46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5

Analysis

user interaction
yes
max time kernel
304s
max time network
305s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
teste.txt
Size 5B
Sample260826-epekrssbmb
SHA256 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
MD5 698dc19d489c4e4db73e28a713eab07b
SHA1 2e6f9b0d5885b6010f9167787445617f553a735f
SHA512 b123e9e19d217169b981a61188920f9d28638709a5132201684d792b9264271b7f09157ed4321b1c097f7a4abecfc0977d40a7ee599c845883bd1074ca23c4af
MD5 SHA1 SHA512

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	1276	chrome.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DLAOqmGFxrVoJkLiDy\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\DLAOqmGFxrVoJkLiDy"	wmpnscfg.exe

Executes dropped EXE 1 IoCs

pid	Process
2976	wmpnscfg.exe

Loads dropped DLL 1 IoCs

pid	Process
2976	wmpnscfg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	discord.com
83	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2976	wmpnscfg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1276	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321908740476886"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{7E9D4B14-77A2-4658-A28B-E8A22D4377D6}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\Root\Certificates\5BFA2343B459071E7527A65BEE454596D3EE21AB\Blob = 5c00000001000000040000000008000014000000010000001400000089b7085c32831c68fe8ff2e821945d52043f6bc30f00000001000000200000003fb6acd846a69396322aac2858f5aeb4441ea0558ce85a023668d4817649abf50300000001000000140000005bfa2343b459071e7527a65bee454596d3ee21ab0b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004200430000006b0000000100000020000000abee43fd023c5773196d5217eca9ec4d790183594b3d9bc7f8efd4d583a83aa8190000000100000010000000af5e9c0357343f7c2930eaa32ca7bfc02000000001000000a7030000308203a33082028ba003020102021000c22a9429c74367dd923f68ff581123300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3236303831393030303030305a170d3336303832363035313132315a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010091ae11305161ab3b33e64666752e04c343cab83116315b8e1a6c7b50ec5a5fcd3408e408612788f3409a2f8fbe230e5f497352bab5787daa177dcf822a6c04411553671973c8140b6ddeeccb179efd74caf5e881d1fc595ceab9bf96c3b1d70c5bfb217707233fd647d9acd57a7b9d937dd74617cdff773f3dc0cf09ed92ac64eae6897f80d79d4033862e16326e4e295fc9046aab4ef12c0e01929aee5582536c4545ddf899d24288985c5c1bd5a49ed9012503d5603b5c9b35338e2059041daf01c4b130e25c751c8b77ca8f76256c7d2ef62277b9ce993e5a81516097fc28e4a967d196707bee560b6034af3b776989aec6d711e77a38ebd33b77b88719850203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e0416041489b7085c32831c68fe8ff2e821945d52043f6bc3300d06092a864886f70d01010b050003820101002f7e8a4b19a98b894a99b71e96630e5b6a46f37ec6218308b9bbcd1a38733615c7249f8749e6b20a8768c5756ffa1fde9f26319da16c73661f69ea688aa825abd506d3d38eb4eab86f6b86d0bdfcb8497b89af8eb260058ee869f4e0266d69dbfe85b29f8fb5e812bf7e15df1479510c0c990645cca6ed71b2ec506b9aaed71f0bad07ca37f0eae13ee6e5998c485ed003f1a0c1de26dbdf576a2dea3a3a5e90d21d4b86046cd0c2f9b8a9c56abc366ddbcd661da9a311e98cdc2d24b482b53568c19ab5453603c63eedcb9444b76cd2a1953f4c167f3f800b2112647a0e0696199b887b86002af489ac992df27297d096297c9b49f4bb2fb8c76d932c8c74c6	wmpnscfg.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\Root\Certificates\5BFA2343B459071E7527A65BEE454596D3EE21AB	wmpnscfg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\Root\Certificates\5BFA2343B459071E7527A65BEE454596D3EE21AB\Blob = 0f00000001000000200000003fb6acd846a69396322aac2858f5aeb4441ea0558ce85a023668d4817649abf50300000001000000140000005bfa2343b459071e7527a65bee454596d3ee21ab0b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004200430000002000000001000000a7030000308203a33082028ba003020102021000c22a9429c74367dd923f68ff581123300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3236303831393030303030305a170d3336303832363035313132315a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010091ae11305161ab3b33e64666752e04c343cab83116315b8e1a6c7b50ec5a5fcd3408e408612788f3409a2f8fbe230e5f497352bab5787daa177dcf822a6c04411553671973c8140b6ddeeccb179efd74caf5e881d1fc595ceab9bf96c3b1d70c5bfb217707233fd647d9acd57a7b9d937dd74617cdff773f3dc0cf09ed92ac64eae6897f80d79d4033862e16326e4e295fc9046aab4ef12c0e01929aee5582536c4545ddf899d24288985c5c1bd5a49ed9012503d5603b5c9b35338e2059041daf01c4b130e25c751c8b77ca8f76256c7d2ef62277b9ce993e5a81516097fc28e4a967d196707bee560b6034af3b776989aec6d711e77a38ebd33b77b88719850203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e0416041489b7085c32831c68fe8ff2e821945d52043f6bc3300d06092a864886f70d01010b050003820101002f7e8a4b19a98b894a99b71e96630e5b6a46f37ec6218308b9bbcd1a38733615c7249f8749e6b20a8768c5756ffa1fde9f26319da16c73661f69ea688aa825abd506d3d38eb4eab86f6b86d0bdfcb8497b89af8eb260058ee869f4e0266d69dbfe85b29f8fb5e812bf7e15df1479510c0c990645cca6ed71b2ec506b9aaed71f0bad07ca37f0eae13ee6e5998c485ed003f1a0c1de26dbdf576a2dea3a3a5e90d21d4b86046cd0c2f9b8a9c56abc366ddbcd661da9a311e98cdc2d24b482b53568c19ab5453603c63eedcb9444b76cd2a1953f4c167f3f800b2112647a0e0696199b887b86002af489ac992df27297d096297c9b49f4bb2fb8c76d932c8c74c6	wmpnscfg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\Root\Certificates\5BFA2343B459071E7527A65BEE454596D3EE21AB\Blob = 6b0000000100000020000000abee43fd023c5773196d5217eca9ec4d790183594b3d9bc7f8efd4d583a83aa80b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004200430000000300000001000000140000005bfa2343b459071e7527a65bee454596d3ee21ab0f00000001000000200000003fb6acd846a69396322aac2858f5aeb4441ea0558ce85a023668d4817649abf52000000001000000a7030000308203a33082028ba003020102021000c22a9429c74367dd923f68ff581123300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3236303831393030303030305a170d3336303832363035313132315a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010091ae11305161ab3b33e64666752e04c343cab83116315b8e1a6c7b50ec5a5fcd3408e408612788f3409a2f8fbe230e5f497352bab5787daa177dcf822a6c04411553671973c8140b6ddeeccb179efd74caf5e881d1fc595ceab9bf96c3b1d70c5bfb217707233fd647d9acd57a7b9d937dd74617cdff773f3dc0cf09ed92ac64eae6897f80d79d4033862e16326e4e295fc9046aab4ef12c0e01929aee5582536c4545ddf899d24288985c5c1bd5a49ed9012503d5603b5c9b35338e2059041daf01c4b130e25c751c8b77ca8f76256c7d2ef62277b9ce993e5a81516097fc28e4a967d196707bee560b6034af3b776989aec6d711e77a38ebd33b77b88719850203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e0416041489b7085c32831c68fe8ff2e821945d52043f6bc3300d06092a864886f70d01010b050003820101002f7e8a4b19a98b894a99b71e96630e5b6a46f37ec6218308b9bbcd1a38733615c7249f8749e6b20a8768c5756ffa1fde9f26319da16c73661f69ea688aa825abd506d3d38eb4eab86f6b86d0bdfcb8497b89af8eb260058ee869f4e0266d69dbfe85b29f8fb5e812bf7e15df1479510c0c990645cca6ed71b2ec506b9aaed71f0bad07ca37f0eae13ee6e5998c485ed003f1a0c1de26dbdf576a2dea3a3a5e90d21d4b86046cd0c2f9b8a9c56abc366ddbcd661da9a311e98cdc2d24b482b53568c19ab5453603c63eedcb9444b76cd2a1953f4c167f3f800b2112647a0e0696199b887b86002af489ac992df27297d096297c9b49f4bb2fb8c76d932c8c74c6	wmpnscfg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\Root\Certificates\5BFA2343B459071E7527A65BEE454596D3EE21AB\Blob = 14000000010000001400000089b7085c32831c68fe8ff2e821945d52043f6bc30f00000001000000200000003fb6acd846a69396322aac2858f5aeb4441ea0558ce85a023668d4817649abf50300000001000000140000005bfa2343b459071e7527a65bee454596d3ee21ab0b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004200430000006b0000000100000020000000abee43fd023c5773196d5217eca9ec4d790183594b3d9bc7f8efd4d583a83aa82000000001000000a7030000308203a33082028ba003020102021000c22a9429c74367dd923f68ff581123300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3236303831393030303030305a170d3336303832363035313132315a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010091ae11305161ab3b33e64666752e04c343cab83116315b8e1a6c7b50ec5a5fcd3408e408612788f3409a2f8fbe230e5f497352bab5787daa177dcf822a6c04411553671973c8140b6ddeeccb179efd74caf5e881d1fc595ceab9bf96c3b1d70c5bfb217707233fd647d9acd57a7b9d937dd74617cdff773f3dc0cf09ed92ac64eae6897f80d79d4033862e16326e4e295fc9046aab4ef12c0e01929aee5582536c4545ddf899d24288985c5c1bd5a49ed9012503d5603b5c9b35338e2059041daf01c4b130e25c751c8b77ca8f76256c7d2ef62277b9ce993e5a81516097fc28e4a967d196707bee560b6034af3b776989aec6d711e77a38ebd33b77b88719850203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e0416041489b7085c32831c68fe8ff2e821945d52043f6bc3300d06092a864886f70d01010b050003820101002f7e8a4b19a98b894a99b71e96630e5b6a46f37ec6218308b9bbcd1a38733615c7249f8749e6b20a8768c5756ffa1fde9f26319da16c73661f69ea688aa825abd506d3d38eb4eab86f6b86d0bdfcb8497b89af8eb260058ee869f4e0266d69dbfe85b29f8fb5e812bf7e15df1479510c0c990645cca6ed71b2ec506b9aaed71f0bad07ca37f0eae13ee6e5998c485ed003f1a0c1de26dbdf576a2dea3a3a5e90d21d4b86046cd0c2f9b8a9c56abc366ddbcd661da9a311e98cdc2d24b482b53568c19ab5453603c63eedcb9444b76cd2a1953f4c167f3f800b2112647a0e0696199b887b86002af489ac992df27297d096297c9b49f4bb2fb8c76d932c8c74c6	wmpnscfg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\Root\Certificates\5BFA2343B459071E7527A65BEE454596D3EE21AB\Blob = 190000000100000010000000af5e9c0357343f7c2930eaa32ca7bfc06b0000000100000020000000abee43fd023c5773196d5217eca9ec4d790183594b3d9bc7f8efd4d583a83aa80b000000010000003800000044004f005f004e004f0054005f00540052005500530054005f0046006900640064006c006500720052006f006f0074002d004200430000000300000001000000140000005bfa2343b459071e7527a65bee454596d3ee21ab0f00000001000000200000003fb6acd846a69396322aac2858f5aeb4441ea0558ce85a023668d4817649abf514000000010000001400000089b7085c32831c68fe8ff2e821945d52043f6bc32000000001000000a7030000308203a33082028ba003020102021000c22a9429c74367dd923f68ff581123300d06092a864886f70d01010b0500306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f74301e170d3236303831393030303030305a170d3336303832363035313132315a306a312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433121301f06035504030c18444f5f4e4f545f54525553545f466964646c6572526f6f7430820122300d06092a864886f70d01010105000382010f003082010a028201010091ae11305161ab3b33e64666752e04c343cab83116315b8e1a6c7b50ec5a5fcd3408e408612788f3409a2f8fbe230e5f497352bab5787daa177dcf822a6c04411553671973c8140b6ddeeccb179efd74caf5e881d1fc595ceab9bf96c3b1d70c5bfb217707233fd647d9acd57a7b9d937dd74617cdff773f3dc0cf09ed92ac64eae6897f80d79d4033862e16326e4e295fc9046aab4ef12c0e01929aee5582536c4545ddf899d24288985c5c1bd5a49ed9012503d5603b5c9b35338e2059041daf01c4b130e25c751c8b77ca8f76256c7d2ef62277b9ce993e5a81516097fc28e4a967d196707bee560b6034af3b776989aec6d711e77a38ebd33b77b88719850203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e0416041489b7085c32831c68fe8ff2e821945d52043f6bc3300d06092a864886f70d01010b050003820101002f7e8a4b19a98b894a99b71e96630e5b6a46f37ec6218308b9bbcd1a38733615c7249f8749e6b20a8768c5756ffa1fde9f26319da16c73661f69ea688aa825abd506d3d38eb4eab86f6b86d0bdfcb8497b89af8eb260058ee869f4e0266d69dbfe85b29f8fb5e812bf7e15df1479510c0c990645cca6ed71b2ec506b9aaed71f0bad07ca37f0eae13ee6e5998c485ed003f1a0c1de26dbdf576a2dea3a3a5e90d21d4b86046cd0c2f9b8a9c56abc366ddbcd661da9a311e98cdc2d24b482b53568c19ab5453603c63eedcb9444b76cd2a1953f4c167f3f800b2112647a0e0696199b887b86002af489ac992df27297d096297c9b49f4bb2fb8c76d932c8c74c6	