ed3585b3902e0ff6d08a4652555bb10aae6b18e40e0a6879ce29548ee6dd957f

Resubmissions

04/09/2026, 06:04

260904-gs34mstalb3

04/09/2026, 05:53

04/09/2026, 05:41

04/09/2026, 05:39

03/09/2026, 12:09

03/09/2026, 11:43

Analysis

user interaction
yes
max time kernel
527s
max time network
534s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/add-account-local-first.js
Size 4KB
Sample260904-glrf9sshja
SHA256 ed3585b3902e0ff6d08a4652555bb10aae6b18e40e0a6879ce29548ee6dd957f
MD5 0c8f76d51746e948cd14b08fc75fc1ea
SHA1 43405b7630fcc758cbb9ba420a6542b67973ed21
SHA512 a9ef05bbf6424fbde04fe5aed9da2f53012dc3bf2d427e6c6a297da3d1caf4e0d9389822417382ebf28715f51930e42fbee071d80976d97ab014e1308679a64c
SSDEEP 96:H0N7RHUca6fzWmmSkqQWqFbyBU7uvwsILXSFAxPOBbwE4KZ4mNF/u5ledVPIfv+n:qVUcaFmmQQWqFbuUivwsILXS6xWNwPKZ
TLSH
T124A1318DA8F710265C13717D8EAF8105B5B9E823064DFE24BC5C95702F84BAA46FEBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5068	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329749672371798"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "5"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{16DD6F85-400A-4FD0-9AE1-38834A9B4095}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
1816	chrome.exe
1816	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe
Token: SeShutdownPrivilege	2992	chrome.exe
Token: SeCreatePagefilePrivilege	2992	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe
2992	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3964	2992	chrome.exe	91
PID 2992 wrote to memory of 4784	2992	chrome.exe	92
PID 2992 wrote to memory of 4784	2992	chrome.exe	92
PID 2992 wrote to memory of 5068	2992	chrome.exe	93
PID 2992 wrote to memory of 2504	2992	chrome.exe	95
PID 2992 wrote to memory of 2504	2992	chrome.exe	95
PID 2992 wrote to memory of 4688	2992	chrome.exe	96
PID 2992 wrote to memory of 4688	2992	chrome.exe	96
PID 2992 wrote to memory of 3196	2992	chrome.exe	97
PID 2992 wrote to memory of 3196	2992	chrome.exe	97
PID 2992 wrote to memory of 2944	2992	chrome.exe	98
PID 2992 wrote to memory of 2944	2992	chrome.exe	98
PID 2992 wrote to memory of 3456	2992	chrome.exe	99
PID 2992 wrote to memory of 3456	2992	chrome.exe	99
PID 2992 wrote to memory of 2736	2992	chrome.exe	100
PID 2992 wrote to memory of 4276	2992	chrome.exe	101
PID 2992 wrote to memory of 5284	2992	chrome.exe	102
PID 2992 wrote to memory of 4276	2992	chrome.exe	101
PID 2992 wrote to memory of 5284	2992	chrome.exe	102
PID 2992 wrote to memory of 2680	2992	chrome.exe	118
PID 2992 wrote to memory of 5368	2992	chrome.exe	106
PID 2992 wrote to memory of 5164	2992	chrome.exe	108
PID 2992 wrote to memory of 5668	2992	chrome.exe	109
PID 2992 wrote to memory of 2680	2992	chrome.exe	118
PID 2992 wrote to memory of 5368	2992	chrome.exe	106
PID 2992 wrote to memory of 5164	2992	chrome.exe	108
PID 2992 wrote to memory of 5668	2992	chrome.exe	109
PID 2992 wrote to memory of 4804	2992	chrome.exe	110
PID 2992 wrote to memory of 4804	2992	chrome.exe	110
PID 2992 wrote to memory of 5536	2992	chrome.exe	111
PID 2992 wrote to memory of 5536	2992	chrome.exe	111
PID 2992 wrote to memory of 3144	2992	chrome.exe	112
PID 2992 wrote to memory of 3144	2992	chrome.exe	112
PID 2992 wrote to memory of 4944	2992	chrome.exe	113
PID 2992 wrote to memory of 2284	2992	chrome.exe	114
PID 2992 wrote to memory of 4944	2992	chrome.exe	113
PID 2992 wrote to memory of 2284	2992	chrome.exe	114
PID 2992 wrote to memory of 924	2992	chrome.exe	115
PID 2992 wrote to memory of 5784	2992	chrome.exe	116
PID 2992 wrote to memory of 924	2992	chrome.exe	115
PID 2992 wrote to memory of 5784	2992	chrome.exe	116
PID 2992 wrote to memory of 2532	2992	chrome.exe	117
PID 2992 wrote to memory of 2532	2992	chrome.exe	117
PID 2992 wrote to memory of 2680	2992	chrome.exe	118
PID 2992 wrote to memory of 2680	2992	chrome.exe	118
