FD16BBA7E7F5102171D42E44EBFC8A2C11E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d54c4bd315619f96d779c4a7c5d242e1ebe179328483b44849527a6f38d05e1c
MD5 07dc59ac2a9dfacf2cebe4cc01c40080
SHA1 5ffa594b2a065b71ecfb07283a2ea2e54fb15645
SHA512 5d7d53cd7a3fe669b0da65dce9b92a4edafbf1affffca22f598a1cf1a47b73e4fccb7a386f7d736af865e40b44a3f2bcf5595e9dad6d753ef646375c7275d140
SSDEEP 192:iRp9AwBv7JQAPRp2799Hsb+WNnTIdMfqBTwkwFasVyIsnAUgE:iRp9rRPXcvw0d5MlaIE
TLSH
T15142B62EB914293BADDAD219FE167793E7F5202171D82E44EAFC8A2C11E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f8a5a6d9fa6306d2d43671682f8cd5f01e25b536393106372b270fd706602be8
MD5 de730b2aeeeec4bada7b2a4e6d8aff51
SHA1 ce003378b2b8ce21493c89cd0792e79bdeab112b
SHA512 edfc6e71ad2bc0cb0560fa10c4e4fd9f93635c6c9afa7bdaf4fcdae5ce3c9a73eaf8c7ab8af26d2f6dced4937a8f102e04f4b247ca751b2020ea5c3cb8954481
SSDEEP 384:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRXODCB+ErU3hHHGKuSb2r7d:GUH+7KxkXqKf/pUZNCgVLH2Hfgsn1OeF
TLSH
T12052E92B648D9A3F0F98D68CDC16AF4FACF1025765A84C2457FA5D0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 49321c52fbfa5c8614a9a0baeb0083d3344bb29a2d32c147577a5d6ebdf9588e
MD5 5e70b50fc522ea86b7f669d39e346b6e
SHA1 27afe79280d15fab70c877c446601558c6f82b2a
SHA512 4a3b083b315ecefc52a20f28593c34b2da3bfcb15307d829f5d710c07d3aa2178e03a0bd81144b84c8193aa6de9122225b38437f8f34e0c9d5fead3cfd229656
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 84d4125e97e1aa58459a10ef3f29c97eaff1bd4bfb1fd1a09c649a492e954c99
MD5 fc9c0ab34ef154804201447a090db459
SHA1 f2b17240f24bd9800b04869421e9e6d70f454136
SHA512 e6897fd9d138eff6c3e824de9cd9d1a9321a5990604d015d06a21ac2f77fc85252182c4ea16bd52364b50e8d9d32ea7f948dae05532993d96fbf09c1dcb1a3c0
TLSH
T13AA0022182D11825CD5142F068672DC332728C24155243075A931448ED5B1E89116148
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9038ea8f838c4e89f4fb3285e5b170b28d5431e6d75c1135e7a8b246bdccaf7f
MD5 49ae3704770b415f008c28dfc2202d2e
SHA1 0a6a1a91e9c85ffe6196167f0d90656c3ec49988
SHA512 697e57359fd97cc36c294bb1bee19c94c21aecee75784741ee64f5fc3d15736927634c467c3ea7336ca633a108bab56fe71b9791815b431df66515fb4c8c9edf
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5k4DNB6vGyvk54ECTboRYv4a:5C0Ngjf5ZKSNqDUDHT7qECTbog
TLSH
T114A119B1E46D4EB794B6C589B5477B43DEA421A7A561EF80E8DD1F0C40FB1E81382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 32dac8f23b2eb0331e26bdf093d43f967978cf6dcdb556b200509e263d9dc6af
MD5 09b45e3ab66b7684899d0d37b30bb5b2
SHA1 88c2209fe3b7837001ea384f559bdea357da03e9
SHA512 7f31b67c43295dc4e594d9157e5d16dbd51f223ca4034ed7ef32ddc6c10b48b96153096f016540d52e75dd66a3928dda1913964c3ecdb0c455058739ba901303
SSDEEP 3072:MeZunh2CsNK4/rAyi77LCLOZ8BfiGqjMxtTk6qUZL7gG:Mekhh4/Y77oVfBDtTPjZwG
TLSH
T198D312A185FC2C7ACA4A835F58033957979D408291FFAC28A6C55FCC05A2EE547C3F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 f047c05231eb7e082ff07d58d91ea63ea62f3eef8293d6b33707e6dc1049a50a
MD5 927308c585e5802d9efb57ae0ea2dd20
SHA1 fa107c5d58a4e7e3484607432e2a1ec7890edcf3
SHA512 c8e694604d83a76d1cd929170c016497f8bbd9d4754e2dbbe0a7a5fc41d94b76c90af943dd25c964015a16f18480726b6bb8dd7670054fd5578262497455701a
SSDEEP 3072:xeZunh2CsNK4/rAyi77LCLOZ8BfiGqjMxtTk6qUZL7gG:xekhh4/Y77oVfBDtTPjZwG
TLSH
T1CAD312A185FC2C7ACA4A835F58033957979D408291FFAC28A6C59FCC01A2EE547C3F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 981e46862721c04cb081790660f338de62167320207c67b4694b32836cdae3d1
MD5 5fcbc817f2a8b118ffa385cba565af4f
SHA1 471023e50b769607892d8fe99d15a3f8b2ecc4ca
SHA512 66678b36089fe819f276cec824971b50365ec118bbb755c410b93847132459fe648d5ac7cd1738bc7bcdbcdc47d45b4a0bc26373b959e938f9ebccde644f9a92
SSDEEP 3072:seZunh2CsNK4/rAyi77LCLOZ8BfiGqjMxtTk6qUZL7gG:sekhh4/Y77oVfBDtTPjZwG
TLSH
T1FAD302B289FC28BA8A47479E58033D479E9D408391FE7C2CAAC55F8C0562EE547C3F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7afe5a4-0708-43c4-84ba-a2ed790259c1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d7afe5a4-0708-43c4-84ba-a2ed790259c1.tmp
Size 130KB
SHA256 4f9091947f846501966b90ffd31f1109ec637e439a2dd22e5d8e7018361faeef
MD5 d765412db76294d9b9fe4f8bc8aa1297
SHA1 1031584a51fb5fedb335ef8b4be928769245b540
SHA512 6f4004a01c0e1638aa2d1ef4b07489c7640ba4381dbed9ec284a0b39328a2e1c1dc5a748a8f9e66e7ce03bc050678d4758a339d9ae067c482087be65033e2494
SSDEEP 3072:QeZunh2CsNK4/rAyi77LCLOZ8BfiGqjMxtTk6qUZL7gG:Qekhh4/Y77oVfBDtTPjZwG
TLSH
T19FD302B289FC28BA8A47479E58033D479E9D408391FE7C2CAAC55F8C0562EE547C3F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1192_1048475794\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download