wmpnscfg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2748	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
5072	chrome.exe
5072	chrome.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2264	wmic.exe
2264	wmic.exe
2264	wmic.exe
2264	wmic.exe
3360	wmic.exe
3360	wmic.exe
3360	wmic.exe
3360	wmic.exe
2344	wmic.exe
2344	wmic.exe
2344	wmic.exe
2344	wmic.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe
2976	wmpnscfg.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2976	wmpnscfg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe
Token: SeShutdownPrivilege	4736	chrome.exe
Token: SeCreatePagefilePrivilege	4736	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe
4736	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2976	wmpnscfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4748	4736	chrome.exe	90
PID 4736 wrote to memory of 1952	4736	chrome.exe	91
PID 4736 wrote to memory of 1952	4736	chrome.exe	91
PID 4736 wrote to memory of 1276	4736	chrome.exe	92
PID 4736 wrote to memory of 4676	4736	chrome.exe	94
PID 4736 wrote to memory of 4676	4736	chrome.exe	94
PID 4736 wrote to memory of 4828	4736	chrome.exe	95
PID 4736 wrote to memory of 4828	4736	chrome.exe	95
PID 4736 wrote to memory of 5068	4736	chrome.exe	96
PID 4736 wrote to memory of 5068	4736	chrome.exe	96
PID 4736 wrote to memory of 5496	4736	chrome.exe	97
PID 4736 wrote to memory of 5496	4736	chrome.exe	97
PID 4736 wrote to memory of 2432	4736	chrome.exe	98
PID 4736 wrote to memory of 2432	4736	chrome.exe	98
PID 4736 wrote to memory of 6124	4736	chrome.exe	99
PID 4736 wrote to memory of 2040	4736	chrome.exe	100
PID 4736 wrote to memory of 2040	4736	chrome.exe	100
PID 4736 wrote to memory of 3324	4736	chrome.exe	101
PID 4736 wrote to memory of 3324	4736	chrome.exe	101
PID 4736 wrote to memory of 4408	4736	chrome.exe	106
PID 4736 wrote to memory of 4260	4736	chrome.exe	105
PID 4736 wrote to memory of 4408	4736	chrome.exe	106
PID 4736 wrote to memory of 4104	4736	chrome.exe	107
PID 4736 wrote to memory of 4260	4736	chrome.exe	105
PID 4736 wrote to memory of 4104	4736	chrome.exe	107
PID 4736 wrote to memory of 4060	4736	chrome.exe	108
PID 4736 wrote to memory of 4060	4736	chrome.exe	108
PID 4736 wrote to memory of 1176	4736	chrome.exe	109
PID 4736 wrote to memory of 1440	4736	chrome.exe	110
PID 4736 wrote to memory of 1176	4736	chrome.exe	109
PID 4736 wrote to memory of 1440	4736	chrome.exe	110
PID 4736 wrote to memory of 5656	4736	chrome.exe	111
PID 4736 wrote to memory of 5612	4736	chrome.exe	112
PID 4736 wrote to memory of 5656	4736	chrome.exe	111
PID 4736 wrote to memory of 5660	4736	chrome.exe	113
PID 4736 wrote to memory of 5612	4736	chrome.exe	112
PID 4736 wrote to memory of 5660	4736	chrome.exe	113
PID 4736 wrote to memory of 3276	4736	chrome.exe	114
PID 4736 wrote to memory of 1888	4736	chrome.exe	115
PID 4736 wrote to memory of 3276	4736	chrome.exe	114
PID 4736 wrote to memory of 1888	4736	chrome.exe	115
PID 4736 wrote to memory of 4524	4736	chrome.exe	117
PID 4736 wrote to memory of 3472	4736	chrome.exe	118
PID 4736 wrote to memory of 3488	4736	chrome.exe	119
PID 4736 wrote to memory of 4576	4736	chrome.exe	120
PID 4736 wrote to memory of 4576	4736	chrome.exe	120
PID 4736 wrote to memory of 752	4736	chrome.exe	121
PID 4736 wrote to memory of 752	4736	chrome.exe	121
PID 4736 wrote to memory of 1172	4736	chrome.exe	122
PID 4736 wrote to memory of 1172	4736	chrome.exe	122
PID 4736 wrote to memory of 4688	4736	chrome.exe	123
PID 4736 wrote to memory of 4688	4736	chrome.exe	123
PID 4736 wrote to memory of 1176	4736	chrome.exe	124
PID 4736 wrote to memory of 1176	4736	chrome.exe	124
PID 4736 wrote to memory of 3100	4736	chrome.exe	125
PID 4736 wrote to memory of 3100	4736	chrome.exe	125
PID 4736 wrote to memory of 1456	4736	chrome.exe	126
PID 4736 wrote to memory of 1456	4736	chrome.exe	126
PID 4736 wrote to memory of 5480	4736	chrome.exe	127
PID 4736 wrote to memory of 5480	4736	chrome.exe	127
PID 4736 wrote to memory of 2536	4736	chrome.exe	128
PID 4736 wrote to memory of 2536	4736	chrome.exe	128
PID 4736 wrote to memory of 3692	4736	chrome.exe	129
PID 4736 wrote to memory of 5224	4736	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\teste.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdf073c728,0x7ffdf073c734,0x7ffdf073c740
