6bb445905386599132b6d9becb9ace375830a7c8103009d1238cb1349fd27854

Analysis

user interaction
yes
max time kernel
170s
max time network
172s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shattered Pixel Dungeon.exe
Size 429KB
Sample260910-csbxyaterf
SHA256 6bb445905386599132b6d9becb9ace375830a7c8103009d1238cb1349fd27854
MD5 9341ecb1f36bc28e48eafe8e47f8031e
SHA1 62884b7fbdbeccfc585c2cfa7846d7dcf97ef408
SHA512 f39e2e986366fb8864b0ddf9e7ed3e39b4589b564606748d6d7f8a40231d11f16820da4ba1a662919fe2d05b89b124d8bd092c6b34c9d6f873195c60be28ffab
SSDEEP 6144:rTZpx1b7qWLmJ9NvUATvOLjsJ3jRh4kUbCoCCbV3V3LwpcI4:rTZp3jCHUCvOkJ8k0rBapcz
TLSH
T124947C1AE7A804F8E0E7D278C9575906E7B67C5E0771D78F03E846662F232A09D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	camo.githubusercontent.com
110	camo.githubusercontent.com
111	camo.githubusercontent.com
112	camo.githubusercontent.com
113	camo.githubusercontent.com
114	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5776	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334805026344578"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{7486A315-758A-4BE5-A64C-E236C5340E98}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 2376	5924	chrome.exe	90
PID 5924 wrote to memory of 2600	5924	chrome.exe	91
PID 5924 wrote to memory of 2600	5924	chrome.exe	91
PID 5924 wrote to memory of 5776	5924	chrome.exe	92
PID 5924 wrote to memory of 1028	5924	chrome.exe	94
PID 5924 wrote to memory of 1028	5924	chrome.exe	94
PID 5924 wrote to memory of 2608	5924	chrome.exe	95
PID 5924 wrote to memory of 2608	5924	chrome.exe	95
PID 5924 wrote to memory of 2880	5924	chrome.exe	96
PID 5924 wrote to memory of 2880	5924	chrome.exe	96
PID 5924 wrote to memory of 4972	5924	chrome.exe	97
PID 5924 wrote to memory of 4972	5924	chrome.exe	97
PID 5924 wrote to memory of 2936	5924	chrome.exe	98
PID 5924 wrote to memory of 2936	5924	chrome.exe	98
PID 5924 wrote to memory of 6004	5924	chrome.exe	99
PID 5924 wrote to memory of 5840	5924	chrome.exe	100
PID 5924 wrote to memory of 4736	5924	chrome.exe	101
PID 5924 wrote to memory of 5840	5924	chrome.exe	100
PID 5924 wrote to memory of 4736	5924	chrome.exe	101
PID 5924 wrote to memory of 2664	5924	chrome.exe	105
PID 5924 wrote to memory of 5976	5924	chrome.exe	106
PID 5924 wrote to memory of 3136	5924	chrome.exe	107
PID 5924 wrote to memory of 2664	5924	chrome.exe	105
PID 5924 wrote to memory of 5976	5924	chrome.exe	106
PID 5924 wrote to memory of 3136	5924	chrome.exe	107
PID 5924 wrote to memory of 1900	5924	chrome.exe	108
PID 5924 wrote to memory of 1900	5924	chrome.exe	108
PID 5924 wrote to memory of 3024	5924	chrome.exe	109
PID 5924 wrote to memory of 3024	5924	chrome.exe	109
PID 5924 wrote to memory of 4320	5924	chrome.exe	110
PID 5924 wrote to memory of 4320	5924	chrome.exe	110
PID 5924 wrote to memory of 1500	5924	chrome.exe	111
PID 5924 wrote to memory of 1500	5924	chrome.exe	111
PID 5924 wrote to memory of 108	5924	chrome.exe	112
PID 5924 wrote to memory of 108	5924	chrome.exe	112
PID 5924 wrote to memory of 2700	5924	chrome.exe	113
PID 5924 wrote to memory of 2700	5924	chrome.exe	113
PID 5924 wrote to memory of 4372	5924	chrome.exe	114
PID 5924 wrote to memory of 3084	5924	chrome.exe	115
PID 5924 wrote to memory of 4372	5924	chrome.exe	114
PID 5924 wrote to memory of 3084	5924	chrome.exe	115
PID 5924 wrote to memory of 3372	5924	chrome.exe	116
PID 5924 wrote to memory of 3372	5924	chrome.exe	116
PID 5924 wrote to memory of 3008	5924	chrome.exe	118
PID 5924 wrote to memory of 3008	5924	chrome.exe	118
PID 5924 wrote to memory of 1896	5924	chrome.exe	119
PID 5924 wrote to memory of 1896	5924	chrome.exe	119
PID 5924 wrote to memory of 5840	5924	chrome.exe	120
