a75423fc89ea00f44aec7f1b40f603240fa19315dcbe55f0098c49765272f8ee

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NexusRecoil.exe
Size 5.2MB
Sample260826-tfshlasapc
SHA256 a75423fc89ea00f44aec7f1b40f603240fa19315dcbe55f0098c49765272f8ee
MD5 696a13b28248cbf7920beabaa99ffd7f
SHA1 97a4240725355d2089fa6e0b694ed201c2ac1601
SHA512 25babe581cd350e86bbf12e285cdf1ac0b187fa6d658098cb352a170d4461cbdbf9d8e37d9fbea71e329f86f2ca58ea7b9c59d0424479b2347a671219316cdf7
SSDEEP 49152:IX92p/+GRRBKrsPoffwbU7iu/lvYlvShw1Gj/W1Q47Lx/ZOLzpsjAsMKl5gLz66f:utGTXZut+S0KW1iLPTc/hS3
TLSH
T1DE467C11A3A44516C73E86BCC0634105EB71BC8353E2C6CF55A4FE892FB7BC29A76267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5444	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322336582033643"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{2CA0BFB2-16E2-4B6F-A6EA-FA7872981964}	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
1820	mspaint.exe
1820	mspaint.exe
1236	mspaint.exe
1236	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	NexusRecoil.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe
Token: SeCreatePagefilePrivilege	2936	chrome.exe
Token: SeShutdownPrivilege	2936	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe
2936	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3788	NexusRecoil.exe
2936	chrome.exe
2936	chrome.exe
1820	mspaint.exe
1820	mspaint.exe
1820	mspaint.exe
1820	mspaint.exe
2628	SecHealthUI.exe
1236	mspaint.exe
1236	mspaint.exe
1236	mspaint.exe
1236	mspaint.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1728	2936	chrome.exe	90
PID 2936 wrote to memory of 2928	2936	chrome.exe	91
PID 2936 wrote to memory of 2928	2936	chrome.exe	91
PID 2936 wrote to memory of 5444	2936	chrome.exe	92
PID 2936 wrote to memory of 5740	2936	chrome.exe	94
PID 2936 wrote to memory of 5740	2936	chrome.exe	94
PID 2936 wrote to memory of 1120	2936	chrome.exe	95
PID 2936 wrote to memory of 1120	2936	chrome.exe	95
PID 2936 wrote to memory of 4788	2936	chrome.exe	96
PID 2936 wrote to memory of 4788	2936	chrome.exe	96
PID 2936 wrote to memory of 4564	2936	chrome.exe	97
PID 2936 wrote to memory of 4564	2936	chrome.exe	97
PID 2936 wrote to memory of 2104	2936	chrome.exe	98
PID 2936 wrote to memory of 2104	2936	chrome.exe	98
PID 2936 wrote to memory of 472	2936	chrome.exe	99
PID 2936 wrote to memory of 4192	2936	chrome.exe	100
PID 2936 wrote to memory of 4192	2936	chrome.exe	100
PID 2936 wrote to memory of 3000	2936	chrome.exe	101
PID 2936 wrote to memory of 3000	2936	chrome.exe	101
PID 2936 wrote to memory of 5016	2936	chrome.exe	105
PID 2936 wrote to memory of 5016	2936	chrome.exe	105
PID 2936 wrote to memory of 2148	2936	chrome.exe	106
PID 2936 wrote to memory of 2148	2936	chrome.exe	106
PID 2936 wrote to memory of 2308	2936	chrome.exe	108
PID 2936 wrote to memory of 2308	2936	chrome.exe	108
PID 2936 wrote to memory of 4476	2936	chrome.exe	107
PID 2936 wrote to memory of 4476	2936	chrome.exe	107
PID 2936 wrote to memory of 1212	2936	chrome.exe	110
PID 2936 wrote to memory of 1212	2936	chrome.exe	110
PID 2936 wrote to memory of 3976	2936	chrome.exe	111
PID 2936 wrote to memory of 3976	2936	chrome.exe	111
PID 2936 wrote to memory of 1144	2936	chrome.exe	112
PID 2936 wrote to memory of 1144	2936	chrome.exe	112
PID 2936 wrote to memory of 4628	2936	chrome.exe	113
PID 2936 wrote to memory of 4628	2936	chrome.exe	113