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,15180870657443869691,10624647922112804235,262144 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,7705927059622094754,10641628879235264610,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,17841534862698684748,10629583492937942350,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,122944211752572358,10208791849458675301,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,795246285605900184,6666503022866858143,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,9997870175032125219,5373488116899266591,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,1351560682142534699,1763495710410709045,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,12864944009584956155,2080539502903596127,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,1474359868933612541,16966187316098435226,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,5590688102081340363,5040549435521773211,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,6319303556532174252,10376245058898512435,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,6643325925462073269,10828643135622415065,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5496,i,4195721484202130471,5223499463113022615,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6288,i,9465317416437296777,10468616660657223603,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,2621368382659360284,17016883371908720498,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5576,i,11560512125942401657,14540984921874454537,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5764,i,8287909947184004461,3506634003012248623,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6148,i,6730279449659217546,15457861562223718431,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,9100701113096459001,13207436815751483302,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5436,i,18438552543174465377,12131064608930916516,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4728,i,8559878132959011317,14154695488202550476,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:9
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,1339143679162979637,10007122651207916407,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,8541611050481706629,9338414997830016034,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,15271621300626708928,18084016004283660137,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4744,i,18301421696469279062,7571900718272128444,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3628,i,17596391632612148979,2429098401645269267,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6244,i,14683203231571611052,6592061477248094655,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6552,i,14112217688602885562,5502009582525908053,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6596,i,13663108557619118941,4198541986267030223,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3532,i,5863081047882232676,18051667015333330305,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6808,i,6347174487025323353,7788469885179325560,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6260,i,1786490323954808163,15574703229020940516,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6860,i,11233235847304546301,10755852416045638913,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6772,i,10601662648547933116,10804841862269740891,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6844,i,15700503131655525166,14199168083677110147,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:12
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7228,i,1185559547676643629,3690639021114751246,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5464,i,11712690408162953437,14230344407657362142,262144 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7312,i,8435050501837314911,9607907788262185170,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6448,i,15788717617286826811,7764269562972924237,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6032,i,9854304188066058478,18198864438705214675,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6224,i,15856126975606566357,18380833869804581566,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6776,i,3838021558760980536,244952655008864130,2097152 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,900400425314273187,10708741751687781568,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6548,i,11414920949922309156,18139345449268288741,524288 --field-trial-handle=1904,i,829759688984985002,16158741820670819671,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:1820
- C:\Users\Admin\Downloads\wmpnscfg.exe
  "C:\Users\Admin\Downloads\wmpnscfg.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of SetWindowsHookEx
  PID:2976
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get PNPDeviceID,Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2264
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3360
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" diskdrive get model,serialnumber,size
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 18KB
SHA256 40f088fce01605128e76e724490a6dabb727793e37a075ce6b2d37a53bcd7635
MD5 1f71a8705633e092f61b51bcfedbabbb
SHA1 734de3cf8cebec41efb6139ad505c79f9699e374
SHA512 bb6d3289034f402aa04dd6cf3773af78fcb2f9b7ad8f4dbafde6c5036f83ca20ebec1a1012487f8e92b96f164c98ecabdd2b4a2d085f452927e244b3547c217b