PID 2992 wrote to memory of 988	2992	chrome.exe	119
PID 2992 wrote to memory of 5096	2992	chrome.exe	120
PID 2992 wrote to memory of 5536	2992	chrome.exe	121
PID 2992 wrote to memory of 1196	2992	chrome.exe	122
PID 2992 wrote to memory of 5568	2992	chrome.exe	123
PID 2992 wrote to memory of 5568	2992	chrome.exe	123
PID 2992 wrote to memory of 1656	2992	chrome.exe	124
PID 2992 wrote to memory of 1656	2992	chrome.exe	124
PID 2992 wrote to memory of 3424	2992	chrome.exe	125
PID 2992 wrote to memory of 3424	2992	chrome.exe	125
PID 2992 wrote to memory of 4920	2992	chrome.exe	126
PID 2992 wrote to memory of 4920	2992	chrome.exe	126
PID 2992 wrote to memory of 2568	2992	chrome.exe	129
PID 2992 wrote to memory of 2568	2992	chrome.exe	129
PID 2992 wrote to memory of 5784	2992	chrome.exe	131
PID 2992 wrote to memory of 4156	2992	chrome.exe	130
PID 2992 wrote to memory of 5784	2992	chrome.exe	131
PID 2992 wrote to memory of 1816	2992	chrome.exe	133
PID 2992 wrote to memory of 3360	2992	chrome.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\lib\add-account-local-first.js
1⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9c067c728,0x7ff9c067c734,0x7ff9c067c740
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,11639716902950529137,3382128073543666225,262144 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,966664300498675172,18021566088946352885,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,15497788132337294812,10207149904699395145,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,4466451160740670073,16734234151573903697,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,13993384065329928755,12632636411137120367,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,8886554038537295453,9414888165396564235,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,14378852728662771174,14537225628303388054,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,1912262393624645390,308550161076970391,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,16951361506425986460,15953047779394764380,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5472,i,8765510264605917351,16874206806782476933,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5824,i,9473717679579318273,2763750854766425881,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5524,i,2095172342990518895,15993562569766940174,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5984,i,482827103898925987,8680616921187915803,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,1564223633204178749,4252552285821674308,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5468,i,14227908911107238065,5794835772537088743,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5992,i,4456623296089662370,4011954859892182829,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5584,i,8566408887675976940,8814902739798047473,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5532,i,13145664557396732135,3728811469616525722,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,4410581178564466952,17629918566972600135,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6116,i,5750901060423465272,10050675582989636991,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,13002065913577841193,13253907711201473471,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5396,i,2982106605841165272,11068960453366244830,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4796,i,3328140821581347572,8857951049982975551,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:9
