c0a2de773da6a81d51c99be83fa542f25c68e7df184ceaa9c768b31dcf99cccc

Resubmissions

10/09/2026, 22:27

260910-2c8dmsxake8

10/09/2026, 18:48

260910-xfxzvsec553

Analysis

user interaction
yes
max time kernel
899s
max time network
865s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.md
Size 4KB
Sample260910-2c8dmsxake
SHA256 c0a2de773da6a81d51c99be83fa542f25c68e7df184ceaa9c768b31dcf99cccc
MD5 1d4c96cfe0ecb2c08a828d4c937ba895
SHA1 6717d47fe22733416575f738e6f9ddf331f8d5ca
SHA512 f3021bebd3304ba35774c835f4e07278a8498c6c2cce7f3df94a54100dc09c9e6ddb121b7851526e3c1597d709c3c355ace484ade374e31e095fdb2c0a18eb02
SSDEEP 96:LPwNjSoqXfejaDQaebvcsUHITFLD48FYThyAb25gz8N/2t2P:LPVoqX9QaebcsZBHASvNv
TLSH
T10DA1F91BD3267239862243DD513762A1F774E0AE53FA8054189CC01CB12A46DC23FDEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
38	5992	chrome.exe
40	5992	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
6052	kdmapper_Release.exe
4084	kdmapper_Release.exe
3356	kdmapper_Release.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	api.gofile.io
30	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4712	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5992	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335528745783647"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
6052	kdmapper_Release.exe
6052	kdmapper_Release.exe
4084	kdmapper_Release.exe
4084	kdmapper_Release.exe
4932	chrome.exe
4932	chrome.exe
3356	kdmapper_Release.exe
3356	kdmapper_Release.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe
Token: SeShutdownPrivilege	3128	chrome.exe
Token: SeCreatePagefilePrivilege	3128	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe
3128	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5632	OpenWith.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1584	3128	chrome.exe	92
PID 3128 wrote to memory of 5992	3128	chrome.exe	93
PID 3128 wrote to memory of 3744	3128	chrome.exe	94
PID 3128 wrote to memory of 3744	3128	chrome.exe	94
PID 3128 wrote to memory of 2156	3128	chrome.exe	96
PID 3128 wrote to memory of 2156	3128	chrome.exe	96
PID 3128 wrote to memory of 3472	3128	chrome.exe	97
PID 3128 wrote to memory of 2636	3128	chrome.exe	98
PID 3128 wrote to memory of 3472	3128	chrome.exe	97
PID 3128 wrote to memory of 2636	3128	chrome.exe	98
PID 3128 wrote to memory of 1604	3128	chrome.exe	99
PID 3128 wrote to memory of 1604	3128	chrome.exe	99
PID 3128 wrote to memory of 4572	3128	chrome.exe	100
PID 3128 wrote to memory of 4572	3128	chrome.exe	100
PID 3128 wrote to memory of 5904	3128	chrome.exe	101
PID 3128 wrote to memory of 1224	3128	chrome.exe	103
PID 3128 wrote to memory of 1096	3128	chrome.exe	102
PID 3128 wrote to memory of 1224	3128	chrome.exe	103
PID 3128 wrote to memory of 1096	3128	chrome.exe	102
PID 3128 wrote to memory of 4336	3128	chrome.exe	104
PID 3128 wrote to memory of 4336	3128	chrome.exe	104
PID 3128 wrote to memory of 700	3128	chrome.exe	106
PID 3128 wrote to memory of 700	3128	chrome.exe	106
PID 3128 wrote to memory of 5028	3128	chrome.exe	107
PID 3128 wrote to memory of 5028	3128	chrome.exe	107
PID 3128 wrote to memory of 1800	3128	chrome.exe	108
PID 3128 wrote to memory of 1800	3128	chrome.exe	108
PID 3128 wrote to memory of 2500	3128	chrome.exe	109
PID 3128 wrote to memory of 2500	3128	chrome.exe	109
