1f5fafea22046e5c1cc5db25865e92f6afda94f227a76f489afd85162ab3b210

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Black and White Vintage Newspaper Criminal Wanted Poster.png
Size 4.5MB
Sample260907-2twfeavydy
SHA256 1f5fafea22046e5c1cc5db25865e92f6afda94f227a76f489afd85162ab3b210
MD5 b4cb6d475390290017d52fdab92f3559
SHA1 1f4ca3c1aac321688e63f5bb86475ccf0dd27928
SHA512 2bb183f414813b00c4fe9a31af65502e9675b93646767f3c6afe25d3ebf26ca3304e2e7ae6a1dc1f868e42112929cda7ba8fbae38a9426637692c08f66e8304a
SSDEEP 98304:S3QTzD83E1guHHnnLDl+DYKDlSCZlXmfDhJh+LILM:S3kDmE1pHnLZPMgDhuILM
TLSH
T157263361C28F3D71B34721A22C3E4CE442E574926FF19527DC9A81DA135FE8761A2BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
248	ipinfo.io
141	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4332	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332952593533611"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1700	mspaint.exe
1700	mspaint.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe
Token: SeShutdownPrivilege	2572	chrome.exe
Token: SeCreatePagefilePrivilege	2572	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe
2572	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1700	mspaint.exe
1700	mspaint.exe
1700	mspaint.exe
1700	mspaint.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1272	2572	chrome.exe	103
PID 2572 wrote to memory of 1888	2572	chrome.exe	104
PID 2572 wrote to memory of 1888	2572	chrome.exe	104
PID 2572 wrote to memory of 4332	2572	chrome.exe	105
PID 2572 wrote to memory of 4560	2572	chrome.exe	106
PID 2572 wrote to memory of 4560	2572	chrome.exe	106
PID 2572 wrote to memory of 4872	2572	chrome.exe	108
PID 2572 wrote to memory of 4872	2572	chrome.exe	108
PID 2572 wrote to memory of 4944	2572	chrome.exe	109
PID 2572 wrote to memory of 4944	2572	chrome.exe	109
PID 2572 wrote to memory of 4100	2572	chrome.exe	110
PID 2572 wrote to memory of 4100	2572	chrome.exe	110
PID 2572 wrote to memory of 3572	2572	chrome.exe	111
PID 2572 wrote to memory of 3572	2572	chrome.exe	111
PID 2572 wrote to memory of 1788	2572	chrome.exe	112
PID 2572 wrote to memory of 1140	2572	chrome.exe	114
PID 2572 wrote to memory of 1140	2572	chrome.exe	114
PID 2572 wrote to memory of 4936	2572	chrome.exe	115
PID 2572 wrote to memory of 4936	2572	chrome.exe	115
PID 2572 wrote to memory of 556	2572	chrome.exe	117
PID 2572 wrote to memory of 556	2572	chrome.exe	117
PID 2572 wrote to memory of 4372	2572	chrome.exe	118
PID 2572 wrote to memory of 4372	2572	chrome.exe	118
PID 2572 wrote to memory of 4484	2572	chrome.exe	119
PID 2572 wrote to memory of 4484	2572	chrome.exe	119
PID 2572 wrote to memory of 1112	2572	chrome.exe	120
PID 2572 wrote to memory of 1112	2572	chrome.exe	120
PID 2572 wrote to memory of 2880	2572	chrome.exe	121
PID 2572 wrote to memory of 2880	2572	chrome.exe	121
PID 2572 wrote to memory of 1784	2572	chrome.exe	122
PID 2572 wrote to memory of 1784	2572	chrome.exe	122
PID 2572 wrote to memory of 2000	2572	chrome.exe	123
PID 2572 wrote to memory of 2000	2572	chrome.exe	123
PID 2572 wrote to memory of 5228	2572	chrome.exe	126
PID 2572 wrote to memory of 5228	2572	chrome.exe	126
PID 2572 wrote to memory of 5280	2572	chrome.exe	127
PID 2572 wrote to memory of 5280	2572	chrome.exe	127
PID 2572 wrote to memory of 5572	2572	chrome.exe	128
