ef2ae27c184adf5cb2ec8d89350379473ee5d2a12d8f0262a1bdd5af8c12badb

Analysis

user interaction
yes
max time kernel
599s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pythonw.exe
Size 106KB
Sample260827-nwptraterh
SHA256 ef2ae27c184adf5cb2ec8d89350379473ee5d2a12d8f0262a1bdd5af8c12badb
MD5 38fc7e16757f8703737c0cfb63e1cbbd
SHA1 172f6a5a4305725400c3b20975bc2fa434c5151a
SHA512 71e2dbb321e62d1f849973f859c13ebe2ea3c858e7d3a54ec3c32947732e2a6828961d87f3d9b6bb621c9c0f6e26ea4093c7b6a28883a0cd4973ef183a97f6f0
SSDEEP 1536:ftg0xmIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/84st+Kik7/Z5Q:fq0xdwMpdCq/IM8uIGfV/84soBkDZ5Q
TLSH
T122B30751E66DBCCDE10CD03059B6D5F26E24EC3126D0A22EA3F2BF162971653F90E936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2688	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323047273400334"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5288	2752	chrome.exe	90
PID 2752 wrote to memory of 1668	2752	chrome.exe	91
PID 2752 wrote to memory of 1668	2752	chrome.exe	91
PID 2752 wrote to memory of 2688	2752	chrome.exe	92
PID 2752 wrote to memory of 3216	2752	chrome.exe	94
PID 2752 wrote to memory of 3216	2752	chrome.exe	94
PID 2752 wrote to memory of 4876	2752	chrome.exe	95
PID 2752 wrote to memory of 4852	2752	chrome.exe	96
PID 2752 wrote to memory of 4876	2752	chrome.exe	95
PID 2752 wrote to memory of 4852	2752	chrome.exe	96
PID 2752 wrote to memory of 4920	2752	chrome.exe	97
PID 2752 wrote to memory of 4920	2752	chrome.exe	97
PID 2752 wrote to memory of 5384	2752	chrome.exe	98
PID 2752 wrote to memory of 5384	2752	chrome.exe	98
PID 2752 wrote to memory of 5800	2752	chrome.exe	99
PID 2752 wrote to memory of 928	2752	chrome.exe	100
PID 2752 wrote to memory of 1936	2752	chrome.exe	101
PID 2752 wrote to memory of 928	2752	chrome.exe	100
PID 2752 wrote to memory of 1936	2752	chrome.exe	101
PID 2752 wrote to memory of 1692	2752	chrome.exe	103
PID 2752 wrote to memory of 1692	2752	chrome.exe	103
PID 2752 wrote to memory of 4576	2752	chrome.exe	104
PID 2752 wrote to memory of 4576	2752	chrome.exe	104
PID 2752 wrote to memory of 4756	2752	chrome.exe	105
PID 2752 wrote to memory of 4756	2752	chrome.exe	105
PID 2752 wrote to memory of 3464	2752	chrome.exe	106
PID 2752 wrote to memory of 3464	2752	chrome.exe	106
PID 2752 wrote to memory of 6008	2752	chrome.exe	107
PID 2752 wrote to memory of 6008	2752	chrome.exe	107
PID 2752 wrote to memory of 1644	2752	chrome.exe	108
PID 2752 wrote to memory of 1644	2752	chrome.exe	108
PID 2752 wrote to memory of 5856	2752	chrome.exe	109
PID 2752 wrote to memory of 5856	2752	chrome.exe	109
PID 2752 wrote to memory of 3236	2752	chrome.exe	112
PID 2752 wrote to memory of 3236	2752	chrome.exe	112
PID 2752 wrote to memory of 2516	2752	chrome.exe	113
PID 2752 wrote to memory of 2516	2752	chrome.exe	113
PID 2752 wrote to memory of 5012	2752	chrome.exe	114
PID 2752 wrote to memory of 3232	2752	chrome.exe	115
PID 2752 wrote to memory of 5012	2752	chrome.exe	114
PID 2752 wrote to memory of 3232	2752	chrome.exe	115
PID 2752 wrote to memory of 2380	2752	chrome.exe	117