PID 5924 wrote to memory of 5840	5924	chrome.exe	120
PID 5924 wrote to memory of 3852	5924	chrome.exe	121
PID 5924 wrote to memory of 3852	5924	chrome.exe	121
PID 5924 wrote to memory of 5800	5924	chrome.exe	123
PID 5924 wrote to memory of 2304	5924	chrome.exe	122
PID 5924 wrote to memory of 5800	5924	chrome.exe	123
PID 5924 wrote to memory of 1212	5924	chrome.exe	124
PID 5924 wrote to memory of 1588	5924	chrome.exe	125
PID 5924 wrote to memory of 2348	5924	chrome.exe	126
PID 5924 wrote to memory of 5324	5924	chrome.exe	127
PID 5924 wrote to memory of 5324	5924	chrome.exe	127
PID 5924 wrote to memory of 2772	5924	chrome.exe	128
PID 5924 wrote to memory of 2772	5924	chrome.exe	128
PID 5924 wrote to memory of 6120	5924	chrome.exe	129
PID 5924 wrote to memory of 6120	5924	chrome.exe	129
PID 5924 wrote to memory of 3564	5924	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\Shattered Pixel Dungeon.exe
"C:\Users\Admin\AppData\Local\Temp\Shattered Pixel Dungeon.exe"
1⤵
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdcebdc728,0x7ffdcebdc734,0x7ffdcebdc740
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,17545081021999409241,9162515709133517137,262144 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,2390098218317562935,7373760343789912630,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,7203343464661452873,4538543155119130519,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,9975211574994315844,4366782621922441985,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,5756522805313566578,17064235347804037291,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,1450713790525652188,8802263716517024669,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,16962525904630363809,3158056050593114309,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,338575282652862728,1317765273466885939,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5380,i,17790353710714842855,16917964149673814433,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5392,i,10329718996256838094,12677044640063454753,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5736,i,9157849234659367254,17385256639766869071,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,16133381908528859866,8740266904358118275,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5376,i,3062478738485466624,15350570126294647565,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6100,i,5838144335017674851,9029678382522814622,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6140,i,17959031812706354465,13114341435516666203,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5536,i,7020879949597768578,13162029513983267013,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6140,i,16528679986448460260,9849240150878674818,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4576,i,11796392994907163897,18274282477157549416,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,3692014749902366363,13537313684555837594,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5728,i,5037423984155695344,17139277495676882354,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6028,i,13029977233620272421,10051378345112426528,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:9
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6036,i,7043632252199986711,8801550061492880211,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3596,i,5089061836018021368,11518212935222521914,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3232,i,7421165555586503416,10589909787980301752,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6184,i,9376700898262397543,2436968960301792954,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4736,i,10420778069099626806,12487701264686196855,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,13606166462906885082,14581565772575476029,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,4239786756033018540,16536494630463985048,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:12