PID 2572 wrote to memory of 5572	2572	chrome.exe	128
PID 2572 wrote to memory of 5992	2572	chrome.exe	130
PID 2572 wrote to memory of 6004	2572	chrome.exe	131
PID 2572 wrote to memory of 5992	2572	chrome.exe	130
PID 2572 wrote to memory of 6004	2572	chrome.exe	131
PID 2572 wrote to memory of 5548	2572	chrome.exe	132
PID 2572 wrote to memory of 5548	2572	chrome.exe	132
PID 2572 wrote to memory of 5872	2572	chrome.exe	134
PID 2572 wrote to memory of 5880	2572	chrome.exe	135
PID 2572 wrote to memory of 5888	2572	chrome.exe	136

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Black and White Vintage Newspaper Criminal Wanted Poster.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9f253c728,0x7ff9f253c734,0x7ff9f253c740
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,3994544172522247657,10209603191738380510,262144 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,3138742417769726918,15111357834531132176,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,4073838269075997408,13945834282337947999,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,6440386852321749438,2349335833708050043,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3488,i,2174690147986766590,9801124196349333781,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,14157213763131542770,17847405811718755769,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,8318335115414995878,2625615583443772816,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,14007099417591489499,13064485267598328230,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5344,i,17946524112117534976,8317091740295656528,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,5228284978315776142,17906317877220927161,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3684,i,9982306662700239518,16541870110978841033,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5872,i,11837506635126206209,13825360814381609001,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5584,i,367061203168333370,14651394518493250045,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3256,i,14236517061320045041,12563079894140664632,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6044,i,8011455494242144030,10205248236957679367,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6236,i,6632091986319344091,2686958636955870679,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6372,i,2307603498649398398,8636370666428633543,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7080,i,4496352844401122721,6346939353483440800,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7140,i,6306802756805848219,7307408521486017323,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7100,i,12928676436461192945,15542680163494473007,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6812,i,17800304503771274264,9224128060850148865,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6784,i,5663247607889752514,9700172936159264988,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:2
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4732,i,6945701045980086762,16075016746636883891,2097152 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7164,i,8991496799745158685,12890018777379115760,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7116,i,6386657096628304396,15159003944380133635,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,490913704830814251,15293400041165529372,524288 --field-trial-handle=1972,i,13931308896221141043,1914640335344627672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 24351b4241d2d7a000119820602d72b820193c5a7c753f10442f9adc4c0f06e4