PID 2936 wrote to memory of 1988	2936	chrome.exe	114
PID 2936 wrote to memory of 1988	2936	chrome.exe	114
PID 2936 wrote to memory of 2624	2936	chrome.exe	115
PID 2936 wrote to memory of 1192	2936	chrome.exe	116
PID 2936 wrote to memory of 1192	2936	chrome.exe	116
PID 2936 wrote to memory of 4408	2936	chrome.exe	117
PID 2936 wrote to memory of 4408	2936	chrome.exe	117
PID 2936 wrote to memory of 2916	2936	chrome.exe	118
PID 2936 wrote to memory of 2916	2936	chrome.exe	118
PID 2936 wrote to memory of 2764	2936	chrome.exe	119
PID 2936 wrote to memory of 2764	2936	chrome.exe	119
PID 2936 wrote to memory of 4996	2936	chrome.exe	120
PID 2936 wrote to memory of 4996	2936	chrome.exe	120
PID 2936 wrote to memory of 4704	2936	chrome.exe	121
PID 2936 wrote to memory of 4704	2936	chrome.exe	121
PID 2936 wrote to memory of 5320	2936	chrome.exe	122
PID 2936 wrote to memory of 4744	2936	chrome.exe	123
PID 2936 wrote to memory of 2060	2936	chrome.exe	124

C:\Users\Admin\AppData\Local\Temp\NexusRecoil.exe
"C:\Users\Admin\AppData\Local\Temp\NexusRecoil.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb6ec2c728,0x7ffb6ec2c734,0x7ffb6ec2c740
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,1386848922535982573,7456202470648198561,262144 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,11588563779612680753,14232794818928042802,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,1536604692904877571,8728395321992226334,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,1989884239001582310,14923109084320700276,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,6895152454332760268,1876966413066276788,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,7349663236352510459,16063068268453554286,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,14674332629380700811,8854285403165125367,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,11620202095535097750,5514313247815194799,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,12334158719251903633,14895532386018621296,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5508,i,9472599874009319181,18253690975976630534,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5844,i,8340943684593884376,17253101575982230349,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5956,i,6817078121511530585,12520847098300125799,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6012,i,1573372877490098605,7725264878260815084,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5504,i,12615670971525801159,2796455566756153159,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5712,i,12375456166948715487,17137164181032751318,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6224,i,10026092136271464043,6053005372844215147,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5724,i,13383470387583367554,2579721152871907657,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3520,i,1643500755869857111,8953220074016529053,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3228,i,10535389153484328718,9945481542590646333,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3208,i,4748963028345152158,1120101325122937647,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3516,i,6824930032722082755,16822148080864174099,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:12