PID 3128 wrote to memory of 2280	3128	chrome.exe	110
PID 3128 wrote to memory of 2280	3128	chrome.exe	110
PID 3128 wrote to memory of 4712	3128	chrome.exe	111
PID 3128 wrote to memory of 4712	3128	chrome.exe	111
PID 3128 wrote to memory of 6128	3128	chrome.exe	114
PID 3128 wrote to memory of 6128	3128	chrome.exe	114
PID 3128 wrote to memory of 360	3128	chrome.exe	115
PID 3128 wrote to memory of 360	3128	chrome.exe	115
PID 3128 wrote to memory of 5076	3128	chrome.exe	116
PID 3128 wrote to memory of 5076	3128	chrome.exe	116
PID 3128 wrote to memory of 632	3128	chrome.exe	117
PID 3128 wrote to memory of 632	3128	chrome.exe	117
PID 3128 wrote to memory of 4664	3128	chrome.exe	120
PID 3128 wrote to memory of 4664	3128	chrome.exe	120
PID 3128 wrote to memory of 5108	3128	chrome.exe	121
PID 3128 wrote to memory of 5108	3128	chrome.exe	121
PID 3128 wrote to memory of 2316	3128	chrome.exe	122
PID 3128 wrote to memory of 6020	3128	chrome.exe	123
PID 3128 wrote to memory of 2904	3128	chrome.exe	124
PID 3128 wrote to memory of 5432	3128	chrome.exe	125
PID 3128 wrote to memory of 5884	3128	chrome.exe	126
PID 3128 wrote to memory of 6052	3128	chrome.exe	127
PID 3128 wrote to memory of 4084	3128	chrome.exe	129
PID 3128 wrote to memory of 4932	3128	chrome.exe	131
PID 3128 wrote to memory of 3444	3128	chrome.exe	137
PID 3128 wrote to memory of 3444	3128	chrome.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\README.md
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffaa0e4c728,0x7ffaa0e4c734,0x7ffaa0e4c740
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1888,i,747147809301732011,16100157226947409186,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,707205868101095713,18065970607379462097,262144 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,14926084603375327400,16760416391730159222,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,18013119858436281354,15735932122591505288,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,3284175815483853437,2980615718335421539,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,12589578868409422351,11778731944533036458,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,1033632140136884056,16464197976988358588,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,7288536541219110052,18426893835442380832,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,13872974454929154024,12853668395958936809,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,7971735087065218158,17892664156127132365,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5532,i,14943173397051252596,11076913403405565640,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5712,i,16043670187332812651,14563319854024641063,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5940,i,15622855561413725835,370871982586307385,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6204,i,9061853640416954098,14312180826300295430,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6380,i,14288731641157693735,16061742941456957363,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,10417723886236431995,14757060393016674204,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6124,i,2891324534587270910,17523279979695442276,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,10523362691996186399,18441851633255598878,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,8598390820891615589,774077354286541584,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6120,i,15196211119467599191,149576676628254865,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:9