MD5 bd53cdbca85d1860851ec3b10c7bfc18
SHA1 52a2d8fb47222d3ee809699e96353ebe8caa2ce2
SHA512 d9eac6ccca85612953fe90061c74c19ef0c391dba40b64153320f6d63052edc8b2c2d5f93845d36ed3d21494e94b75aca33f3fd3053ff826aae27db8d40ad23c
TLSH
T1A3E0ABB9C8A1EC2B28FE0718E0904305E350135B2A80494F373C840C8FF0A3A4749C0C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 21KB
SHA256 b7582acf1f182c6a66e203cd6eee889d409cd05ff4950975128a32fc3e0c0418
MD5 e126007f6b835ef3a0916864cf476699
SHA1 04eb8318f173d6fdb5417e92645502d93966b8a8
SHA512 5e169a71116c41508283ee7224b7fee51c6b737a909c269e062e7494c9e7a853dbd4a762ddd9d9f104d79965d5570c2511df5b1c08c840c2037a4901af8a7140
SSDEEP 384:7zhykQ67ifiZgQPmqN64Q4PBZtjCiMEZiRkCYzMNFMvj686avLDo1bo0/GZl:5VQ6kU5Pmqk4xZTF2Ct6YLDkpql
TLSH
T1EEA2C01F966DC059082EB5CC9795B522D0CB8391E5CD106FD8F54C2FB4B277236E8B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 3e95a1f3af2e4c827413a724a23e8cc7f1e87264f0dd402eeafec45aef0f4f9d
MD5 528914eb391bc59f21a3dbffe40f772e
SHA1 32d204df7e57792971b2ccaf3856b7d3bcc760cd
SHA512 5c784cacc98f3710fbcf8d75f13fa935f6743904d235070cce9d52738e66cb15720ee362d40a7061ccea0dd32e5fc587167c4ff6ad3fad112c4264fb0fa00e5d
TLSH
T1F93125DC89A17640FF71A1F1D6EA7A53B5320127280B4F4F6882DBF06563AF6C829584
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 f18f5121751995d743fe3c43b8eb5be0d2fa34ac097ad350eb38dd7a5b9164a6
MD5 6a34226473165ea4301f154086b046ee
SHA1 6b43eb5c59188b1e0ad07e2f3fc22daf4bfa5980
SHA512 80f834f425b95173b1bcab1352d97644c2c01441f41d00411e79f721616f2e58d54b0f2bb8b5cf721d00246782133e2ba6b7d3db67e79372964004a0b8eea875
SSDEEP 384:D+PyZWGAJII9Ap9hJ+eKJcBelCNg4AKJYJZIOaQCtET8JcYa7of/NWCySn7su6vz:cYoSJKTQE0bsnTIFS
TLSH
T1AA82BEF7C3D8DE7DDA1122F4A7142E1BCE2D0D19466D3C2A89D9AE0BD3E2431D24169E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3a2059ea310dd727cf38f8ae922f2a7c7a71f9d3b11b035d1355711f53feac9d
MD5 89a146cc3c78aed0f06ffd390d178fd2
SHA1 fc702b6f0be2039f2e2071bbef501bac1dded947
SHA512 b34404937aec55b1e5559f7eb49a97a1bba97d0b1d15f6e48cddf8d978ca712a59c348a04ea320c0ae50d4d06ca37314aeec31a5799e88bfa661e783e169bf77
SSDEEP 192:LRWcBziHs3iv72vAPRp2+HO9THsb+WNn4H4In2wVPlkw0a6VyIsnAUge:LRWmziM3uC6X2Fw0L2E9Ua6e
TLSH
T15242C66EB960293B9DDBD229F9617727E7F5103139D42E84EAFC852C04E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c0dbed49b49744f09e84788b151530e4356cc803b0724905e88125fcafd18b0d
MD5 6a18db9f0ecf993e9249c9aa04c49d53
SHA1 30ad2098f4361c0e4930cd0871f727e9eeb6714b
SHA512 8c28242c8517bc73a55c4661d697bb66536e16a95a71ea2bedce7315edfccba7cfd5c0c7882b408f08e737b3c6fe0082dc63ca99dbf3a7449f3c68846524b31f
SSDEEP 192:LRWcBziHs3Xv72vSPRp8+HZG9THsb+WNY94HZ7wuMiMIn2mjVPlkw0aZ8yIsnAU3:LRWmziM3/C8X2FwTyHin2mJ9UaeE
TLSH
T1A752C65FB860297B9DDAD229F9217727E7F5203129D52E84EAFC892C14E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5a7e4771b06b8266464ab08d85618b8d7d14fb9d93f32d45440b6e94427e5a1a
MD5 cdb42a5bf8a69e81183c3ddf6774836c
SHA1 094a7beffa28efd4a954527db292cacddfcd3bb5