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,17705514477512833891,16889390412349806831,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,9060356742471112130,3342467021451830030,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,16971244463868208762,3745809385990682915,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6372,i,7817546304116051684,16295434743047687000,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:9
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6332,i,13178776705626532059,15114601337285122158,2097152 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,10190498418806828964,10640308560636317753,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,8026337749688684782,3268747077240274616,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,5344127493458586458,1766705008987157060,524288 --field-trial-handle=1700,i,8329939126563493400,13066390076942390369,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:2060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3576

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EditRestart.emf"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4876

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2528

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:4360

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EditRestart.emf"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8d87be09d7883b0b366b2eb8da5dfca51d5dc4f411133a594eb4926481d0d8d9
MD5 a4dd54207dad47833d3e0f23ca140640
SHA1 e237be1fb98e1ea5a0da1ebff8ac6defdb455615
SHA512 16dd4f15b15a44efa5ecabe420f1ec9d71c4f5453be5741ad68fe107ec066102f71360d1902056ee7f75e1c3b31fe20f88e7623a7d291bbe5ca851a36f8cff8f
TLSH
T18131B8FA2D4E84F8CB1C4FB1F2CAA4C8363693631D272E5813214FB76A51327986097C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 1ab7e898239cac2f98be24750ff7054563409286f0f83e5aad606035e2697096
MD5 3f0ce54464a1155e5ae791372a2daa0f
SHA1 b3ca455df78e10d3152b8d2b04937ea137dda173
SHA512 c3e134ce31f4a091738c742f8904fb21586ddba2993c131609d1e4b27792805b6522be249e459409b0d8d88d574e34d42475432023cb96cb78cae26889bbb83d
SSDEEP 192:D9R8InQnK/K3enJ5EIHEHM0WQiGvucGP0VqnhZwvDboP3iw8GVc3IZv1Z:D9R8IneGK3enJ5EIHEHM0WQiGvucGP0k
TLSH
T1CF32BEFBC7E8822DC85156F49B15AF1ECE1E0A18432C3C26C8D8BF5B93E2471E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ab58aae81a04c122c8369c6a68f216307adc96794f426604befca6c6ff5d628c
MD5 d252a83202dce8f040bc2e9fc5426e68
SHA1 0644a1fb0f0db5aa08d380e38f1118def0f56763
SHA512 58b6d5d683328d5395a756ecef7f003eef046a6fbbb55baf1af4fa269b4168655b629dc652b74156246a74d94a64cb0148b79915463be0cc3eaa296049c904f4
SSDEEP 192:D9R8InQnK/K3enJ5EIHEHIWQiGvucGP0VqnhZwbVDboh1+3iK59/y6:D9R8IneGK3enJ5EIHEHIWQiGvucGP0Vn
TLSH
T1D422ACFBC7E8822DC85156F49B15AF1ECE1E0A18432D3C26C8D9BF5B93E2471E25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3dc1c0815ae6d922a0e0c9cac4c4e94eb43417d310ff1c0704d86fe91086807b
MD5 1d108322a3ac221bd177ad0116b6cea7
SHA1 9bc09418aeee0b2fb144ff8098051f1629bf04f7
SHA512 ea13ed387fd19cd1fd8acbabc97a762c86b711165b24417d95ac3516b896b0af4d2ee2cfd11ed680dd77cb8f006aaa8d098479a3ca99d4358a0ea5a00b318245
TLSH
T16F316DEBD27EB46760BD297B0E44FC15697AA43602816CF4CB5B822CE0C14F3071E456
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f16c33acbe12e17d426243615b0b85c2ca98398a58c95852329e1b3ab84cd22f
MD5 2408300066684e4f19f74f6c4bb7e872
SHA1 ec25c0ee261a5bfe00d7152a9aff5a9a25fe81ad