SSDEEP 384:mnIFkUJzhIqsxwWDL3J4vWFGu9CKbfweJ9j79EGB8SMcRunTEXiW2:mnUaqn6b2WUu9Hbflnj795BvdcQyX
TLSH
T19E82D074A84A188D470E437F33729C2B53A882E12D77DEF0984578EFA81BA38571B5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 212KB
SHA256 e3360af9295325713057606ad414ccf715f0036fbe3fa4a719cd34efb9571b36
MD5 29593640e9dbfbda9ef90c0cefb66731
SHA1 5cb0c3ba58d3b4a6bffd81ff933952d6291b6070
SHA512 b5e27a6a4764d7bd8f03d3a4fc504148cdfc916214c83b2532114641d679182aeaa27cfff4f9412bdb725fe4bd0de2d1b7bfac9d3c54eed03ac4849e802447f1
SSDEEP 6144:IDRhn+5TGuZsuVExu9zJQ+J/YuD8J2fhYSBB:IDRV+JsuoqQ+dFoJOhB
TLSH
T1B62412ACF70F97DA34B4CAC99685EAF1123C9FB0FB0399C92446259B87900B4D886353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 32KB
SHA256 195ebcc81c480e7107eb513744813b2e1d7879a319a51ed8c29e1e44e7571f80
MD5 d03c5555c7c4757db5bcf26f77d4ecf9
SHA1 003811ec5af001a960746e1852a933cf4ef7fce2
SHA512 39996cb0df254018039a703ec6c872764726e256d63f0d9790708e41679532e2a83d0e35d29eb0f46f84bd123bd689fbe675fe1670c513461c5852fdb70d07e3
SSDEEP 768:7n/g5A2h/6dQArQBKAIoK9E5y4UqavDpq:Lg5Aw/aQlbYE5j
TLSH
T126E2F1C9DBA015E07289CE7477BF8E5ABC47D00A028F5496633A468E473D53E75930EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 71KB
SHA256 2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
MD5 4b73e2ff3024784eca66d2120a9bcb22
SHA1 2870bcb8ece10145e089262bb6634d18ac85bec6
SHA512 9ebe0b2cc7ed7298d931fc246732ed90881f0252b957afbf14f390c75c1da3fddf1b3fbb00be8d489cbb7b5a18f9dbda17a24e18594d44ebba4b7ca3f50bb10a
SSDEEP 1536:MO6PxhqwEppt5fUo8w4d+X5JlhLzcua67BYePELa:M3qh7VdDf8GPH
TLSH
T1F0630245820BA35EE09D4A79D27481F61FC2CB5C2BBF5C27538289AB5F57DBF6410134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 592818a68483d155a361dfe75fd0be7bf5d6e795e1fb9329fc6ef719bba94217
MD5 c796d15f15c63dc3ad27d5c5ca505fba
SHA1 6c03e885f56fcd704ecdf2c13dc44bb988261630
SHA512 f335b7acdf5bcd82e9322e3c7705763793da829e73cd50f95912645743f193f9b641f53ba6a3d63b573cdc80b6749d4422c1989271cf43daf8fbbd5a4a2107d1
TLSH
T16C0146001D848920FF949B35AD856CC372F1C5EC78631E4E8C8048F85B6A5F0014A5CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 4e01cb7fe40e78475dedce962f5f1a5db02026dc138fd8221e12093dd275b870
MD5 f9143dd12bfc490abb0da5cb924dd201
SHA1 eadc175c4104860bda59ebdfd33ca0d26c7683df
SHA512 770d052e3a530efb9d831105200f061a7cc380968ba9b8b49a3187ffbdeffc461557c9a8a9a8ed720d84b1a2e068dbba48da32a0b47b4d6b23a6dd956cfce977
SSDEEP 192:mPL6BC+/rdW3zgtJXN7YflwdsSx7NFmoHLvhOL:mj6c8vHX5rxWz
TLSH
T1DE028C9028EF07E0FF1F8E3597C59D8635B2029C71270E528880FB79B78A7A104B06F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 6d88b78e16d1c3e8bb40a63caefdb56accc8ec9f050065fdf2b357575d2f7bca
MD5 5ae1830d580c073da3b2b18961d3d20d
SHA1 d8278758b0f1973b3a9bf4b894fb402d4bdb3176
SHA512 869e57b98923402d20496425c6c63331c4df7cd9481fd24c8c77fe1efa65aa2227675cec0367607348909eaa751199a60544a2266e3cb6043eb78f2ab0590ba8
SSDEEP 192:UPL6MC+/rpWtzxtJXemtflwUESx7NFmosLvhOG:Uj6F8AHXL7xWf
TLSH
T1FB027C9028EF07D0FF5F9E7597C54D4235B2529C71270E568884FBB9BB8A39108F16E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 32d55a21887e1b36042761b77b8f9a1d25824233b07ff8176c5034b9408f7273
MD5 06fff695417bc82c5a5105a9c166dc6e
SHA1 f3160ece4124e246f186fa02e80ffe292f9c666c
SHA512 c818c7bd981dff4073c7ea35f32f52bf101a7c1ca6dcc22060b9ea8e9e1dae937a840d5f1c20485d8eab9b946bdc544018b63b6ecac05e171584b2f5a6ea06be
SSDEEP 192:DXKsTDk9DqDPPLq6cUauis1yZNvDVOp+NP79VDW/uDODWpDW+DIDtSDhCQTNlrbx:DXKsTDk9DqDPPLq6cUauis1yZNvBOp+1
TLSH
T1F3228CF7C3E8C62DC81156F4AB266E1FCE290A14531C3D2AC8D5AF4B93E2571E24578E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 cc88362b6678a29afb22dd0148881c3d37e6071e483dcf1a552709d80b386658
MD5 ad5124da02bac9084a1b8ce4c9eada21
SHA1 ae34c4c85ddccbfc9054d0ad9f9afb9187ecf65e
SHA512 1a39bfb5e720cfc608582e0d8ace60bd80b72cad788b9835fcbb8ca13d7dd4a6e309b206dadde7fba5416d6654f354dd1a6204ff5b6cbe524e10aa017a02a810
SSDEEP 192:DXKsTDk9DqDPPLq6cIDIauis1yZNvDVOp+NP7IQTNlrNHDW/CVDWqDWxyDrDmDRS:DXKsTDk9DqDPPLq6cIDIauis1yZNvBOg
TLSH
T160329EF7C3E8CA2DC81156F4AB266E1FCE2D0A1453183D2BC8D5AF4B93E2571E24564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 af3aaa68cc9da9fcbc62492c55cf89b8a7543a4b61311c3e1dbe49528b77e0c8
MD5 0ee4c748ff92de730c476f6070f46f79
SHA1 46fe707d599a2db50224bb189c48a58867db5e64
SHA512 d6edcd44050a393d779c0b935be91a4aad56a1bb871ffbff320c2524c8ffabe90702404834035c70cac84065ed97465e1b828d6426f74b494f0b6a3109b87582
SSDEEP 192:DXKsTDk9DqDzauis1zmZNvDVOp+NP7OD5DWIDrD8DWQVDWoDB:DXKsTDk9DqDzauis1zmZNvBOp+NDOD5A
TLSH
T1C1E18AB7C3E8DA2D881156F4AB266F1FCE290A14531C3D2BC8D5AF5B93E2471D20478E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 912da9f96b92e05c0a093e4c0126522babaff3c93cd2b49d29f7367db65af6e1
MD5 f050f9f33c4844a0a17ee7fa4c0040c8
SHA1 c69db30a8bbde0e6721f5ce4b84104076081ae69
SHA512 eb31059df9555d960f897e74d7c60702b711bf45f471a832dcae5298fe2588d5b043694f67901e537a46787c67dda4c213c8ece895bb94596cdbc41dff2e758d
SSDEEP 192:bRrcBzyPqZv773TPRpvvFkJ9ZHsb+WNhp+2wo0+qC2+uDaL7MQVyIsnAUgE:bRrmzyi5HLXmbwLk+2vakUE
TLSH
T14252C42AB914793BADD6C229FA22B793D7F5103225942E84E7FC8D2C14E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9f3efaf394ec0ca9cb753038638204414015c88a00b56be4888dd467ba9f0faa
MD5 288760628865f3d653dbd5333146f30a
SHA1 b856f2ce1851c804c4faca7739ea357fe44319a7