PID 2752 wrote to memory of 2380	2752	chrome.exe	117
PID 2752 wrote to memory of 2352	2752	chrome.exe	118
PID 2752 wrote to memory of 4928	2752	chrome.exe	119
PID 2752 wrote to memory of 1200	2752	chrome.exe	120
PID 2752 wrote to memory of 5160	2752	chrome.exe	121
PID 2752 wrote to memory of 5160	2752	chrome.exe	121
PID 2752 wrote to memory of 5588	2752	chrome.exe	122
PID 2752 wrote to memory of 5588	2752	chrome.exe	122
PID 2752 wrote to memory of 6012	2752	chrome.exe	123
PID 2752 wrote to memory of 6012	2752	chrome.exe	123
PID 2752 wrote to memory of 4568	2752	chrome.exe	124
PID 2752 wrote to memory of 4568	2752	chrome.exe	124
PID 2752 wrote to memory of 2744	2752	chrome.exe	125
PID 2752 wrote to memory of 2744	2752	chrome.exe	125
PID 2752 wrote to memory of 5960	2752	chrome.exe	126
PID 2752 wrote to memory of 5960	2752	chrome.exe	126
PID 2752 wrote to memory of 2416	2752	chrome.exe	127
PID 2752 wrote to memory of 4272	2752	chrome.exe	128
PID 2752 wrote to memory of 4272	2752	chrome.exe	128

C:\Users\Admin\AppData\Local\Temp\pythonw.exe
"C:\Users\Admin\AppData\Local\Temp\pythonw.exe"
1⤵
PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa3fc7c728,0x7ffa3fc7c734,0x7ffa3fc7c740
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,18164070830430141684,2496080182237205509,262144 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=596,i,9345882139328328204,11111461178285705381,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,6431195357686981132,5609374437969060672,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3526345965811591550,6710518716958201497,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,16160578346885957362,1100305482810808587,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,2723573712138509798,17795944507861039158,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,9871970470142100432,6201293277962010552,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,3859278308607214717,10847211978347195116,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,14520975204280800882,7499295190701915783,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5476,i,7154236146859113856,2153808848890325281,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,13868244312150055960,12975823413374027154,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5936,i,2993508552064083417,17648338027498990098,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,16555800345734876230,16758194598050352727,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6200,i,15955643335921552419,16127543961309824494,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6032,i,15427709698975388186,9568075375092514636,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6184,i,13748490559841641800,8411285270301665588,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,7075860304486375059,9632410231613019273,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,2312885103420598832,6680275630497142330,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,10335138208716795972,17576788626027138459,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6224,i,15594490254826102879,15363415910190076226,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6584,i,7127815746477850412,6837499629065240083,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:9