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,6530009252953201911,13330776220681098270,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,10937627058709607329,624707106162472846,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,2806014154635797693,1102179483805362778,524288 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5988,i,4799782250071390031,10305362751286235311,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6512,i,5369958147940919700,4689595924869089125,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6796,i,14371192855810302775,7172636106761650532,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3672,i,14272276958019440582,12039237938572602028,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5600,i,1854864427996155148,15151823569230921011,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7140,i,7657139882525460841,12024347036670689309,2097152 --field-trial-handle=1840,i,16729727195724485813,17768470872471362234,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:2576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54fe246c-bae0-46cc-8df5-dc9e9e2647d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\54fe246c-bae0-46cc-8df5-dc9e9e2647d9.tmp
Size 11KB
SHA256 01fc684c95752e75ee26adcb7cf8364d7d25cb07b2986a6e23683f703d9a7a37
MD5 85ae2a0c21bc35bce34e8395bddab3b4
SHA1 5ec4d972b9482835405ea602ee531c6c977a7c34
SHA512 d6c7ef4a801c9308f3a1884e1060393c9f03c9c347c349cfe3b7046eebd32a7205ee16050bc811d8200babc0c4402e11a487d5c1734dfd5ca3bfaf6d68b6d045
SSDEEP 192:cRgLAZYv7QAPRp2s9EHsb+WNnK70q8kQpp4kwC16VyIsnAUge:cRgL8EdX7mw00qVQpOiEe
TLSH
T18342952EBE11693B5CCBD219FA21B793D7F5102261A02E84EBFC896C25E75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6acb634889caebf944b41701076bdbea29d6c3a23178c48054de2da3e1d40a62
MD5 c757afdd9abd18c8958c5f1b06f94f1e
SHA1 a3c342dc04a7700dc3aed4f4064ed0fc2089f688
SHA512 4a84c1763242d855b43c23637f9eb4873b8797ade1f9776dbc87d6d1424c6db1e98647ec21993dff145431f671464b4ce157edd39576a071393030699312d619
TLSH
T12A21B172B284A4C4FBA51A350FE6D9373B30B4EB4D364B4ACA44DAF846C23744C13029
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 1973f338bb70622aa7028c775eed07a0e237f93868084d476e91d89de525ce12
MD5 6ecd82e54912dee4e64c6c0dbb5df064
SHA1 30aa35ae1e494b08d38a314a313cfa8890e3ea37
SHA512 a3c7a305de60c9b47971a9aeb059360ac8760c9fdac603bab45dbf76606eec4e482954e9897cdcf9a8afe671d067d7baa9eb080e43df7e825dfc0b67e1565dbf
SSDEEP 384:DLPu4XG8bniRmelbrI8unyLFGhop5IGIkIPIlNnalfOe6NQ3wVLOjjjsCjhljjMr:z5fgfa1BAa6r
TLSH
T1B1529DF7C3E8862DC91196F4AB162F1BCE1E0919432C3C16C9D8AE4F97E29B1D35154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e42458f21a9a54fa8cac9d37e47068039a8a943866065420f0a9589707f3fd76
MD5 5f6a7588298c4b27b58a0802b75dbd92
SHA1 2ba13763442e4efb5744f06521cae6f1b24040a5
SHA512 eb50322961665efb84a934106a4348be1149497fbf231e34ecb6f3a874f16ce36ed4f2fd1dd7acb27d085f535916555627a67bf9e5d90b7444120dbd5b144d49
SSDEEP 192:cRIcBzLAZYv7OFPRpcxPtloO9EHsb+WN7rFK7ykbM4J2q6kQpp4kwC1CVyIsnAU3:cRImzL8EUXkmwaZN2qTQpOiIE
TLSH
T18552C56EB9202D3B9DDBC219F911B753E3F5202665E02E84EBFC896C21E76DC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bc1a13f6ba6ba8565db4e235ec785284214e3e59f91a843d42533ce95fb7201b
MD5 362e23aa6af141b816cef3e1439cf634
SHA1 a217de022eecd3541c49a7d9f8a9105930a4a0ac