SHA512 b86b8391e3aba40f2d7ec496788ca665d3107f701f846a0651397d367b40032c9ef967e669212839e9422e331553f3e21266e1c7c41763196de20764d950d442
SSDEEP 192:bRXyPGZv7jAPRp2e9ZHsb+WNn+2dKuDaL7WQVyIsnAUge:bRXye5qXdbwvdDaOUe
TLSH
T19B32932EBD19793BADCAC229FA267793D7F5103621942E84E7FC892C15E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e67ba1b07de178ba7430c69adf47d85675a8404dfc659a2c7a2610cf40d50104
MD5 a13e00fed3bf3b12b130cf9fe7e10192
SHA1 d91dd2178240f3befe4d6fd03f80070717c3a2aa
SHA512 007b2a01dea601eabb32c66d05519454fc09806aad498fc63c4e0c9a7dab76d5ed95c080fc381c19eb4c9299fe91dca79e45d1c9e37b529b81f91681d169a27f
SSDEEP 192:bR0cBz0P0Dv7sib3TPRpvvKPkC9ZHsb+WNfzkzp+2DLvcEca0qC2auDaL7MQVyI4:bR0mz087gMLXYbwIhvHA2TakUE
TLSH
T14462B32BA824393B9DD6C229FA21B757D7F5206625D42E84E7FC8E2C18D36CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 58bf09ca6dbb0e05d9fda2f215091149e7c621ad83767dd43e56472a7bdef725
MD5 26edce3327ba2104efb8510c9bbeaa8c
SHA1 9b3b0af6ea814547c7cb4187ddd24de8d0e35c38
SHA512 fb25161dfa9436bec4af9fb5fe03e5bae26100965a53a735b300a32c783bec0c97bfd1cef05dc8b358323a5bb547b41631f15fbb1c3e9beaaf9fe30decc36c5e
SSDEEP 192:bRrcBzyPnZv74E3TPRpvvKPk39ZHsb+WNhp+2w9yAFqC23uDaL7MQVyIsnAUgE:bRrmzyP5dLX9bwLHAt22akUE
TLSH
T1EE52C52AB914793B9DD6C229FA21B763E7F5103265942E84E7FC8D2C18E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f93e9ba35168e6fb9c02ed88fb4f3432edd6bdfb9710844a05af4d6299359997
MD5 c6d4fdbdd8345296ed4f987645625cb6
SHA1 5d3742a959a7afa35a8b70b676859ab393197e18
SHA512 a955c9eb9380d544df2bce2c0bb5bbae9a0fff35021497c1f1d4c0d6b7b5f98b3ab108c1079ad46b208b66ce78de8f0b6c17177ead0b3bdc072d67d74789b2a7
SSDEEP 192:bRrcBzyPnDv7siE3TPRpvvKPkC9ZHsb+WNfbp+2DLvcE9yAFqC2guDaL7MQVyIsv:bRrmzyP7g3LXYbwxvIAt2JakUE
TLSH
T1F552B32AB914393B9DD6C229FA21B767D7F5202665D42E84E7FC8D2C18E36CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 69264514d1ea1c775c5af0d513ad7f1845c02652fb0d7b44d3ec0e5d21282ce4
MD5 763abe9a02f70ccb4905fea2ec02074e
SHA1 a5b9074b0f1a00953bf1ffcc36c2e0ad850e0c30
SHA512 8cfe088eaea52cbbd2ef187ecee3e4ea03158aa934492579c8edf804d8ca86a9c116207677e21194a482280c8802386d0104350575bdd244ac673ee65486e223
SSDEEP 192:bRrcBz0P0Dv7siE3TPRpvvKPkC9ZHsb+WNfbp+2DLvcEYpoqC22uDaL7MQVyIsnv:bRrmz087g3LXYbwxv8023akUE
TLSH
T13F62A32AB814793B9DD6C229FA21B757D7F5202625D42E84E7FC8E2C18E36CC321B057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79dd4d5d345a26705d7dc253f43257ec47830ef1141d9f1630c38a9866805915
MD5 3077c9f6e2bfcb98b4dcf03a75bf40f6
SHA1 08023cedbb79486337b08020e1bafa0a166ec6d5
SHA512 8cd77b95a7c7c24e0ad43066e9ee61ebe6d09356b127f29a477f704a6c59f2f6f5d93946348207c3e8625ff17ccfa21872e406c13386c91bc4318dc720bb14d3
SSDEEP 192:bRXyPqGv77APRp2e9ZHsb+WNn+2dEuDaL72QVyIsnAUgE:bRXyiyyXdbwvd1a+UE
TLSH
T1D542932EBD15793BADCAD219FA227793D7F5103621942E84E7FC892C15E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bedf1f13de531c29744564b6f501d42318017e239f15f66ed72799f93df2b4fe
MD5 278f6a40dfc38b4fd273cda0affb32d4
SHA1 27c7965e230783f18cac788237a534473a3acfbd
SHA512 7cbfc2268f6cb952453d1061a4835c5faa6f09035a802ceba0c5209a3a52994cad138a0dc36a68bf948a75208cbfacfb3bc5bf8922591ef7f3e768356cde4a3f
SSDEEP 192:bRrcBzyPnFv7siE3TPRpvvKPkx9ZHsb+WNfbp+2DLvcE9yAFqC2guDaL7MQVyIsv:bRrmzyP1g3LXTbwxvIAt2JakUE
TLSH
T13952B32AB914393B9DD6C229FA21B757D7F5202665D42E84E7FC8D2C18E36CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 d2d2acbaf2c1c56870617a494bcce65df5189dcb13034eae8c885392643f1baf
MD5 d24c298b235301f00495bda44fa00213
SHA1 b033aa748a1857cbeabe3fc2c1f430cae62e192f
SHA512 265f95e3d87135e38d93d3dcf0859fe60afb79286e3f38ad09c9acf89329f93a8984084d8fee7c174759ce3bcfc7bd4f3396f8d83f1c45eaf4c0b84681188042
SSDEEP 384:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWXODNs+ErU38kHGfepSrpb1FnGzm:ZbNE7KxkXqKf/pUZNCgVLH2HfgsA8OB6
TLSH
T1E652086B684D9A3B0FD8D64CDC16BF8BADB202977674092493FA5C0803A57DF114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\a7e6258e-37d1-44da-95aa-81b3664cb653\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 89f158f54f47a2c3c021c7d0c3a8584601f54530ac18df8f47526e60766230c8
MD5 59cb8ab876f68cc61682d379dc021a85
SHA1 285445a6c19f47971ebcc77b82e42744a0cce7bd
SHA512 24280c360f0860423096e18a3f2aea14ad071774fae38f8336392ec2bdf18b94f85c147427e4cf333c9894038c5b59e58e2b559556f17f6104a84b025f0cff9b
TLSH
T1FCD0A7A7E4570451E7FB4A56567211BF42753C8829E6D248E003352D1876EA7E222EE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 c1582e82d19b34da2c0514597c642b336fd780dd776858c61a793b2f606d7d08
MD5 6fb2b17c8f77f8a66d7f532ef26e502a
SHA1 f31f0aba76b62186fc7d6bab1bb7f58e521023d5
SHA512 ea8ddf6e33a58582452b0c63ee645842654daeb586fb78b691b333b428b197c66ab9318c3cac41fc4e4470ca7b28c7fa12b37053bdb9dda91b0fe9efbd62241b
TLSH
T188D0A7A7E4565451E6FF4F565632117F4265388825E6E148A00205291856EA7A112EE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a8dca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a8dca.TMP
Size 138B
SHA256 30c222f6e3f25b0ee6dd9defd0a6bcef34767b363c7937848161b3285b0ac626
MD5 1c524e5ac060415dcc2538ca2eba12e7
SHA1 0767cff66097cb1c5fd9e787566b42e1fbc32fc0
SHA512 1aa623442fc5e9dd7bd4c6e43318089b944da673da792a3294de3e32d322be93b1793640c9a316e27c303fdc53c3c7ad92f6a314c4a66c359e203313dffc209f
TLSH