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6740,i,6563734547871342575,18411616461551621318,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,607384628380692158,13839082327336077087,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3540,i,17992628891208125532,4245275004086475747,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,2964673063088836893,18093255860738248137,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5780,i,11344908376681313749,8453294526899372487,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6396,i,18363681218064088292,3383390000556306966,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6832,i,2968223127110184079,6002739749605595477,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6444,i,1678667693058056649,15112755020949506969,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6076,i,10955142666285639741,14717340684336191357,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6940,i,11145279288819554792,2358083934823178447,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,13051452678648674404,7976053933245936594,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:12
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,11959359927485484136,408646701163494164,262144 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5712,i,5571873595203688323,11536542679499882805,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5876,i,15289453477347802744,201651583043568227,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3184,i,14755371954093089951,9438041518539295891,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3104,i,780513796600191032,13557252692567420945,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6740,i,14970215848997018346,14764063800695823168,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:9
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7440,i,12387059225860441359,5937732951998692894,2097152 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,14658529608263434076,1855837287674126442,524288 --field-trial-handle=1884,i,7539587703628256280,505226507112412622,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:4596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 18KB
SHA256 81881bc4a007bc96dbddec6350a774905f784c2fc72da21eb1a4ff5f7721b13f
MD5 83f51888614f08f2f5f93375fa02684e
SHA1 fda0c784738556e842d82e62f4f5a19a45554496
SHA512 dda6bb507280aeb9038d0ff478311ff066e7a5123b4da117134db022aac07603e837b745316de6c5ab3a29f58e9b34dc4165eddc506bd314659d237ee7695b56
SSDEEP 384:fDla69OqJi/2s9mLUUS6LIsE8mUBPMEnzV2iBxlzrvR2IfDbjYA4rDsSD:RpB0b9mLUUSaE8mUpMkNZZ0A+so
TLSH
T18982D0168F7BA59CB164027D7049CA1188738D74592F0B4A1926EDCAD35A1E90EB43ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 41KB
SHA256 cb3bd53afa089fde6c05c4ec273d752e402ffd855b54c7370697826e33868136
MD5 e0f0d5fe0779a04217d015e69c2ffa2c
SHA1 d80bb36fee52a2910238b119c8f0baa735b57763
SHA512 b2abb3f827fe5c4015757829d0a02b402c483f726e9bfd3993f2d17e7a40653f4c86a99e274f46e5b228968557ea4f6cc5266b94784486bf498a15d4845e874b
SSDEEP 768:E/GLuBO6yu8g+ZCQVhBG8e0S3s9jfZzR4rcqEkhK6r3hvi0/gy:gG6BFyuN+Z7h0y9Vl4c6r3hnF
TLSH
T1C513F12A6488C1E2774FF22E3D8F0B5508376261ACD5E4D8B8830478B54A5C75E7EFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 48KB
SHA256 eababcce652179089bf49d558ff31bb600b9e591b00e288ed70537f0edaf826e
MD5 4d7c42ece7f3a7cbe8552afc607e1871
SHA1 4d743ddc524c6770823e9ac29f1ac3444be8aa3b
SHA512 2e072280e02da9d20b9edb6ffe59d3b5b8caf4c8a3f9ecb2089ee790c582d220ec2afdb3b92e29fc5967fe8e8b369d2b8d8139d0450488cb26c49dcfc2dc2920
SSDEEP 768:u7PXdzzd8Y1PchX8/bZrQzl4SAL1i7JGi+iKezKvTgQpwWyxlzirDuyQsrSJLSO:u7/IY1Pc6rQzlOgnHAgQ2WmyQsIn
TLSH
T11023025E4159BC4FE3101D95AD49EB7E0FF40B0218A6DCC1E12CCE4DAEA1B0A1DDBB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 48KB
SHA256 a8fcfdc789e80699ebadbf5130c91fe885f0f4bbdc4a219990f6616c98308c25
MD5 53de47226c8cbfdae5681dc7469c5ec5
SHA1 372c2274393a113488da17b1c2d26a2b8771c954
SHA512 3d4da41ea538bff0094532dec80c6a782d5f37a7849b49f2bb642fd26e912b67da4d602451026f88a3ae196333596fab2af140bd49083fbf80a9d424359b9795
SSDEEP 1536:Ug4gLu0CgJVHwaa1CcwG/1TDo6M2NG07BDs1:Ug4gZ7a1CyjGcA
TLSH