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6456,i,8123846206201029081,7850826667905986115,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5700,i,13860004349648416281,12165379321758769221,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6372,i,10835271360026315220,9922482415033188567,2097152 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,7836764434612772759,17758941202471624054,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3660,i,2807533873752677601,2167637702633915318,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,1944901056187279664,17924154031939845866,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7000,i,10938794162854375494,13494918032467825741,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6988,i,7769176219354890612,17577594279287959008,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
  2⤵
  PID:5884
- C:\Users\Admin\Downloads\kdmapper_Release.exe
  "C:\Users\Admin\Downloads\kdmapper_Release.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6052
- C:\Users\Admin\Downloads\kdmapper_Release.exe
  "C:\Users\Admin\Downloads\kdmapper_Release.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3724,i,12077237226967778573,9868125690931997054,262144 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,2820233473065522218,11000848559305088777,524288 --field-trial-handle=2140,i,13988441328878468181,16268815815855570195,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:3444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5276

C:\Users\Admin\Downloads\kdmapper_Release.exe
"C:\Users\Admin\Downloads\kdmapper_Release.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3988

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 159KB
SHA256 c15c168d8cf2412da724132e3240e46c37ec9932983c35a302330df616fd650c
MD5 73f41bb02fc3019e1c5eb57581aa8dd2
SHA1 fe639d9595d3c79a51ac4a1e4e8e9bbf7017aaba
SHA512 25b92f06f70f74ea81b4199cd2a2dde3d910eeeacf69764a789b53ec2d7feb1a147e0c53c13e3d23e50f72656bf1e4a8ee0df64c152c3d0fb199f9176a877802
SSDEEP 3072:mBwH8yE/427TS2tXk5JA1pxSHhr2GI1sFni6FzkwAemJTQSaMm5/6b2mV:mBwH8yEAiTSoIA1pxSHhan1knAlWlst
TLSH
T1C0F33A1697A91079F2B7D5BCCAB20901EAB17C850B75D2CF136049B90F62BD4BB3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a2511d4182435cc1068d6aaad800cc3d014a9eadbb4c9cd190dcd3ec4a21c30b
MD5 1c9eb6a1a686d7a2059be7af0f33b242
SHA1 e81a142f3c66ecdc05380f696ea79e0c9256445e
SHA512 ea9b449988c80a86a1ea6816c58770ddc0ef10ff17a9cd059ae162db159b6f655ece548f331ef6491c8612778037ca93aed2e8fa6d3e8879fc1d7654aadf5d60
TLSH
T1EB2182EBF53D9820C3E4C230DB85C9AB2EE50A9184D2F4AB0104D4387E06F8B32856AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a7dbb22f820d2df410935cd2d28ab1701ff8dbbcd1956d52990a0d8be7f29024
MD5 102527e508df3c1e619adea38b7a20a3
SHA1 ddf80d69889c27484f05a7bdfc72da2c3c3b615a
SHA512 b5d542e4d88156c61d74a45355dbd6ddf0a23a7f380d0223f1b9aeeb1bec7f9a7e897bed1a4d6936e0d9fe247b2294ca0db8a83ff026399ff6bdb165d61e973c
TLSH
T11F214EB8FA6D0870C340D230D7C0D86B7E761A80C8C7FCA74146C5B93204FD9B2151AC