SHA512 3ff85e9523d49a9ec4999181439daeffde5200309902c17b9e97d3836f087ee9213b8933fd1dde90348cd0d2fc921da04b7b868293fa6dd0d5fb3ffbc610fcc5
SSDEEP 192:FRhcBz5CGxvv7XZPRpIVW0P98Hsb+WNxpovgb2TM8l2ukpS2OoruYkwguZYJvug3:FRhmz5FxnFXMuwF4p2HpS2OOKcDE
TLSH
T16A52C66BB9606D7B9DDAC229F921BB67D3F5202261D02E44E7FC8D2C14E79CC211B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 836b6e1d9df0b1b9c157890ba270b295b192cbca9b5fc243ca3da82ce11328a9
MD5 2b3c706d174397e3bb020d34e73dfd37
SHA1 8667aa1198f2c41c683e6bbd3e90f7ed52de7d55
SHA512 cbd24b80fd0aad0cffe76ff58110c0160f1948144018fdc8bcd1cf22fe299d164329f4b83586b31ca35f51c1d41a8df73ffb61db180d5ec516de5fed96083ed4
SSDEEP 192:FRhcBz5CGsov7hAPRp2G0L98Hsb+WNnvg48l2AkpS2OoruYkwguZYJvugubVVyIy:FRhmz5FDAXKuwIF2ZpS2OOKoDe
TLSH
T1F842D56EB9546D7B6DCBC22AF921B797D3F5102261902E80E7FC896C14E79CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7d6fb3e8612fe0360fa71c908117e407a9e771adee5b00dd1082366a689579ca
MD5 05a886b5807017495821c280d9d74417
SHA1 5f29e06a2bd840064120b3ddf2dcc62006b77a0c
SHA512 b0ed37200b86cb6a543d54aef249f9574e59bb4048ba37c28d6ec1edcbedea26120a7bf41cd22a2e1bf57dd1b4d3573df5704083ebff0739d2cec229187e735d
SSDEEP 192:FRhcBz5CGsov7XAPRp2VW0P98Hsb+WN4ovg48l2OkpS2OoruYkwguZYJvugubVVi:FRhmz5FDuXGuweF2npS2OOKoDe
TLSH
T1ED42C66BB9546D7B5DCBC22AF921B767E3F5102261D42E80E7FC892C14E79CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fc924f24dfa9a8bc83e5c23a6a63f2529edbcc0c09622b3dc1760442adc7d546
MD5 709b46be8ac5e377dd71852e1597984b
SHA1 c2527a271418b81794c6522672f6d43d7293b9c2
SHA512 6598b6b7815205194106109e6453549060729bef5383f49b29be61aecf7d6895f4e006314476d68504fed0bce168b9f6636e00cdfb8cc2cbea67ab144915723c
SSDEEP 192:FR1cBz5CGxvv7XZPRpIVW0P98Hsb+WNx51ovgb2TM8l23kpS2OoruYkwguZYJvu7:FR1mz5FxnFXMuwP4p20pS2OOKciE
TLSH
T10852C65BB9606D7B9DDAC229F921BB67D3F5202264D02E44E7FC8D2C14E7ACC211B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 41180a1cbfab77927752f0339aedc5c2a79b3d42675861cf91e2656ff9450c21
MD5 5a7849a83c046a18cc701316e737f0b9
SHA1 2ad9b3fa75a6c4eecab1583f90dba12ad1fc2884
SHA512 d479f2ab7c8db35037852c7331a9e6e5fde71b45db91686ff179dbc01de3484b574ac24fab6ce2b8c864a28a87dac093aadf40cf2a7304069c7a1661ff3ac2e3
TLSH
T111B00228A9955866DB1443B075DA8CD031693F551383951E64B8CC59A92A342E3A2A49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6cf2a2678e808821b879e21abcc7b1b9e33406ffeeb0f332661b1a77a16b73b3
MD5 4eafd718144bdc78ae6880bbfe1dd952
SHA1 eabb7b2477f71c0dd07f14b78ba8b41e34d6243c
SHA512 8820e6e2fb04e45b42a8eb5a6303122493dd597cbb944bdf05bc92591bb36197df92fd4f6b69649a19a03d79f7d929f135ed38251a555cae1b4ebf65489fa42f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 258ab8e430729aee902dce63bc297462c0bff2059dc0e763ba948e37ce6e0596
MD5 48f1e7adbee066c7a1a487e8fbcb49dc
SHA1 196b8939630861ff1dd822e38af69ed198b387c1
SHA512 0b8790f270753cae6d29ce4d29c60db60ecd6b28e1f17eb7e4014e0af0af7c848919fa0ac393fb01d0baa8feeabe9e76bb5d814382f5647771d2102c96a646c3
TLSH
T192A0023452C55873CD58D2B4F6611541A3B2489A2F51A30B98990848D85B1C64106128
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7a23.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a7a23.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 19fb5ab140a148b32595690d300e8fddbd4304c9773e641d2a131ba6922abec0
MD5 a30cba705d31fe947d36871f99df8d89
SHA1 430506a2250e0daf4023d369b6ed9846f73cb2fd