T1722302819B49670DD4B4871B360069185E6DEE28B73EB26D7C07114DCF1F6E2B98A3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 110KB
SHA256 70479ef412455e176fbb9a3847c255627677e3bcc051f173611b344afe2ef699
MD5 2ff679b1cce7e0a994d4ba042390d7f1
SHA1 d65a3eca72990e1f9bcbe763b99e27917c82279d
SHA512 eaacea33a1421b0806abbbf57c771a34c2b16c7b326896cd3e45c94830d70ae8e47fcae1673f9cba6e2631a3793d52dfc763b3585c25922af6fc18d93b08ad79
SSDEEP 3072:HyB7l8kTIoEu5B6YECOExTD+/IEeIC7cVPm9:HaqkTIbacYECp+Aakctm9
TLSH
T139B3122B997E985AE4F683611C1639D868C283B317CDDB4FC934498DB6E7B391B4C910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 88KB
SHA256 9442cba9804cbfce11010881cda395e6df369f778358e50536bc183c926370d7
MD5 cf32003b2a71b7f09b15e9ad77a42d40
SHA1 dd13a04a430ae36e5947a503abf60c24f17d31a1
SHA512 6007af3fe5be0f250b877d18351510f82fe40458033c7342e26aa4ab8fa75f728881b2b872e1bf1a6aca7810151523bb53bf9609f87d414390b45c32c0e66542
SSDEEP 1536:rZr8alDruw7lsgGQArdSY4hraX23ojOKse2XFfjl9w2VmtTYGpbcrA2P:rbvZJGbdcru2320X5K1urT
TLSH
T1B49312212B9BCE72D00D153F8BAA570A77AF065943D540AEB0D1813E4C177E9AFC24C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 119KB
SHA256 9ecec23b925f131607bb2d66bfeb8d7097aadb23f930d81d790a17d124b0b7f2
MD5 218f5705370bae9716a49d875b172882
SHA1 6c5e20c0cd56ce6afdf5a3d40a20306c414a0abf
SHA512 90a57e1e0892993198055d6008c5d99748976c2bf5e7f8b6ec197fc977e10e517f880b98837187885bad5a916183c66da272f99472938615baf94faeccd057e8
SSDEEP 1536:HnNHj6jabMfGUiyfDWY4MxLLvZO9Xp7T7USpR4FEuccyGNGMLb0J3sMbC1Sxpxcc:tDc+JIRNZvA957ESpR2EnFvoSxfcHGT
TLSH
T17DC312BB5968AD6370ED356DC2D02633AC51F7A70AC61214AEC0CCDE669131AB3F7538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 80KB
SHA256 caaff592793d04391917e2eb08769a001ebc02e3003a81490be4fbbc7cb28a8f
MD5 07538e10ec2528e8a141be97611a0cc1
SHA1 0da2b864976fbbe154f0ee3ed443b83b1d8e5018
SHA512 a4fbae1623953c9714873254c90edd0ce70855cf9ef5943cc2d1b22590a171b5bb871341e52ade23e448c7f3df9432757450ddb2eb0bb138416ecb405a3e81c0
SSDEEP 1536:gs+THbyPqo6u2rDVw8/+EaSZ45HECLwOddL5gHoRsviV4LaURWIdVTUZrJTr6ToE:9+T22HVjaSZaXPLVWiKvL+rJ2
TLSH
T1B7831245B60084F79AED49D18B8E7E6CC568E67DB536154C399E86003338106FE3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 127KB
SHA256 19ff7ff3dab1f61dbed082b8c6da4f2443dfd90e640159038ff4852a569610e0
MD5 c3429c30024940003ccc555396f12de8
SHA1 e1d98da5c6d6397892e14301d6fc7a372f5a1aad
SHA512 2a8915f27bc9ab7aa04fff7fa4c7014ed31df9ada359a0d0353f26e9717a4463e107183727a49509dc8ffe3d49da55947a63d6d03a843b2242e03b9e1ce9b3cc
SSDEEP 3072:g8keYH4Rq4n4TmvT0bGnSkGJYJXXVkDxTMCF7VfQt/sVjHSGO6:LYoq4n4TmvMwcGnVWlotE5y4
TLSH
T1B4D312D6AA49C0DFCE1E88561E944A95CE300A5FFB3E588B121242EE43DF4E3475A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 77KB
SHA256 3f718bd89b794ee72ac0554240317dab36f14436555fb0151a0176164f7a5223
MD5 da504a86cc8120b79e6aff72ca205486
SHA1 61ed1c46f004641f924a732fe6e8a375ad912356
SHA512 c2b03a02340e750d1f9f2f41bd4c3b1d99d0e931e3505f492c2c312bc7b45487c9331b535aa834f0b1ec2461c50f3b8fc75f2add786a8261f8f7f13f54c6dc6e
SSDEEP 1536:RQJg84UCnfR+YoKYhvkwg/X+fPiJ8Fe8E+IyHmBtX/cMURQqHSpOB3h:RQJN415+YuhFTFe83ITn/cMURJyps3h
TLSH
T1B973021247F8E24F0FB59B75B9B419747C39A6729F004B18113BE680BFB4ED42068BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 233KB
SHA256 5b0dc5d303babd0b37e25d4fc2705cdddff78d4a5b77e3d94d740a0bfa8b2f4e
MD5 604f765a78ef21fcd25cea188e51934f
SHA1 f5b5302dac7e5ecf09045681a28a649601ec3ddb
SHA512 42e515e3b4d6788698ddbf3d05095a2bbdd9e9a8b4f7c00767105d4eab1a85460bd0b0ea366a5b8b05e75e78a0969549f0f13af3e380d13d8c162056ac761519
SSDEEP 3072:nSU1gGH24n4/UuYNHH9zjenVjLLYBiQ/Zh20hEYGhf79Rj1s+rqPmhx4TYvsnosh:Sw28XpN9f0VjPAiMIDx1rnhxDeonrN2
TLSH
T1DE342314A9307BFBB7E89D93C1D094C76A803232E253EE25F525CDAF66C4039595F3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 246KB