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de740deb9865c3e2bfbbe202f9b0ea8325840d419271052f74e4858441a724b9
MD5 091dc365894b04dea686ef27214a747d
SHA1 a76e6c6498d8b5d35ee93a6aac3e4008febdb198
SHA512 6ddbab33e2a66379a66ef8668915de62f0c43cb65fae8cd71d6130c34f0b7ed1913423a5c5c8c3272f35e4dde872231f8d1b431ba21632f788d8679bb02aa690
TLSH
T16351BDF7D3E4867D892196F4EF116E1FCE6D0924432C3C6689D4AE1B53E2872D24139E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ac3adc07b277385606253f9fbb535e2750091d4729a22b1cc4aa091d22145c33
MD5 38253976d832c401b9557129b5f63079
SHA1 ae0e854a03857eff493e12e040bac820588b5923
SHA512 18d43dde544ba7fa9666531cb852fecb8f010517430b94f5a63434642d7c0e28747de9f3bbf8564fc7faae8cacb7d7a3f70631c955c17556d46dcf553a7bcebd
TLSH
T15D51ACF793E4967D891196F4DB11AE1FCE6D0524032C3C7689D4AE1B53E2872D24139E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5d3fcdb0c1b2d39b2a9d1c48a6db93a643139f94ecbe09d32da64c6b32dec7ed
MD5 fe3d3a0a147f50d7faa825f92b1effa5
SHA1 569409792ce5f73f07ee895f90c75746b34e7a50
SHA512 080a37eb120521addac0ea991036b4a20f17d1fedcc80b6b154dba5aa0228b986a2b43b9efe4ea6407dec5f33256bd9a8b9108ff567381d3485526ccf50a65ab
TLSH
T13C51DDF3C3E4867D891196F4EF116E1FCE2D0924432C3C6689D4AE1B53E2872D24139E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 abda67744f1e79115f116c0e510d1e104a6186012398df7b2284598feeedf9ea
MD5 fbd6bc857857de04a0600662cf176d90
SHA1 407557c0a2da34dc0d6797e0789be8fc696ca961
SHA512 d8063878bbafcb91260ef72c9630b2a0f2308a41a95fb6bdae3f5c38010407fc8360268b8c0f8a93d635aed19a5ed51a1ef58efc38056f4f9307d8051fc5b976
TLSH
T1C951ADF3C3E4967D892196F4EF216E1FCE6D0924532C3C2689D4AE1B53E2872D20139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 077c5ff9491b7990209a04702ec8748d5647a22c59535961f3d56fc613cdad84
MD5 2e1a3e7507e5cbe8758060c729039a8c
SHA1 2b89d35bb087f288f32285a2cbe1cf868dc1fa12
SHA512 0ad01e50491a4a2c9f2d0280c3701ce5cbcdc1c437aae877d9984d0267bbe034efbf3fbba9138092e392e52583efc5bba8d0985d4017a1b415a4594259db6efe
TLSH
T1B721AC579B7FB4AB507848FB1E053D0A6AB9B832034168F4DA6B826C70915FB0713853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6efdfe6b9c80d41afb479fca04e9fa93a9eaac9a5b719d6805e1435c902f66a2
MD5 1f7f9f15467bb6f2d6cf85c0587dd49c
SHA1 71ae4118e95196187ff5289226ccb9a9f80f7649
SHA512 30f6a42a6d179a162952a3898a81eff58376411759b013272b2f73ac7fdbce63434186376d2beeac6222453a34f140c625f0fe020936a1ca3ca38582319db201
SSDEEP 192:NRQp1b4VJIv7gAPRp2X964Hsb+WNnQKU5IdUvF2WwkwNhOVyIsnAUge:NRQpdSJUVXUbwQ35IdUd2WwrGe
TLSH
T19E42C57EF965697B6CCBC229F9217B53D7FA102220902E84F6FC9A2C14E75CD2227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 65f02d6a4c6a80f3df30868e09d28c5830dc39d9b417b1359c5bb747cc570c3d
MD5 88eb5c35cdb0c7acd2d60ba2b2eb1f53
SHA1 037c3e8ff3a405c08fc29fa2f6e9812918a4f018
SHA512 38533d2cdf27e0a889be194fefd49125960d33b35060e35772bbad0bc6075bfcb4c1f9e042f0b3a9144458a8d29345ce6c4b40bf915cd9b4e19e808f70788294
SSDEEP 192:NRQGlbuVzpv7g8PRpw1lf964Hsb+WNnQKU5IuyRupF2WwkwN9OVyIsnAUgE:NRQGtczp5XmbwQ35IluH2WwDGE
TLSH
T1AB42C47EA9216A7B6CCBC219F9117B53E7F9102221902E84F7FC8A2C14E76CD3223517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3b8d0426c0cb9a28a5b0d6ee15b869a24b783b79dbaa70ec3cc4dd1920502cb5
MD5 5e32fad64f72d7428cb1b01f1c63431c