SHA512 304b02834c41f3623e82aef007c9c524d93fd8ae2e902bdf49d35887fba2aeeec3821aa4db162269befc5069e20c56e57eb4b2c1f520f1ef9fb11c84584336e2
SSDEEP 192:LRWcBziHs3nv72vAPRp2+HZG9THsb+WNY94HZ7N6+In2XVPlkw0aNVyIsnAUgE:LRWmziM3vC6XgFwTqB2l9UabE
TLSH
T11352C66EF960297B9DDAD229F9217727E7F5103129D52E84EAFC892C10E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 55e51f4ef25de440836e68136d2eaa15820f194831e271406d83a09dc78f059b
MD5 ceba2417faf453c91f1f191440e9dab2
SHA1 bb79b18c87888a3608510665ab0528aa6f9eced3
SHA512 8e120885adfc159a9c5a91e15686d256bcfb270fd89cc8e1788a42ecd1bc12e32bbd61e2c69c56b0a44b2450d45c8562d40602816fa47e4d25f13c9065407566
TLSH
T1C8B022300880C302FE002338EAC03CC033380E2BA32B082B00B02388CFB32022302200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b60a9468edbe5acbff202afc36edf675ffe54807779335b7825cf53aa035bffb
MD5 8a8f7c283c60c636f16c153b3819b686
SHA1 ed88987450da7543c5400712cacecc7038a50ec7
SHA512 3c486a8e80ea2fed09150902faa6ae264debd34a8a87fccff0dd2b4799c3058f11f1d3c32c4122eb5a312f238a37a852e263df7ec8dc2438e07d10befa893b0c
TLSH
T124A002D441C46D11FEB4467560E1699527534D562553C32355E19589889B5C04301500
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9ae8ca06a1f8c9f36a18d4f2c279d32144f70df5c8d8fb4d5828b05364f60c53
MD5 86470548c067cd80548d0fc51a7459e0
SHA1 991e86560a6bd00293e51bdf932d0a4960298303
SHA512 68d0f0b62b143afdd61a652c1cec7337e6befa0b96e13a44a86694f8510beb47306c5fd232844d1bbb1083dc9e70591828c1f5c811f572e40df34d69a668c8df
SSDEEP 3072:8Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Pm7Rkm1tYpBeh2BAom
TLSH
T165C3123B5E70E9775979A74EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 390a14c15472be78b31373f8146c75f0affa6f043075ee6d673e9cb1a03d402a
MD5 8c08ca8ddf2484e3570a85b95e988f47
SHA1 087b08edeb97bc24c964b73dcd92584fb4050c30
SHA512 24622b841342955230469eefb12cf84e9db92e4397b30f841886e11a12a5ec9739f4b2db22914dc9e3cc04df5898334da016c5d24df96412888a57f6b69c7a9a
SSDEEP 6144:XwHYW7to35PbBYpqsu5um7Rkm1tYpBeh2BAok:AboQJe9oBGcAok
TLSH
T17034232B5CA85C3A0C69BB4FB48F1A1F1E704E52C855DF41D5A47B846BE8BF80E95E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 acc56c4e0670f9dbef787866ce6db76d20e024855c3b13dbd0decbeb778213ec
MD5 f1e82d6fc7ba51ba4d1c29c07f6236da
SHA1 9d2f9261deb1aa9c44cde1ceef60a0aee18c729b
SHA512 dbc7b8ca8b393fd247aca3693d7e2433730b28f682e1c6da9be9920f3c1426b020db429cd9f81220b893cb423bf8d29c006076a2b8d4544bbe69e30cf21f56b7
SSDEEP 6144:EwHYW7to35PbBYpqsu5um7Rkm1tYpBeh2BAok:PboQJe9oBGcAok
TLSH
T19434232B5CA85C3A0C59BB4FB48F1A1F2E704E52C855DF41D5A47B846BE8BF80E95E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 0785297a788dd48d4e039dd94356e1d0a2ed842e4c326616dd3e05dceecb2559
MD5 c73608e43deccb8857285cb10e92766c
SHA1 80e9ba5c0bd49782bbd1f14a44a2a4500b94649b
SHA512 9829fc3f2d94b405a83a69e88dac1383994d6c643d51faf45b8ff5f6aaba9162a5db20cf7f3824ae1816e02c3da89d8c34871814f4c5c05e9b78650fe614c2f3
SSDEEP 6144:KuHYW7to35PbBYpqsu5um7Rkm1tYpBeh2BAok:pboQJe9oBGcAok
TLSH
T19D34233B5C68983A1C69BB4BB08B1B1F1E704A53C855CF45D9A52B8467ECBFC0E56E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ae93542-92bc-4db3-832d-c751924cc79e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2572_1022666051\7ae93542-92bc-4db3-832d-c751924cc79e.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2572_1022666051\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download