SHA512 ec07bb3200a596d1f0a4f1a39f83c3e51b39798de7797e735c544b0caede5a916c9c0d4ee509c6116cefc9e3a259ed7e6f1557598a648f19548db1b6aadcb1be
SSDEEP 192:cRIcBzLAZYv7QAPRp2xPUO9EHsb+WN1FK744J2qWkQpp4kwC16VyIsnAUge:cRImzL8EdXsmwcp2qfQpOiEe
TLSH
T12F42C56EBE20293B5DCBD219FA21B753D7F5102265A42E84EBFC896C21E75DC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 520ea71314bcf825035554885ac336d1fa2f14bf7cd1add6cd4912500aceba21
MD5 48243b913531ad5d867921e7938b87c0
SHA1 f205ddeceaacb11229f013a755f52ec98a5b607a
SHA512 de4fdff9250474bdfaa084c8cc618f37ddb7f6b3b1e070c2f872c43d9179eb34eba3a4255c7abed766ee295bffe6fa5cebfd5b2a5fd526907cf623b5b0e18706
SSDEEP 192:cRIcBzLAZYv7OAPRp2xPtloO9EHsb+WN7rFK744J2qlkQpp4kwC12VyIsnAUgE:cRImzL8EDXamwap2qaQpOiEE
TLSH
T15C52C67EB920293B9DCBD219FA11B753E3F5212264D02E84EBFC896C21E76DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b4f8e5266dcd45aee5276b0b7a993e53ba5cd2140a8bcee5d6c6ecf6767784b5
MD5 866be5204ff289be884aa9b3d8b8ec75
SHA1 2c67b4d58eff5965ef67126bcb10a09e8ceb30de
SHA512 1a8e392d9d9d58f58a6b8802d8381538f97c7635b20792eaa39b1f1250d6a8e85828d67f085f3bf81439937f2181c5afac57a717ad02019a1fe9784d22aad6f4
SSDEEP 192:cRIcBzLAZwv7OFPRpcDNTaPitlopL9EHsb+WNJpgRFK7ykbM4J2q6kQpp4kwC1CO:cRImzL8sUX+TCmwjZN2qTQpOiIE
TLSH
T1C362B66AB9202D7B9DDBC229F911B753E3F5202664D02E84EBFC896C21E76DC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 406b2d88677f04e07d443adc4962ffaeaa49f40868fc4245dec79586d47eaa84
MD5 273269bde2eea34d3e17a1e9c6aacba9
SHA1 32c174ac4a1034481e7d5326feef883b80f15118
SHA512 2e15a664c9dd169f197a2d96c7f16ef4bdee696bf9a006bdeab410a68fc5dd9a831e32ddd28be6bcef56fa428ea831b0084f68caba8c8884f741a2eb6e3c596e
SSDEEP 384:WQjZ07KxkXqKf/pUZNCgVLH2HfgsljhRXODZ8+ErU3oQHG3pGYHX:WUZ07KxkXqKf/pUZNCgVLH2HfgsH1O16
TLSH
T12152F967684D9A3B0FD8D94CDC12AF8FADF50256A6A80C2497FA5C1803D5BCB114B1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 eaf2629509baa24688643da55c4ab59edb5ad2507bcf9fdd2904d59ac7127227
MD5 3457ee9cc660296a587aec75abbf6015
SHA1 ffb23df0277f2e993f900ba818a690970b772720
SHA512 2bc6810ef5fca6699010f264563cf04072ec13e93d93839203be65bd7c1f3afbbf65c7a43d123379e508f102ed8b756619c2feaec74db3fd14ca869e1c5d4c8f
TLSH
T166B022C002A200A3E0800FB8E3C000E033303F0F03838303B2A23882C32F3C38202280
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c9726c3cf6ddda78eab0f253aae1bd9fd3c17376a8fb5317a4cb722a89d6ab50
MD5 1a71769c35c62db126991853eda2e67c
SHA1 296d3607a22be5322db3219a67e37c6670d87c33
SHA512 839cc5bc61131e5cd426a0864ab8d5bf2b49e6e720c75f7268096214323b89da4cd7b898bc4f3bba34d59a217f541eeb3c5b8e88b25a71baec1cfb7915cfaf55
TLSH
T19EA0025043D84491DD4852727167078166914C555571571395A384F49C9F1C45906610
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bcba9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5bcba9.TMP
Size 48B
SHA256 35f67a7eea5567221ffe03bc0200980433d9fcf6892517be30811e78502e7485
MD5 7d579fee97df34c4b3d62cb31631b21a
SHA1 86bc71a6c76c5ee3788f860dd1e408769aa73483
SHA512 113838ef85795e5a0ff34d854e25615e3fa51e3617945acc129dcb33a01dcbccc1547e224d4aff4c38fd98b40da38f2a0eefb4b13db27006412090642893494a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

752c9784-65e2-4d65-a2f6-5e2d7ac01947.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\752c9784-65e2-4d65-a2f6-5e2d7ac01947.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\e443187a-4e9a-4250-85e2-6efba18ba0f9\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\e443187a-4e9a-4250-85e2-6efba18ba0f9\index-dir\the-real-index
Size 72B
SHA256 b9c971c5bbddeadb6853f0c62eae656924a6d87abf250da6f07134ef361abae0
MD5 ea5486403e7af980ecc5d5441b8e27f8
SHA1 6efb266c75e481d44f9dc2a22d56ba6ecf21d085
SHA512 77a3809a2decb1237cf570a599a29d68289902e657fbd3806aa0259ee5d5cbbeb59a57faf57ca4cbc7a0114511ce6ff323fcac5cbbbb1d37ce1361f7d5bf3a3a