SHA256 245e358b935ef141eeb244c665668eeba1744779929966a7902d3411b5c60789
MD5 c101fa29287f77f5431c22d98693d6a2
SHA1 c7b8b84a5c1abf15648e4fb450bdfb0dfa3ed8de
SHA512 606176d1fbc0c5319746241b38039ee470f94a802ed1950a3bce7b35cb4ad008813dc98b4108ff58346fdf5f9c89a3542b7601a42b3d747d3692702f12f117ec
SSDEEP 6144:SZ2X8D8MjajoBIPaP9WNz5RJck9U1zfrV:Sc8wRjoiPU9WdtceUF5
TLSH
T13F342248387E34220ECCDC5D436B2F5FD869E169C8BD74B9A62512C8E14DE4786F72E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Size 42KB
SHA256 d70dec47837e50799c46d9b8925767d32f65adda04ec015be6af92bd4caffec4
MD5 86fe63fc0e7a1438f6e28c33fe5064dc
SHA1 8e2536f901bdf219649c2ef9fd4915b2778a877b
SHA512 99f6f8abf56e3b620dfb9e961a71897c050e7f6b3d3b20801e5b7209a6f0afde2de637f26e4baf5d869aab99e99f1b872b19017954155fba0340f8ec771bb03a
SSDEEP 768:oLgsYotfGy5sxGr6JaPCOT7wPhQl4HeCto1oEU6FZsJ3z2OmdMSVNtAw253e0p:Wf/sEOxpPhbej1ofcZQz5WVVDO3e0p
TLSH
T115130201B668EC31EDFC07A7D94311217D198B24205DC9A2FF6B994873D6B769A9F08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000072
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 bd04530b97f17f11c81f8153074d4f96245e7d0de268fbcb20ff85cf5ce81faf
MD5 e26de3335ccff3e28211a3da589b3ce0
SHA1 11fbf86f9238780542953c4902f82ef7c534d056
SHA512 6476df2b6629a97182dc42a56c90f27f5e5fccb68b9a450cc77a8b3c68dfa5b013b4cd03eda5930271cd4e2657bdc8aa3bb88ab27175d8ddb08c12d7f24ac92c
SSDEEP 48:ZvWUGc9Sv0lgn7rJALhRwZCZVdE1yCDv1iQw5bkMba4av+Yu3bLDidSkGrJ:kU99S2tRwYZVdBCW5g3F+YUedSkE
TLSH
T1D291D8E59ADE1082FF4916710ED4DCAF62140E736DA6BBFB1FC6C22C6443AD4017A342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e72c3e434a560c1cb0186d8d0cab92f404c323b96ca57251061423a47d5f0103
MD5 10ccc641c58b82b518538c48ef614bb8
SHA1 c06293caebdc5e1ddcdd3f7552dad9530d1ac4d6
SHA512 16b8d8591d463501c5d6a9c5b324060678901069357689aa35ef2aa28116ceb66950f88ab0220dae195b2653cbecb1c7e4fbd499da7953b63b222624724efa57
TLSH
T1BA71A6C59ACD5412FF5412B10FE49CAEA6040E737EAAB7FB1FCAC52D6443AE4017A306
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a0447a04cf2b159c66d617141888d23cb2a8afe2d7cff547b28757d3fa4dd0ea
MD5 ce3305f123ba5315ddd4b701e4e4e875
SHA1 8c5c7ec6868f604c08b21b93e1f159c196b9e07b
SHA512 9591659a7677df6383b894f0f6e9b4e8d7017eb388fc43adbe7bed33cf1ef5a5812934096440ab0cd247158158478a5c885802e7c62a3ed324c2e6c34a40b3e2
SSDEEP 48:LWvWUGc9Sv0lgn7rJALhRwZCZVdE1yeDv1iQw5bkMba4av+Yu3bLDidSkGr6:bU99S2tRwYZVdBeW5g3F+YUedSkX
TLSH
T13391D9E49ADE1486FF4956710ED49CAF62140E733DA6BBFB1FC6C22C6443AD4017A342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 db38acb447a3d67909f9d0e3fd4aa3aa8b2a898a0b1b555a948398c5b77b061a
MD5 908cd44033c3fb3051b09820a35e89c9
SHA1 7454d1b8a4a44946ed28c0ef548754d1d32791cb
SHA512 6aed7a4f24579b5898edb65f72d7f1037df30c76ed9334793839920d911adc460207f959ad939fa3c55901fcc8f17f8dfdf631ccae9baf359ef42ab0ad05efa5
TLSH
T1A681B6E58ACE5442FF4846B10FE49CAEA6140E733D66BBFB1FCAC62D6443AD4107A301
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log
Size 983B
SHA256 a51ec674623a8633c0f0050dcf052fa2a17ce797ebe49ee3271152cf67bdcb56
MD5 dc4883f039e425d10b566294ace9e58a
SHA1 2c68ef1117175eff7108206400e1c4023d6b0090
SHA512 7115204639edd07defe096909227091d12e0d964fd9a8f08ea2a8e073af260ce388c5b9990bb47e44dc0eaecb35e1213009b3d380decef4c3f7cdbe1f17e8b1d
TLSH
T12411BA2B75908FD3D5180A3609660FC84B377E46BE88C14AF5C4FE7EC7F16410831696
MD5 SHA1 SHA512 TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 1851a64bdc18cba58993fdf13336fa45d4ebcb7744db876efde76e3fe583836d
MD5 a351ae29e33b7478bea4154b71fb67f0
SHA1 93ae5e86371b8d5a349fdb5bef73ea1d9280ae60
SHA512 78e4656ed97c0e9a6d06c82c96e9e5b99f45471f84ec36b7bb9a2e2438561aa05b110e7e58a5b2208267a055d21a87d789b26cd5a251c4e7aed96d6d4cea4211
TLSH
T1E73182225BDC842ED90A173349EB46FE8BF1A68535518B8A39B0A74D0E225070DF3299
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 347B