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6560,i,2538235302885811053,1583727332036268392,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,9591574707482539582,5608601771795943914,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,17960850410443522038,1226909996906974054,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,6042306542911447536,10831424853409605427,524288 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6208,i,7348427586031403417,12529718940978594897,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3516,i,1366724777313679314,4689724991805123296,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5964,i,1669962914395472225,2005796657497925893,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3608,i,11652451193688247718,13338806028817299473,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5928,i,12947552181880247159,318050703184021260,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3624,i,13361407591451445544,1849628581954847904,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6548,i,2245446517322403386,9677770646397977725,262144 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6456,i,13768476368974304664,4260112956053670951,2097152 --field-trial-handle=1788,i,17280970438496144868,6660176317772175586,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 320KB
SHA256 4a2449802aaf50999f43cb76b7e52f94b4ad9ed629f0cf0f1c8d7756e8f1d235
MD5 aaf3d5e782d4fd86316609597ff7f014
SHA1 2e82b15ea1a7dcfdbb5035ed8ce44304c2d7230a
SHA512 ed3c22757414ed48c89e6460d1b0215b5ab9498c3245d9a2c181885be68a5da172c6857055ac19e3b0e774a59ba561690e381acf0c5801e2065a42e0684c269f
SSDEEP 6144:0AeLqKHr7KNb8ya/yx0vbqXXZleSH/+NL5T05Gsk+feSQ/Gvcq:0fLTHr88X/Jv2XXKfNLO53VMGvcq
TLSH
T1C3642325B563B6702B1CBDC6EB4D44585888CE9239E00BB655B3E49CCE316EBC132DBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 577a49931fcc881d15872fa1d92c7a96adf0e26f6e22b2a1514b4f7e03e24dd0
MD5 a91a80bc9002596a70eed51a1b8f7802
SHA1 15e3e3ce15f86059816e19e5567836069a82bf0c
SHA512 7a4e6206e5669bdc3571e811f585c76b997e7f00d0654b139edc0a31a1461f3c5346b7443f93a071f4fabce69f3e87b730b7f7342a7e00301eaf479d3e40189d
TLSH
T17F11CB32B0A37875DFD10AF0DBF609C93474C2D5B7C2A226001C58AC86432AA12DC1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 95c75478de2fd89fa1037f03ba9a0966029a1043587abe7502b98e0a444fce85
MD5 a473bf6512e7caeed539d7496867896c
SHA1 3dffc64ccb201042e99a5e55b76e2a8834b98d83
SHA512 196b0f75aee66f03f200cbcbf1f0a9c399769669d51b4be77d8365aca68f1da57b1affb1c6b76bf8c603728386fc1d852fb4427297558a6763d86c360a43437c
TLSH
T135C09261616A0016EF176AF14CA6884832BA4AA83876F71991AC3A7CA8136AA8202100
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b419ab8e6346849ea2fc47a799b0972b94a7f7a66e4606ae100490bb2c7a83e4
MD5 13a1761834355711a8e9831559134c97
SHA1 7acaa9c5771555f60072bb0bbcb4f9b135438811