SHA1 abdda2a19f1d2d5354710e1bdf5ab58c03808fe4
SHA512 75b8e94941f74b4998d7c57ec6a69330fff81e27b73f8a11e3a1124dd8a72aeea334e632f3fff98d793f24d6717e4931dca1a9f3387bc818abf060718dbee889
SSDEEP 192:NRQp1b4VzIv7g8PRpw1lf964Hsb+WNnQKU5IuboE0F2WwkwN9OVyIsnAUgE:NRQpdSzU5XmbwQ35IBEY2WwDGE
TLSH
T17D42B47EF9216A7B6CDBC219F9117B53E7F9102224902E84F6FC8A2C14E76CD2213517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 faa145fb627aa287c2950db6012b9e4662c2ee682cf683d1a276b9f872d14625
MD5 10b6ef81231b3dea4f0f4da5997f0e6f
SHA1 74ac17671a1a8c641b9a9b44d5068989db79fb87
SHA512 3b8b84c3785ca42d674cdd8493965abd0843112ad12b4cbc1b2c2cf0a6ac9ce839d4349fc37b5459f7f410b9f11c7d9dee865f5630a879ffc216f6a834a170b5
SSDEEP 192:NRQplb4VzIv7g8PRpw1lf964Hsb+WNnQKU5IuboE0F2WwkwN9OVyIsnAUgE:NRQptSzU5XmbwQ35IBEY2WwDGE
TLSH
T1FA42B47EF9216A7B6CDBC219F9117B53E7F9102224902E84F6FC8A2C14E76CD2213117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2019803db90f165803cf997c165922856e5ab6c69a7d78685b177d35f3488135
MD5 c447ca796441c332fec8073e0f1c93c6
SHA1 ea963921835857972c726a72c3b0c555eeae449f
SHA512 f8ad7a9667f5fd3cb522d5ff47b67c258c2733a6394e9809e991a5d06c90a12ffab8aa7fad3b3aa2fdc0c9818ca379d64c9b374124b81ec70f1d5289438da8b1
SSDEEP 192:NRQGlb4Vzpv7g8PRpw1lf964Hsb+WNnQKU5IuyRupF2WwkwN9OVyIsnAUgE:NRQGtSzp5XmbwQ35IluH2WwDGE
TLSH
T12342C47EB9216A7B6CDBC219F9117B53E7F9102221902E84F7FC8A2C14E75CD2213517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 08ef91a1c391670a28e628c3d4a0be6e550ad5c6227a6847cf83cd1fc2e879d1
MD5 a0a11c93276311221eef1da5c23965a6
SHA1 a38d9101730992cca2d33d93b82ff6d4c9d0eee9
SHA512 1e31943acbe070521959ce3ade0c2b73b9491a940a103ec0218d49e64e7b02ca5f1f613186442d281f056d3dd977eb2dac7814adc567e86d2999badde8180606
SSDEEP 192:NRQp1b4VbIv7gAPRp21ls964Hsb+WNnQKU5IuZ12aF2WwkwNhOVyIsnAUge:NRQpdSbUVXLbwQ35Ii2G2WwrGe
TLSH
T19542C57EB9656A7B6CCBC219F9117B53E7FA102220902E84F6FC9A2C14E75CD3213517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 680832f7224e20a7de607e98714c3516d50ecda2402b24765fc30e461134fc7c
MD5 190a41b02907a872d28f8461ca28b330
SHA1 728cd85e0023019200c1d558eb070d61ce99fcaa
SHA512 1a4c290869cff77f766c36caffb56140ae3a3e806df82346fb87a5f9bad386fc9ff8a0bba000107842c82c079d402612126bdc91cf60a2b9d8b07d1e1993c62a
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3jSJJHGj7RqtXI:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAONF
TLSH
T11F520867648D9A3F0FD8DA8CD8277F4FADB501576568092497FB9C0803E4BCA114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ab88f90d4590dc1ee146c885c156ad963b15695f39b1b9ee3557f09bdd60df1c
MD5 26a627e373dec564e7fec551d2f39f86
SHA1 3d578b79c1034fffacb7dfc8bda8c78280e13f62
SHA512 e039f08b44abed7f430213d64636ba92823c28bc8531987ea38057a38b626fed51079ba82ac024cc6b5ec8add07aac9bb1616189c6089019420ea0c41787f0dc
TLSH
T1A6A002608DC0291BEF208670F1F30561329A9919266A431795D28578A95F2C04192541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e1cb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59e1cb.TMP
Size 48B
SHA256 998c893d55c2815e3badf44291a8abad059f5c1cb5a86cdd26cabcef35e50355
MD5 9cc869b154c63d83a3d6d08765914e27
SHA1 3d09f5cc4942fb20b26d7262afc0712e32ab0dc6
SHA512 ba9056650ceec1a8182ce24214ba8637209dec5427f634cd92e849888b19cba7acafd54f966304b276411f860150feda25eade19cb4f0a5fc47dc04396ecf101