SHA256 a1bd88fceb147c67df09434fc20e0395e02878f30c512c50c024346c0308a155
MD5 1f13183eca797619b303b984e357c10e
SHA1 91e8bef19369aa9bb8614086ba885c0cbf184146
SHA512 7a7a853095d341f34cccd799fa92646143283a7deeb3c8228844b076c26169b732f74ebf60ce1af0a27b35bdda5ee2d5c9976f6f06ca98876d3e01e8c8bb4f92
TLSH
T11FE0C0A881C9C51F2080817355387F4ECAE62A0CD7CCADC14F02F81871C500CA168270
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 6ad33b5a1891d4c5d0f2842b2aaf78bdc426c78f030b872635cbc54084051768
MD5 ee070d15446489e0265fcdca042f1c26
SHA1 163fdfcd2932b468467bfa44771667767ead1d73
SHA512 f9957a3d407bfac9dc9c3dfc5a045312e02e3d099fb9ab598ced91b092f8f4501683855b2242dd0304614fb074ce7759f4d00c82469e94039ea57edeb5cf0fd4
SSDEEP 96:DE1TWDWIUZWMQfnVQB72WThMGupg98XX1QKHxK:DE1TWDWIUZWMQfVQB72WThMGupg98XX+
TLSH
T132C1AAF383F4CA6D9A1152F0AB156E1BCE590924431C3876C8E4BE5B93E3472E200B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 456eb3e596dc19a780a217ae5812b39c417afe6033d25d4df1ad1abd23e7fad4
MD5 9d6431bcd6e24716d6a643c988754122
SHA1 a04b0600dfc169627a38fd6fa2a2ace1102763dc
SHA512 ee8b46caf30da9639a068a29d49206c8a1d556eb4407a52303a516f635e72b0859c8d1e07f594d46571c13c2812ae7dcb6474fb8f21e618c6fde83274d98eef1
SSDEEP 192:DE1TWD+cI5NIUZWMaVQBzW8CgHj9huGTHxNLQTa8Aejli7C:DE1TWiB5NIUZWMaVQBzW8CgHj9huGTRO
TLSH
T13EF1BDF383E4CA6D991256F0AB156D1BCE590924431C3876C8E4BE5B97F3572E200B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 bfd8bba8a87869956e82f8321c5aade94d475049f976c5a3ecd2671ae4ba2733
MD5 e9e210d2acb95739bdbe0617709af4c2
SHA1 1f77f37b823fd89fb64b22ac077e556370531d56
SHA512 20dce8ff02feb3f17134f4d27d65d9cd24e15ca5d4b593455a881537af959a6cda321f08e795fdcf21f497a3025b9e8690d0ac9bb94d9b3b1a85d7ea41532e6e
SSDEEP 192:DE1TWD+cI51FIUZWMaVQBzWxgHj9huGMNLQT8ZjlikHVwaGC:DE1TWiB51FIUZWMaVQBzWxgHj9huGMNj
TLSH
T1F1F19AF383E4CA6D9A1256F09B156D1BCE590924431C3C76C8E4BE5B93E3572E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 369f3d308aff4f8f9dd36c805ec402091ac659443de8e0fb61229d3fa4901ea1
MD5 328cbfdb90ab68af9287b53e3add783f
SHA1 046037bf879b7296840bf1180cd7037e3605dd3b
SHA512 02c4a24a479c41e33b54ab8bd99ddfd5f886d699a882430bcabf06a08c11aea505dd06175bb018c0d66f9b6585bf4f72bdcac7e4e250c03ed002f3ad0f0206c6
SSDEEP 192:9RwCoMFv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsrzxwmSJe2O2ype8yIsnAUgE:9RwC912UXuGwNg3cpwmR2ybE
TLSH
T10162C76ABA1029BB2CDBD229F9517B57D3F6102675D02E80FAFC8D2C25E75CD221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9bd927ab0330b8649a3dde1cb61e3cab57785c3470425f2269f53c74a30fa299
MD5 e973d949cac62edcdab89b952ae28713
SHA1 e4ae03c3fcdd55a44c16fc6d48341ae144f04d48
SHA512 4f54646d101d9793e5662874afc3f45d459e9dcf42c9b6fda078e8f825b7c3c9aac3fb193f84330212bd21bfc7a098c4e1ccd8e6068d7eecce792f2578d46881
SSDEEP 192:ORQsopYv7HAPRp2g0aU9UHsb+WNnwe7m02xJe2O2yleVyIsnAUgR:ORQswEeXCGwdV2k2ygR
TLSH
T1E632B72ABA1029BB2CCBD229FE617757D3F6102675E42E80F6FC892C25E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c2a7478bce6febc6b6eb99b491db81b839a884919b83237e711bf68f1ae3e920
MD5 7709fd70e206a9125201ff3d1ce417b9
SHA1 c6a15bcecb7f6e927f6ae294ab354f9796b2610f
SHA512 69c8fb2feb33b273722cbf163b2d9cf5be6109865b9a0e819b09c1d82e6daffd926d37798fffae0b8b9de6c5cf5257729ca71fee7a19677772c1ea90a08db362
SSDEEP 192:9RwCoMPv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsrl7coSJe2O2ype8yIsnAUgE:9RwC9H2UXuGwNg3cBcoR2ybE
TLSH
T10D62B66ABA1029B72CCBD22DF9517B57D2F6102635D02E80FAFC896C25E75CD221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b9d611a1065d7b851d507dafbf8a167e9037a403de243802ae5ce3c8529a191d
MD5 a58dc1ffa389b79732dd5b449c743ce7
SHA1 ea284b5fa2ab7df42aa2adcad2f61cec0f474288
SHA512 bae96925c9ea91ba950cf93bea8fbf238e5033ad336ff77491a6a00d9a1461880d2d390ba7199edfdec4d60b3cf2e3e161a3cd76c3ac833c35575c8c944583be
SSDEEP 192:9RwCoMBv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsrAnwdSJe2O2ype8yIsnAUgE:9RwC9R2UXuGwNg3cQwdR2ybE