SHA512 ba02c837ca1b85f111a4f171bebbfc37171ec05d382f0d59e69879edd8e4c2a364731550dbb5beeda5e6c990dfd9b68d8866910020c76c9eab7cd2ce25bb7b96
SSDEEP 192:DpWmpQRwQJXJoRIJYzP8jhGHlVPVKaPlvFfPANPXImHW:DpWmpQRwQJXJoRIJYzP8QHlVPVKad9fj
TLSH
T1B0E19EFBC7D8852DC85156F897117F1ECE2D1A28422C3C26C8D8BF5B93E2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f7d62ccb07e149231c94570ac0e4ef6e46cecd258bd53d2ae978f6cd5751b37
MD5 8f96cef69483f7aa6f948d43b2859055
SHA1 2b1f6135d5ecba30cea0b7e0d66ea4a358e798e5
SHA512 88a3deb46b06108deb577623dd19c66e30b6a3cac95a76b41dd0e264d2f3acea2a4fa3f2eeeb09841386857e9adf465350795d62265c33820952543e4264b10c
TLSH
T1F25189F7D3D88A7D882596E4AA217E1FCD3D0A14121C3C6688D4AF5B53E2872E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 c3e52f967971e705cb33556069021d8128361ad4b39a36d6119a7e80d1641ce4
MD5 cd8be432cfa7bb457b0fbe715e0d0d63
SHA1 9b5260481e22265b976b22bd5dbab4caf66811f7
SHA512 9b1abd02d940796a6b1df5e5c4cdeb64fa2ab2f164ff0cbfabb44cc5266e554518a0498543a2e503bd03e21c770466c445c6b4128b6be6aafa7e1b80f8707bf5
TLSH
T182017097D7BEB4A710BD897F6D04FC0959B5943807405DE5DE5A817CA0819B71B11013
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3c2ad143e6e24f49f32185d2f470caabb4846ba4ea3166593391df990515636f
MD5 a0287759fbb7406d9eaf50c2c3712953
SHA1 66f0fbb0d7b72de2159f7f5288f692afa3055962
SHA512 37e6c78c1c597dbdd817f45acfd9ba06a7de77a6d9c055e87e20064fb74d807efa4c420b976f3441f99cbf9b3439be4b2da0a6d20ea01f7cc39043185651e38e
SSDEEP 192:IRJ0+xMMv7vhPRpw4YKaI9gHntfb+WNnCBW9S20delSsqaOlVyIsnAUgE:IRJ05YVXYIqjEh2Ea2E
TLSH
T1BE52E72EAD10697B6DDBD229FA617B53D7F5206621D02E84EBFC892C10E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fec82617d9c562ced3c981a0821ab41636de808e949115b2b94942ef7d5d9528
MD5 b891111262229e396ceb0de3d1a0a299
SHA1 e23ba92176baf2d0acb7f4a18369b07dea2aac8f
SHA512 b10c85fc463f692d1b0ff9897b58d428e60b9f529271dd33d5278229b9a59e5414c441751338eb26fc77e3ac10018a00fd9a2edea791c48f2c32188f9c514e68
SSDEEP 192:mRJ0+xYVv7BAPRp279gHsb+WNn2t0DdelSsqaOdVyIsnAUge:mRJ0rlwXcqwM0naAe
TLSH
T1A742C52EAD11783B6DDBC229FE617753D7F5202621942E84EAFC892C11EB5CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7cc5f520a3502e2a0fe449eab344460467586caa77a61899099d74ff15aacaa2
MD5 cd8347ef609fd979caa226db434dc475
SHA1 a5ae71e292995f30780ba48e422ee38deecb4246
SHA512 9ed551181c2fc08134f43a7c8b03ada1327f7b1a93b513010ad94574f7d5be568581e43a7f30c60f6291eea62ca64c8161bc05f0af52b75f92a34c566a098b6c
SSDEEP 192:mRJ0+x8Vv7iAPRp279gHsb+WNno/t9delSsqaOdVyIsnAUge:mRJ0BlHXcqw0tBaAe
TLSH
T12A42D62EAD11793B2DDBC219FE617B53D7F5202621D42E84EAFC892C11EB5CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9283e5acd19d6a304901950a5969149818aee3320d180b1a64854a5cd35769a1
MD5 41d767a0933cf511e4040b6010c6ed4e
SHA1 4a0674ab5fcac0323e838cb1a452178b9df574f9
SHA512 5cae3d3ad9ae6799816c752319ad955bad66af78173303ab260ec79474cfd9e0de2d0897117f956a6df8ffb881a0f747f387e4464ef2cafb5ed0f74e348e8812
SSDEEP 192:IR1cBz0FxMBev7vhPRpw4To+O9gHntfb+WNGACBWKpEMdelSsqaOuPyIsnAUgE:IR1mz0gIVXMqjsxEsa9E
TLSH