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8c2d8a007d2d1f82d5e071a4001cb18015ae9357e4738795d72766230e99d894
MD5 25c197d53f4e09f4dcab56bf530447c1
SHA1 3fe43c69280c6c541e61bce4f6ea9e8dd960a713
SHA512 49f22b89e171d78037b7e2387b67e37b4fdcb8432b0a2768ac07f41f6af155ea9971d4c91e1ccdef3bd3425a896b27e4e0803ff32c6fa824465aa6e0200caeb3
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok58CDjB6/dGyv95S2hbb2Jv4a:gC0LA/TE57cDUDX9UweS2hbKl
TLSH
T16BA10871B4A95EB75DB6C684F5827E83CF68A117A9227F80D8DD1F0C10E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 60781b79b4adb7bbc8cb6328dd8cc700554cbecfb2f5761faf9850001f179d3d
MD5 f8a809c2306906b412e877e4aa415c5a
SHA1 13df966c8fea02c31d9c475c82195ff823818d6e
SHA512 f74967bba53dd7a8e7a7fa60b1af829d4954e30a00d214d3afd6cbf93ebef0e9f8aff40d946eea479cbc2a00b1bcbaf80283994f20ec53f86a65efc72ecbc84e
SSDEEP 3072:Ona7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPX:wlC949PSmzO3XvANUPX
TLSH
T170D312B198E93D997574CDCD80CBDB420EB4A1CB8E0199CD21DDFA9990C6E1E1E2BD0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 63e2971fb4350008460ebc3a83156d773c2f72d0b782d73b249cc520bd0df5dd
MD5 c8dbfbfd0d79e9d8ff90e81cc0309b61
SHA1 2db3decc38d887fa12697fec4646754c10fb4761
SHA512 76d434c0d809df3593e2344d069c5655eb015879a03cc7bc80ed723b08800da3f2c3a0b869a2cb33d4bf9e5ab37d844c90c7805df3266b5b510cd4c3ba3a554c
SSDEEP 3072:rna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPX:7lC949PSmzO3XvANUPX
TLSH
T1F4D323B0D8F93D9975B4CA8D90CBCB431E70A1C58A0185DD12DEF6A9A1C6D5E1E3AD0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 3f4fd4ca1ff1123e318bbefbec0c37245948ca4bb455a7fdfb34a971df6f8c30
MD5 749e8ec376d68e77287b6f70d6cdb0be
SHA1 d996331f0b91317a92d826a79b7e175cf73465c0
SHA512 f41ffcd01507279a2447add8d950d2b5ac6f55a4cc3ff78513666a5cafae713ddaacb9aa50614cc6d15ff47e424bf983a2f8dff6684c5d3b7b6885449f8890a2
SSDEEP 3072:Mna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPX:GlC949PSmzO3XvANUPX
TLSH
T151D323B0D8F93D9975B4CA8D90CBCB431E70A1C58A0185DD12DEF6A9A1C6D5E1E3ED0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 d962d95336f0ad96bd5054e56390b4c8a0e97d4d6ef3cb5d299ce7975e28e9af
MD5 cffa05cd82b1d622f6f645fe9ff47aba
SHA1 6dda1aedec5cccb870fa0de5e6a63c158b9ebb9a
SHA512 5ac307d64b25d30272467a82a280c3908165643418a53429d842e1950be6b780f73a43cd157f12170da6012f3d1624b0faba7b2e534d8cf967b0e9cfad3280c0
SSDEEP 3072:Cna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPX:ElC949PSmzO3XvANUPX
TLSH
T19FD322B198E93DD97574CDCD80C7DB420EB4A1CB8E0199CC21DDFA999086E5E1E2BD0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3128_761432084\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 79991.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 79991.crdownload
Size 25KB
SHA256 16b63c629c59a5e0de897ce54eafe07137db22c95045ba3db17c8c02181b9aab
MD5 06dd13a9c63be5487d5bb67d9a34fc74
SHA1 88bbb7a6026dcfae3be508418074d9950c0504bc
SHA512 d8f5c4d53223fc8606fa6f9989dfd311acf7811789c846f67be3163c8d20bc1e8176413de47db401b27e3e20ee5e849e012a5c597f23fcb469f4df1edf22c7d7
SSDEEP 384:1vOZaeIVHhXsXdXKXg5XVXjXQwJuHFXBX4/Dnm4nTAoswmCwduRfL7TFCM:1vOZaeuRMNCElTPJSx47VgCw0B
TLSH
T1A5B21A15E3C6137CD147C2FAC297A939B5323C600B372CCBC7E09B2918A5BD1663965B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download