TLSH
T11A62C76ABA1029BB2CDBD229F951BB57D3F6102675D01E80FAFC8D2C25E75CD221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 eae1b0a6b0f67f9ab5e26bdd22292829aab16af57e26828cce399a0d48fe5df6
MD5 4a9e2941690e0c2ac8f31386ed693d02
SHA1 ce4e50275cbf039db7739f5986944b48c4474a03
SHA512 2d46c637195ef37a7f22dfc9a719b3959027ef4b083d865cb2a8744cc2f3952f4b440dbc0e3f4c219761de7a85d4479fb7ea9f899b4f6db2eb0fa8fd6d3401b3
SSDEEP 192:9RwCoMRv7ylMPRpVg0a759UHsb+WNNodq1I+KGsrwncpSJe2O2ype8yIsnAUgE:9RwC9B2UXuGwN3XcEcpR2ybE
TLSH
T13562C66ABA1029BB2CCBC22DF951BB57D2F6102675D01E80FAFC8D6C25E75CD621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2a86e797cb43c029acc0fa4c3a96025ab502aa3901ccf282c16d594c08a17e28
MD5 ac80a2995f8ea4aeedff1394981f9551
SHA1 877fee3c7f23174ce0392f093488b063dac9763a
SHA512 0753f96c8bbbb50b897457f02d8c7173efa8dbfef83ced4ed2e57a74277c46687072073468b51da09e14868be5f9f675e2d18cb4e479972f727cce8e084e0791
SSDEEP 192:9RwCoMTv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsrJlUASJe2O2ype8yIsnAUgE:9RwC9r2UXuGwNg3cXUAR2ybE
TLSH
T12562C66ABA1029BB2CDBD22DF961BB57D2F6102671D01E80FAFC8D2C25E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7648a1cd18dcb9656624e35582594596283df1053698532d97677b2cf9f3fe64
MD5 1c9bdcb7899e71ade63a020e30f13f78
SHA1 a3a8ab0dfd722de00a5b86b9c1b12acda12f8b98
SHA512 86dea82f468df589749d5aaff30cc24bb3639bca717aeeaef092b791eeb687e439ff3cfe45c55baf3f2f0c16246e1a8d9e325a8f11ee8f402640d32d351d57c9
SSDEEP 192:9RwCoMSv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsrhXsYSJe2O2ype8yIsnAUgE:9RwC9+2UXuGwNg3cZsYR2ybE
TLSH
T16D62C76ABA1029B72CDBD22DF9517B67D2F6102671D02E80FAFC8D6C25E75CD221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f8fc810ac31d414aada881e9e23f7de6191c20e3dbc4206d81d3a16929ca36f2
MD5 3d19a2b688fa6ab55c8895a4d99c9560
SHA1 9970a26255239c82a752b8c419f37b9f9fd22a66
SHA512 2a47a615d71b52f743eaf1f0d8d86b4a49a24b9f0d9704b4c7033f3ec9419e1cffacee74342f46dccb5ff8148f1d90cb59d4a00841ded854ddf1123fcc24291b
SSDEEP 192:9RwCoMuv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsr3dw2SJe2O2ype8yIsnAUgE:9RwC9K2UXuGwNg3cJw2R2ybE
TLSH
T15F62C86ABA1029B72CCBD229F9517B57D3F6102671D02E80FAFC8D2C25E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 09ca2440a29985808acb9c255f76b627191ad17cd440818823c73a7a9851d30a
MD5 de1798c20b76cc814812906b12f9ae81
SHA1 ad265d15b593a8183d572b7ddcae9504ba4cdb01
SHA512 cbb3c110b053cd3ddf42987d7e1ae8c0e1750103155453c1649c5dc2e05850520c01c70ab31204f1d17ff7393ebffd65b586fef7011ea5f94c36e881bcc6bd2f
SSDEEP 192:9RQCoMRv7EMPRpyg0a7X9UHsb+WNNodq1I+KGsrIWewSJe2O2ypeVyIsnAUgE:9RQC9BhXhGwN3XcVewR2ysE
TLSH
T1B152C86ABA1029BB2CDBC229F911BB57D3F6102675D41E80FAFC8D2C25E75CD621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 010a2e0f03f37aa150a7783bd9f15bc3fd3fdbbc4394a34e018e85fea635107d
MD5 7b882f82edbc623d397a5fb935cf57fe
SHA1 371ede3dc9ecf41fafad43837c5537f517832070
SHA512 1fa134d882b3301da7c7d5b88cb3c6ce82f3caa37ce5e21f20049644595df80318fc0f69e5ffd31feb69870096e1e4307d9f693e9dbb0e5baeba01c99302ffc1
SSDEEP 192:9RQCoM1v7EAPRp2g0aU9UHr+b+WNnI+KGsepJe2O2ydeVyIsnAUgE:9RQC9FRXCGehcec2y4E
TLSH
T18142B76ABA1029BB6CCBD229FA617757E3F6102631D41E80FAFC892C25E75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a61260405901e2aefe10c01c4049067ffe0d3ee5d8c238d0cf56ab73c621c27e
MD5 42063907fb43f6eba61b52462b807218
SHA1 9bcbdca46c97337cda51c00488d796c6c9b7204f
SHA512 55e9aa782ff9119c51391d6f04e8af5371a2f32e680cee95cfc5a698680a2eb339c35235fce2fa45a07a2d161401f099a8b3c11c2a2882430a0e1ff7a787a9c5
SSDEEP 192:9RwCoMlv7ylMPRpVg0a759UHsb+WNNoZ1VI+KGsrpWwMSJe2O2ype8yIsnAUgE:9RwC9V2UXuGwNg3c8wMR2ybE
TLSH
T1E362C76ABA1029BB2CCBD229F951BB57D3F6102675D01E80FAFC8D6C25E75CD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 99cb928d390976622ad02f53983dcc3cea0054d6388a3c4f6cbe4adaa4ff6663