T15052E82EAC2069776DDBD229FA617B57D3F5206621D02E84EBFC892C10E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 58260b878891e3f63b08359ac9da427594c24dc850d679da8711f9c1ebd3d059
MD5 35f45cbf4c35fb90e308510fa486c92b
SHA1 cf629b308cfca5cf79bc68216b0edc11065984fe
SHA512 23b5485d9b1e9189f8d66b4daacaa96babffb751dd2e1aa42def82c3dcb141b8e18da525a5d8f9161cef2d666a53dc2ec7fe3516dd20ba857ce0c6c60c02a2e4
SSDEEP 192:IRJ0+x6Mv7vhPRpwes9gHntfb+WNnCBeLdelSsqaOlVyIsnAUgE:IRJ0rYVXoqjEefa2E
TLSH
T11B42B52EAD10697B6DDBD229FA617B53D7F5206621D02E84EAFC892C11E76CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69714697a3a699681a412f2c1275c5c0732082d3bf5fb319666adeefff24395a
MD5 c1bce5c8edbe38de9d76a6bfa992c66b
SHA1 c2be4b484366de1dfb5fd7eab0587d098c9754eb
SHA512 d71a21ded0c50c7dfdff1d5acc8d9d6d9b10fcad8759428f1703bb655032c81d9e7d7561fdbb2ce895606c1d22858b99fc0c1569efcc345f1bd6ddd9225cab43
SSDEEP 192:mRJ0+x6Vv7iAPRp279gHnJb+WNno/tQdelSsqaOxVyIsnAUgE:mRJ0rlHXcqf0twaQE
TLSH
T1A742E62EAD10797B6DDBD229FA617B53D7F5202621D02E84EBFC892C11E76CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5ecdd9cbdb0b1423cf7b7d118c368acf7d004006166ec974c00d33c1c9c3658d
MD5 c154bdf065f4b633ee0ac0848a65575b
SHA1 960193eeca401123abdc5823336cec6539b3eef9
SHA512 15bb6a7b33b5bf60996a76b5e06af8994ae3086df84a20d8434f744e63d5a0bebfe1db1096b53edcfe0248a18db1409018d3d84dd8fa7642d7ae6dbeb424ff60
SSDEEP 192:IRJ0FxMMv7vhPRpw4YKaI9gHntfb+WNnCBWXG9erDdelSsqaOlVyIsnAUgE:IRJ0gYVXYIqjEwoerna2E
TLSH
T1DE52D72EAD1069776DDBD229FA617B53D7F5202621D02E84EBFC892C11E76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ed774c1cc8383b806e7ddea50fd2081a23a90d3f400faab3a7c656d957d5b23d
MD5 145bab74d57d527ac68a96cb470d5a85
SHA1 578eddd4b3eb901da66d91ff9841102e82450376
SHA512 4b37cd63907be133e1172a8c672cec5fcb6de107e29ad5458700ac0d45a9b2ef7920f40449988a1887d9995041dc8b9c2d2536608858ed7c61bcb5272ac5ddff
SSDEEP 192:IR1cBz0FxMMv7vhPRpw4TKO9gHntfb+WNnCBW+9Y3delSsqaOlVyIsnAUgE:IR1mz0gYVX5qjEVYra2E
TLSH
T18352D72EAD1069776DDBD229FA617B53D7F5206621D42E84EBFC892C10E75CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 bfcf397dbcd96da6d2fe3a0754689b2d8012899a2bdf2b239f875986fddbf6d1
MD5 0ef4acdfef9bd11979b533e87468398b
SHA1 60ef8276639582c88093312b7b2120989107dad3
SHA512 100ddb033cd41fdc3dfc07d4df296988367fa7b2dc846c6cfa7f62731617041d04a5f05f6de9d92717c85dfc93f15008574b4e8980af77bb3b26fb09b5839f3e
SSDEEP 384:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCXODID+ErU35WHGyo5q47Rff8lWC:pPIf7KxkXqKf/pUZNCgVLH2HfgsjQO8H
TLSH
T13252E727684D9A3B0FD8D58CDC226F8FADF50157A6B8592452FB5C0803A9BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c6c8fbfadb2f29d98c420c58d0c90d5bf1c244e7ada680f4093701cb7dee9a48
MD5 88a7b3c40acea4b4553e3c23a9119a36
SHA1 015cd15c5fad8eadf0b335701091a48380545a43
SHA512 3471a66b7027d3cda6bd4ceffdfcf5f0e545bec52df059f2a49bf6246e910dd95e8ff89a47d024fdcde04496bf1ddd37b1f0b941d7e45506e190175536748cec
TLSH
T1D7A0021866C95559DD0043B4A0A24E85237159147A518F0357EF0544A99B3D1E1059C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a733.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59a733.TMP