T1B5C02BF3F446040097690B514332427D43043CCC0AD2C08CB00331183133E3B3101ED3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3ef43a5b5448eddc6778a967377d85ee9ae1ec7e8d97db5e82cea43fc01dae6c
MD5 5c7fd52fd19cfa60f88c7b3ccdaa3b5b
SHA1 9f9bec1c50a692d486983903e6224af8f8471dea
SHA512 6f3f26c805e094048fafad84400b99de8abe8cfe168142294e779908ebc26e879fd9ccaca5a80ab8e41ea701504bbccbc835c4f93dcc4bcce850d9b529b16fc0
TLSH
T190A0029042815571C05906F110C64280F310581123D5131584D091A98DF51444172C90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f75dd59e182ab53b7c61774217d36f460a2b321f72ef263b2c5856874656f8f4
MD5 44793f450ce4d778ef1dc4247acce977
SHA1 d225a6431cad08fb483fefeae1bd6882862084e8
SHA512 d0d623afe9c98368d3bec7e0918310ff8088cd1f15cec61f515f21d0f8b91cd756526d586bd260194ce0abc3f0c94104ac12cc1b676b83989af3b8233c4c845f
TLSH
T19EA0021141C00C31DD064270606506C926664D2575918317A491997CABEB7D58951582
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597c1c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe597c1c.TMP
Size 48B
SHA256 61b5421312b9ecb7dbe44c3b9aed95bdc65a15143ef380df60ee7edb0d5efe76
MD5 90d02b85bd90cd025275d340ed736c9d
SHA1 450f0a16a5c53849ffa69360fe6614affeb7d13f
SHA512 c02535f5591a7976a7283fd0bd3ca37f079879a1a59686894cf7378a2b1edbf08a1717ccea667345b4c61bfc10122ac3315ae1fb6db14e82e9df537eef56d27d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f967af25-78b4-4c1c-a6f4-d2d4efc98cde.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\f967af25-78b4-4c1c-a6f4-d2d4efc98cde.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\8ae80cdc-10bb-4875-992b-00e7eab98a18\index-dir\the-real-index
Size 72B
SHA256 179ea17e7b17a0a1a17cd93fca9ce27d9f3f7ca1668a83adc72a906e459e70b2
MD5 e875443024b2ce8491f99cce4d03a370
SHA1 28ef657819ee2b2b528358be3373e82d70af73e8
SHA512 fecc356bece2be7d6f93d16f2ba8cad1e4d5b0f9b492e58b5a88334b14f938b1341091a07495feeaaeec20e07aa72e1f84c528f245680d160e7ec1a2c03f8f6e
TLSH
T11EA0021043C91491D01012B560150BA13380E95044404723449031CC8E915C85952495
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5adc48.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\8ae80cdc-10bb-4875-992b-00e7eab98a18\index-dir\the-real-index~RFe5adc48.TMP
Size 48B
SHA256 2dcaae6408ddd8152882229d090b190dd755fea29d4d99973129317dba9bab56
MD5 ef9032dffa3f6b926e2ea7db1f8ddf36
SHA1 25687b1b91452e9aa89d933d64bfec31c6aa88c3
SHA512 1d3302b9dd45b4ef8f7b63d31eeaf1e4739a2835d85fff3860500de253d61aeb93090786b21d743ee5c309183c9e9e8f3edc9573721102505894562ab08bde2b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5afafb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5afafb.TMP
Size 178B
SHA256 85effe562fbe7d207d2c4998f565f04c78e7dd6859d21ad84ba450400869f1b2
MD5 befbaa8c828ddc982eb4d4233a539b83
SHA1 4d4a202ec0c19bac6c01849aa8c15f536c911cf2
SHA512 3fef1856a92a41f0bfc1b29b5cafcb2e59a11ac440b49af5138768d81250f1b922f55be9894c919baaf3ce9db8aad0b104b8008797be4ed957fabbded059518e
TLSH
T1D0C08CBB909295D22F3428EB81573ACCCA7E7FCC8CC0EA8C9423308D233596B5001D20
MD5 SHA1 SHA512 TLSH

Submit Download

d757adeb-cf3c-4a05-bc8b-0d635585e821.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d757adeb-cf3c-4a05-bc8b-0d635585e821.tmp
Size 12KB
SHA256 4e20a801cbf7f01ed6ce48827dbc82afeae9818b7f2e784a175077c5ccc0b17e
MD5 feddf2c8037918e1a02e07ecdaef02e0
SHA1 5fc15763f945ed90f8873e1f47e65410bbb00dfa
SHA512 509607ca2699465b9fcbbe5d7a4fcfb3943db80a5e220b6e679d6c8c6c6d6619e40b50aa4c263912e65a2c7a932ed07f5b381fc70ad146b7a1bdf9958ebed7d3
SSDEEP 192:bRrcBzyPqZv77APRp2vFkJ9ZHsb+WNhp+27qC2YuDaL72QVyIsnAUgE:bRrmzyi5yX3bwLn2Ra+UE
TLSH
T13F42A32AB954793BADD6C229FA22B793D7F5103221942E84E7FC8D2C14E76CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 82e8b1fe7bff94a718ff2395fccb8e50c942003b08c47f39378f7d3501f26010
MD5 9a99c0156a620380eef7230d0f5de3aa
SHA1 6beabdd4509ad1f92be957c2d7baa1bff79da26e
SHA512 7b838df1473d4298fecbbf3614631242aabfe57d1d027ff3b6b87933dea8067bc009f0fa62fad15a27306e4786a84d45cadd1d405ac57668b5524c181e5bf0c2
SSDEEP 3072:uKSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcW:uKSrbKKpL/h1L1xKMsln6zQcW
TLSH
T1F7D3127676243FEF0FE8257C600F384F4CBE9347A95D3BAC469E2155C6096E89B82123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 7adcbd75e7a32f0a234353e7420ac4df7a570dc242f18254cf53ca411da79153
MD5 fc4624c734a0895a54899cae47790c12
SHA1 1dc4e0a8ad553acf91a72b117c3d11106220f47c
SHA512 625287cf17854f3a14da26a28196071b622effc4540886e92fabab0e4e1e44f4c46ca90db8c87cc13af1f302b943906e960b942974abb7c45b2ead80fa13b357
SSDEEP 3072:JGSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcW:JGSrbKKpL/h1L1xKMsln6zQcW
TLSH
T160D3127677383FEB0B982679600F398F8C7F5187695927AC479F2122C645AE49782223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 896c19de342644095e288d2eda47513aa35b8bbfd382ebde2ad6ac452d29c8f3
MD5 9ba7b6f84efd41503c9e37042df9284c
SHA1 db15002e3c2460515aba71e0a59d7bae2ea46a2b
SHA512 4e559198f5f93e5d05341d5b985ee6c5b76fc4f8a8306af864a78aa6800e5e7af070c717b257aace0fcc0c3be7bdd03e435c36a531709c68eb6c26d8e8f90c35
SSDEEP 3072:lKSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcW:lKSrbKKpL/h1L1xKMsln6zQcW
TLSH
T155D3127676283FEF0FE8257C600F384F4CBE9347A95D3BAC469E2115C6456E89B82123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 af10980c2967c1a27fa7440109e1fd21d322519f2450cdeb7d59a65358f597ba