MD5 1c81917d41dc8e4198a5ca664fb559e2
SHA1 8b4230ca6ef06c8aac6f4aaa017836af19e8444a
SHA512 e41922e5c171722237d3d3dad9171de356c90c02ba7ee0a958451f366d4e215e20d88d30fa279ca20acd90f735a490f393578d1cf2c38ad3947bbe0b75065e71
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9SO5a1Af4r:oKj8P7KxkXqKf/pUZNCgVLH2HfgslxbD
TLSH
T1D132FA67948D9E3B4FD8D518C8176B4B6CB40296737C0C24A6FF9D0803A67CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 541f3a6813f26505dc249615326bbe2e6de980bdf22a65e2cbbcc0124e6c6914
MD5 116505ce665495ec1560d2e136ea8839
SHA1 5e401c5a2eee1a8439d03ab7b20e1c8fad568f4c
SHA512 2d9301e74e63a7209fce4746539d878fe6f0f9aa72a73523ec62f71d2a2bcfd54359ab88e3ad3de690f34dbf8b9ef3b244f56218a9647c0c308da015f159cb41
TLSH
T161A002528FF12C51ED0C9E74B0E9C5D12A629C691D5993135DE18444899B2C18212E04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 adab302b6d382b7f7087191f43fdee046d987fa0ba8758bea614ec6a57bc57e9
MD5 7d1ddda523e67039dbbf8faec740e7ae
SHA1 056e9042850a1e8a2353ac69e24d76092b861553
SHA512 a2498f909b6798a2f530fbd73c4077ca526c38b2bb715e8fb3d8933911d5d337fe2561e2b56fce7860dca56bf88f94ab3ff67270eeaa72f1877434e52126abb1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b3d1aae227300d9aeb45d150e7379b54b3ce2c5d4ff644b0af65ee4042e98382
MD5 c8b05ca3ecfbb47a31def0c4625d6715
SHA1 4dcbe052206846e86c25f3645cc7284eb58b0b7e
SHA512 6d3ad2e2d3a90b90e1e15cdd93bd2a26ac882290533ceaae89a48c53eddb35aec9b74984b7dce75d5e6aac7ea8e929bfabfa2ec1cb64199f9b1bdeaf9fabd0b5
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5X3DHB6AGyvODqLu/bjv4a:gC0AJr7fbyVlFDUDjhkFqLu/bH
TLSH
T1BEA13A71F4665C7B5DB7D448B6522E03CFB4B2ABB861AB64D9DD0F0C01EB1E80741517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 3577a098937a7da8ecfaa31197d97dc26888171646ea72cd81b110b9024dfa60
MD5 b6fed597c60941bf96601a62ddcb4ef5
SHA1 7d4aa5753564736b4fde5f93f2c9eab349df9144
SHA512 a3aa3ff1787cf8b10debbebc560d374f17bed730b024957df08529e7f04bcb8dcbe9250d08c3f0d5be86054537352360b22040feca5eaa67778f55d7f54e18c0
SSDEEP 3072:b9VfBMIA6VmmdZmWtz+uSZvl6WEkGaDZ4qQUE9mbVDcDwBQsA2yG:bfBMIpVZdg7REGDCA1KV2yG
TLSH
T1FED3123AAC692EB7CD776C39230D3523FDB9AF6B5648ED9CD1E8398500DF9E40A55080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ffb636fecea2a0f37e1cb9ef3d275d3d72f3c49afae24d9f52e18eb44bb9ef9e
MD5 8f8bf60480a91208e5fbec4963536083
SHA1 7eb4168cdd4f0a35b6ddf7973349b54b06281ad2
SHA512 829d458d8c67fdf787a42c5aa1edb3d053dc7d94ec5d9824a751d8efb738dd6d80d2322da8e1b2ddf8988286700f901fc580dd8c1c4cf6971a23dfea2ff0e5f3
SSDEEP 3072:DJVfBMIA6VmmdZmWtz+uSZvl6WEkGaDZ4qQUE9mbVDcDwBQsA2yG:DzBMIpVZdg7REGDCA1KV2yG
TLSH
T12FD3123AACA92EB7CD777C36270D2523FE7D9E671244DEACC2E9398200EF9E40651540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 57df9f78f99489aefbcf6aeb3cb4013aa014603c84a54f819940587f74955291
MD5 d5c6c489734dca23f00e934ea2416f2f
SHA1 c25218f52003fc924d026ea05726035fce19364f
SHA512 631c68caeb91e3d89e87391950748d101b153efdaa4234cae9ef914ebbdf9d1c04c4a3290dc121e909d961fde87d79a6aba10cfe5bebbfc86d1774cc02e11fdb
SSDEEP 3072:DJVfBMIA6VmmdZmWtz+uSZvl6WEkGaDZ4qQUE9mbVDcDwBQsA2yG:DzBMIpVZdg7REGDCA1KV2yG
TLSH
T14FD3123AACA92EB7CD777C36270D2523FE7D9E671244DEACC2E9398200EF9E40651540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 d8e9a43268a6aafc6740ceb44d7f397757131ac54fc589fc5b05ef073d435404
MD5 eee9e0fcae6d67788b7a83bdcb8c8edd
SHA1 3694ada68ce188c0204f74da8cca33d9fbc472c2
SHA512 5c61af80acda3e56b97faa4bfda24017a65916c0e919cc3419a5a4e98d0b19bb6c345c07317c80e77915d463e6a3567f348c1b6d8402328038188ed8033772f2
SSDEEP 3072:n9VfBMIA6VmmdZmWtz+uSZvl6WEkGaDZ4qQUE9mbVDcDwBQsA2yG:nfBMIpVZdg7REGDCA1KV2yG
TLSH
T122D3123AAC692EB7CDB76C39230D3523FDB9AF6B5648ED9CD1D8398100DF9E40A55080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2992_997084538\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download