Size 48B
SHA256 e560c7a3832a50309a9c9d554d22277105c761e7a6159471d2aa32286229c80a
MD5 52a47bc768032422676bc74d992fac11
SHA1 06aed61e01981ab872ddad6c700a5277eb013e34
SHA512 dd0321665162bef2aa19e4f6bf878fc0ac54f90e7903263844f832088d44d31ac9c24d007032ed3b3c23e9d5273f87ce031f5d8bf7adddcba09fd62272d080d6
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b3e8c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b3e8c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 18c641c4af96b746cff5df77b367516605a0def66c410a4cba99555d791cff45
MD5 73e6815c3b4eb1ea3fa7b1f93437293e
SHA1 0bbe472f012f5691909054977acaea010dea8b34
SHA512 5b62e1837c4c864259a078950574acc25bb0e4a54f74b086cb02595d7f5be58d0a52c58d9cd8da02174521b74fe2906dc6988269bf382356b386fa1004b4940b
SSDEEP 3072:KYRJ915aOqFw5LNcNS1DWbS6yGNmXfNqY+Do11Hl/uxP:T15a725ONS1DWm6ycQQY+afoP
TLSH
T17ED302B25C4C89EBD4B3E093AB857C4D1CBC89F76AD5DE5D98486E0360D96EC020687F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 03d091c842506ecc13fdb0e20cb8b98029437a667ebfc8594e7f311ea3706367
MD5 b775effcf7bce76c563346d13585adce
SHA1 b98a3c6644e8bbdfa4372104a8cb5fa41ec61a4e
SHA512 955bbf8916331d734ffd7bcbb52ae5c45355e5a736326d336a57502e1ea65a81207519a60130dbd23d039e2ccd8ee7c492905cf6e0b77fa9022b033da142ef71
SSDEEP 3072:KXRJ915aOqFw5LNcNS1DWbS6yGNmXfNqY+Do11Hl/uxP:s15a725ONS1DWm6ycQQY+afoP
TLSH
T17AD302B25C4C89EBD4B3E193AB867C4D1CEC89F76AD5DE5C98446E0360D96EC020687F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e3f7f3a5c04032bbfec38a2b7cbd3a4c55c4b46ca2bd83062fa7746f6b5205e2
MD5 4bb006281fcb676fa01a828f93495d9b
SHA1 49437357ac1b26f62be41da0efa4f89effa974c9
SHA512 5f54b456c688c72812aba9beed45ae16e9299113f69aa99686f248128cee6602eafd8f4a1a1edeee9c0de14b2a84b8189df50322f4850d8cb89ebac396bd7f38
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5s6DSB6gGyvXNQRrbfyYv4a:RC0G4DkG/FZ9kGDUDnyMAQRrbfX
TLSH
T16BA1F771A47D8EB76972C448F5933A03CEA4A0AFA611AF44DEDD0E0C11FB1ED1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a6f39ab13f8670d08fd857977230e96d868deb120e87a77916b63eeb1b385405
MD5 56e3c5b17395d61d91d0c8e93e6625af
SHA1 c131369c8722f561ebf98b291a51c2fd908c86f4
SHA512 a02b70e761d4e0067d6197a275cd2988bc740700d4782f5835afafbf5b5533f4cadcfe89e3a81dfcf1ce17b1daccb086266369c5b1fbee4cda64dd8d6ebf4e1c
SSDEEP 3072:vpRJ915aOqFw5LNcNS1DWbS6yGNmXfNqY+Do11Hl/uxP:P15a725ONS1DWm6ycQQY+afoP
TLSH
T163D312A15C5C89FBD0F3E153AB867C8D18BC89F366D5CE5998486D0361E9BEC020687F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 d1cb0697e3828de8eb2f71714b1f6636fac1b610cb78ec458b7fe5d669b8405c
MD5 e2cefeaa347954418e7090ce9cc5f672
SHA1 931e631c2dbdb925072f425dba0293c11edc5d03
SHA512 9c428921eb03a686b08c2522230730fc2decc37a002fc4a27fe480145d2dbc6dfba73b2772bf1fa5e6fc33e1df35a2646d514bb1ec9d80f163341af8f91087ef
SSDEEP 3072:KpRJ915aOqFw5LNcNS1DWbS6yGNmXfNqY+Do11Hl/uxP:i15a725ONS1DWm6ycQQY+afoP
TLSH
T15CD312A15C4C89FBD0F3E153AB867C8D18BC89F362D5CE5998486D0361E9BEC020687F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2752_629872480\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download