SHA512 78d0eefd0a686254d8f29596d3a16a3785a252ed14d38a1cd96a8e2fc834e0a16a66dc06f912dc01c0500f523348143755a01e01ec45f040c80fb2c40606ff9d
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5LHDqB6eGyvkonuob1v4a:MC0HJm5FHuPgXDUDH6W8nuobZ
TLSH
T1AEA12BB1A4B94CBB5AB7D745F8827A83DEA4A2276991FF80D9DD1F0C01F31D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ff4144eb497779eb7d447d62f6b2123263c12c4a61ada56a8de6be1a97f0ceec
MD5 8c41cefa10b6e64038f7127315bd6a0a
SHA1 fe06442fbce888a71f21c207cc0f4ee68d433c65
SHA512 01dd6c7335caa03f01e00065698943e5d9ce8f628ea9e9d36ea091bfdaf1f9991a2f4d3f2e5d62edf84ae32c128b4e771a849585ab56dab65f3e278a8ff2b569
SSDEEP 3072:jI7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3Aftw:E7hOurjMI+G9bjWcTHv3AfO
TLSH
T180D3127668E56CF21330E9C9F90FA8AF4DEC656F8F00F60444A7161948B919E6F10B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 b471e12aea2e697b4a62a278518ff2b79e0a0717016231436b2a9a1219ef82cb
MD5 f25b7c0d0c923048ca2ffea6ddd3901b
SHA1 4dc7f223ba0014c889e909db35a58baffb2be319
SHA512 70332f8c30217aa40332d5cd282892f8263d69f754947ce6c6954e26b0708295627240fcc852318fec0120abdd66a638b5cbdd22d4d6d53861677e7dd534c0ba
SSDEEP 3072:9z7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3Aftw:V7hOurjMI+G9bjWcTHv3AfO
TLSH
T122D3127668E56CF21330E9C9F90FA8AB4DDC656F8F10F60844A7161948BC19E6F10B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 6ae730ca61358d6f27728058209db859e9eeb3f07e5b994613bf52f83498e7db
MD5 8d619c317e019bd70edcb7f20fc4b9b2
SHA1 d661dfd5fc6e0ff8508021cfc76e42b2eabe8217
SHA512 5bae9ed412723709ef89de7c1fb494f0ba08816d4ce712b15880414d0f7216a1bd88b76d948d336c2adaee51bdb666d511300384c84981c4b53aee354ac44eb1
SSDEEP 3072:b7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3Aftw:b7hOurjMI+G9bjWcTHv3AfO
TLSH
T1B7D3125968E56CB21320EACDF90F94BF8EEC656E8F10F60041A7021D48B919E6F1072F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 79410c8cca3bb054fe860de594ba21374d3d1af5d60abfb27b21bb146773c9c7
MD5 52f73be9eb227b6efa2a001e46376835
SHA1 ed27182cc3be413286571b827a8f7bd41ec19a93
SHA512 3708c7ddb0c46400f6eceee2725de680f55dc02c06479fa61238a37b4ba398042dc7ef0b6ed916c6ab3a01f594f07d6f4793a4ab3c6b181428ee235c1050a583
SSDEEP 3072:F7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3Aftw:F7hOurjMI+G9bjWcTHv3AfO
TLSH
T18FD3125968F56CB21320EACDF90F94BF8EEC656E8F50F60041A7121949B919E6F10B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2936_1366079082\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\settings.json
Size 959B
SHA256 09648d7fe756bb9d92a4d57a347815ffa50f9b6090754c0c5805ff75c94ce6d8
MD5 eeb6b119350f35ececeb9d4befb05def
SHA1 688dcc26a5e9a0ee7bb3f3ac72c5e0c5c01c45db
SHA512 5bf02eeed62162761b173439a81ac94be61c361767b2f40279051fec6bddba7527a1fc34117b2b8bc7d34fe2bed27359306895c3722e6a68038118340eb88d9e
TLSH
T1AC11CA2AC82420FE597CE1798935522B47559F4D22780C3FF7FB8C4C7A5B2362206FA2
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 e90ce6dfe1480912758b6f983ba4c7fe8a5f3e57d4ae3af3b4c373d2b42a7dcd
MD5 15a29eae0b11e8ecd54fee5afeecce8e
SHA1 9df4f5fcec936cab467886f29ef85b3277f955c1
SHA512 c3a6b68256a49db6ca42aea47754370899737a7a07f38aafda0fe75f18a5c400c825b5c7d0d0d113adf54313d69657dc6194366eac9ebe1e5c9466e7b568cffc
TLSH
T19361C0D0C4812C1FCB8B325DCB55209ADB5FB8D7A9F160110E3FAE96A06A18CD7E740B
MD5 SHA1 SHA512 TLSH

Submit Download