MD5 9f92e3518c16cd304ade5389a1e173fe
SHA1 e069c27500cddfee8e562a8f0091bf245d4f26aa
SHA512 c5be1f1152c68ca3006fdf66f1853e8df242692eeead98315a84751a074f80577dcad45bb117c112be257bb7f75a45f71a8f6b108958f8b6a783d5896e363a91
SSDEEP 3072:aKSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcW:aKSrbKKpL/h1L1xKMsln6zQcW
TLSH
T174D3127676283FEF0FE8257C600F384F4CBE9347A95D3BAC469E2115C6456E89B82123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b3b84dea2ae2784eb9c609efa5fd4235684451417f83c4a72a347039358e7f70
MD5 e3f868904b8a8a24e1f254e72e125c41
SHA1 b00f618e39487893135488118a427a09ea6ce8a9
SHA512 86ea77da47ceab7c08507cbb49164ce6d357279c14e280b0d7824374a33d53a1a242ede7bdfdc184f0a0d727cf429ac41e603677859780b2a0b0fa28bae50bb6
SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok5LdD8B6nGyvLlAOZbdOv4a:0C0G7/qffEDUDpQvcAOZbe
TLSH
T19BA11A31A42D5C375AB2D48DFA466A53DFB560A76920AF44E9DE1F0801FB1EC1343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ae6f81a95df7b0f541c63303e2fcbbd832dc2fd8a809792693499583a8567b75
MD5 b0f6569a2045da756f238cb93d8307e4
SHA1 849406e92ed626d37e12a870c89d23a132aafd90
SHA512 1f7f69aebd112e3f124047f0df2e059a95dcddddaf9ccc2e6f353130a9fb6321815ee32e38844e8c82a77f02367af7f1c1d2e3a592271994992ec7f955d5967b
SSDEEP 3072:8GSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcW:8GSrbKKpL/h1L1xKMsln6zQcW
TLSH
T1A4D3127677383FEB0BD82679600F398F8C7F514769592BAC479F1122C645AE497C2223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 6d636846a9dc28894565a7da9e6053322f55267ca280fbd02e540f21408c2f13
MD5 b1ee51218cf4ae409589d6f722eb8e8a
SHA1 6e08337ee1ffe3fea115ba203c05210b51048bd0
SHA512 c2dba86d95848cd535d42b1d76128962bb8d13d852b1d3b6165795dd8f583d36d63e402d5fb419246b81b8318807d97afacaf2926ba825ca02abb046b2ea9a25
SSDEEP 3072:5+lSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcW:5+lSrbKKpL/h1L1xKMsln6zQcW
TLSH
T118D312767A243FEF0FE8257C600F384F4CBE9347A95937AC469E2155C6499E89B82133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ugp3qcrmra.tmp

Path C:\Users\Admin\AppData\Local\Temp\2ugp3qcrmra.tmp
Size 122KB
SHA256 689a72c278df319cccf8c28b8b6e40272aaeb38cd767b6024b8262093012daf5
MD5 9b9d9eab51a7354a6e6959c76ffebb6d
SHA1 dc47ea9633134cab592c061e3290ad0a4024fc4b
SHA512 d817d5590f54e47f94f04750464dbf5925adcfb22b30b8c6a749a31f353b1591aca71bae5600963b013a4a41dff1383ddfe6ab22d5435ba6bcdd334e4441d5d3
SSDEEP 3072:TmrICKSVgoC4I0voE7mLYzrQYkwSmJTQSaMm5/6FbU+uAg4:TJCKS04I0vozCWlubU+Rg4
TLSH
T12FC31A579BA91029E2A7DAB8CA724911CF717C850B74E7CF1350489E0F62BD4AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp59B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp59B0.tmp
Size 2KB
SHA256 632c85ae23ba7efd2056ade20e5a928409c5df1ab26b4993829e41e77bcbb177
MD5 d285f4f520f092e6966ee2ff399e15ee
SHA1 9b6b3746430ee6e4e7e135d8ffb64004092a286d
SHA512 483fd5f7725199dafe4d659dd4af2d1576d048d2370654186eda8545da7eed7fd9eb0c09c1b682c167be1d1a9cf85e00c713b38629f3908a10213c7fdc9571f3
TLSH
T1D3515ABB98F854C87C0AFAD7221DAF1904508B3A890F8E2D26D538C51AB07A03E25705
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp8546.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8546.tmp
Size 2KB
SHA256 ae494bcc384cdb3038d64899ecc8b85c6d13ac7eef8822080e61bc4d4db97917
MD5 b54bf2c147a562c110a67cbb24d27a19
SHA1 393249504bc233c877130a48b783df880c225588
SHA512 9b9fdec280a6b33dbfc03e7c1b84f9ca71ab223a28e10a2011c098b9ae449df253cbe8ef0dae49d1cb8157634764724ddf56fa131d9db87b8fbebb66f5d8ec7e
TLSH
T1A9512A925A5ACCA01C4C8D42E50F8D691407C7081E597523D6A281C42CEE7D9BE9FCA2
MD5 SHA1 SHA512 TLSH

Submit Download

TmpE895.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE895.tmp
Size 2KB
SHA256 08c0d9b002862c7f81af00f1c99290c5894b472c7a0b88b8c0d73a2c12652cae
MD5 4ae60698cb5ebce993e4606709e59683
SHA1 0891088e81930cda5a6ac6ba7e97a5cc59976626
SHA512 899649a63e8a96488d466e7fe29cebd7efca687e88c241406fbcec9045e6e84d254dfb475bf2724b67ac197ddc43943ed858fc650328d736e2be74b3919c20b3
TLSH
T144511A101C24D82C3819ECB90E5E3567D9A456007EC8FAEEEEB96EE4A57F364DC69801
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4736_409128636\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Roaming\ISOLogs\debug.log
Size 2KB
SHA256 cae66d67d882e1a7fc81e87a6ddd9cdf7c9f0131b0c10d6ae089756c36a213db
MD5 86d2c8dca7ce82ea26d3eba5cdb25c4b
SHA1 f8888a2c4f19fb2404e4bc728a6f42d9650e2344
SHA512 d98804164951a39e875eb932b0ab7ed5475eead3f679fe800c986f790ddcef43f2152af42438ae1f1db20133b661dc03d5a3e143ef79c844ced43b201eff828d
TLSH
T1F9511FC59F2340A946E285A19236D0E15FDC434D5B3501B19379A01BA9E807B73FFEBE
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 765573.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 765573.crdownload
Size 23.2MB
SHA256 7fc0c4b02e5cb4e9e9667d8bd2130780515e68111a93c0bca0c371432661c89c
MD5 146852aaadca34a265ec48777fcaf786
SHA1 e9c8e3a654b9f9e5e80aa81eb5976945bd39e119
SHA512 771616a36a7c3dfcb3cdc7fb00dc3aaa6f2bcc53ee8d92529c17bd245f7e4e422b7aa2d4bd587695ec8a4b0b7ff4bc841bac69ed9840e6b40efd50168ad2913d
SSDEEP 393216:perZF4vRTy/9OIkDesQEUA14iLlyt+aW3hwF5rDbFh1+1f0p78yn+O8MIOK:yZF4Zu/9OIkDe1A14UygaWhwFB/14Min
TLSH
T1E237331127E80665E2BE8F79D5601091CF74B5075B4BEB8E3D8CB0ED2F623819D81B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download