TLSH
T136A0027C12701782C40006742C578171323759B4F9454322C1F161D4CA922B5850713C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c21a9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\e443187a-4e9a-4250-85e2-6efba18ba0f9\index-dir\the-real-index~RFe5c21a9.TMP
Size 48B
SHA256 0efcdda67293996229e90d08dea1e5168468e3f265d6ccc001e270f6d1666a09
MD5 3dff147ee542c6bf900606499ee3a353
SHA1 1390adf939cec90f36a642ed5ce701136bf55125
SHA512 cdc81c6f0b54b94e51e88728093e7c5642f59c0b009f4df8d3796f5c1319794711c3eba5a5bdf4fd090762d0646a1fcd2bf0a78f3bf8fac5f53c25d00ae63488
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 73B
SHA256 c3bef144f4e170d9176d152c764bc8646769e918f899e5992473b18b73cb8efa
MD5 2de2db5b529eba9aee7a4df0f5ed6483
SHA1 d9d4bdc2f8c30e565ec1cc1e3f695d6df17e09e7
SHA512 a27dbed5073c38667297d6062df0321bb095d06a86babeb0c8b1c1bdebefb0b2868c1eb822972a6dbba0514c0d41de6339f61e4491e9f30231de6528995049fe
TLSH
T163A002F70800C08E0F30ACE8353ABB5DE00B95DC8CC4CDF4C41980422138AF70402854
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 154B
SHA256 9318c3c1c6f981eb92f3e7c66f21232faa2a3cac1a3aa1e5ee4cb00bee27a7bf
MD5 7f2c9ff18f3fadd24b2106fe97f2f430
SHA1 de034e79c18f301eec1f1f3764cb3d85dc2f3ddb
SHA512 b1572047626f6fbdb2cb71f13bc51bcae46b861a7c4d37bf95d457441f2adcc7c57f67247b435f0b4363634270b8a2ce44342be2d666ec123a352ba73c276eb8
TLSH
T1ACC08CB30020858E473459C5743D361DC0078C4C4CC0CCE8A7297109203CD6B440052C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 148B
SHA256 8acc132882cf81c469916007941670d3b28c32e4fcb6fb154728078e2eee73ed
MD5 ea8fc200ac60434f7996178f472be0f4
SHA1 43ddfa536e83dda0e0dc0d9ccedd5d99b3f52d9b
SHA512 f06d0059ad930cf1f41a2d1995496ec7cdcb5bddb4c764f95898d9045e6872cb5711fec30bf6be33b958be52ac068132291b94a35a30357332a393ba054e2e34
TLSH
T195C04CB34420858A5B3499D8752E7A6DD507954C4CC4CDE8A758415A1578D6B480156C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5bd02d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5bd02d.TMP
Size 157B
SHA256 e4137b96d80a0cc07922379f7f9c04ee97cbd305bce28cc2cdfc7927555e2915
MD5 fc7242b3362ef409535427e3bb48bd7e
SHA1 c838f21cd5f5df276c7aa6d87e515d7e19db019c
SHA512 a31ae21f959eea75aa722055557f037f55a5d2a6feef0e500155db3d34070faa3363f765a940bacd2cbd3b93597b857152c80b05fc6157571ba5e87913f6ce9b
TLSH
T172C08CF30A30864E0F20DCE4782E764DE1026C4EACC1C8F4C80AF05120B86928102A24
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 add89b2ad5c0801622b416b8b64a8e2cf20d999938799ec1e221819bba089a3b
MD5 cd8e079aa630b6c8270d2ea0b7de0e80
SHA1 7c84e792dbcab0368daa919e485160218ce815ce
SHA512 82706b91338f6dd57d8db2b34aa9dee591949aa847a1af9c0eb482240fa6de19a14ebeb07e949a51bce88c4abaed7835abb09ddbfe42b4aef7de18216fd4638d
SSDEEP 3072:ssHPaOmCbeEkIHRczW8iiIqep5IFySAgjVZ79HZVpRHG2JvqN:5PalCbe7IHRdXdIFySpjv95VpRHvK
TLSH
T1BCD312D2ED8B6D27E5DDC326B12123931D98C766C90DEBD028D436730BFBDA40389926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 a424390df66df82f93d4636c0c6a1b2165f500690d6d09f468135e52684baf4d
MD5 9956f8efaab3487b02bc4d92d0e5fb22
SHA1 229673e05815f03ddc53a06b58a49cbd2307e4f9
SHA512 1e4c2f420e8d7e5d60db7b3d4a788c99d226d9d8e884541b6cd552ee3b44d4685430a1d80f1bed9a897bfce4c096aa019d383a4d90bf100672e9ea9df69de20f
SSDEEP 3072:isHPaOmCbeEkIHRczW8iiIqep5IFySAgjVZ79HZVpRHG2JvqN:zPalCbe7IHRdXdIFySpjv95VpRHvK
TLSH
T14ED312F2AD8B2916E5DDC616712137931CD8C69BCE0DFBD42CD03A630BABD940389D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 b08672fef450e291b45864ae73b9928a59ee43fc910da5ca11966588bb26aa2b
MD5 b654f48f7c46e7eafae348bef6b52e7e
SHA1 256deeb7be079b4b4b3602611ebe361cea2cdf4d
SHA512 67c81c4fe876a3de556cfb74ef19994d1b1e902fb2f75b9fe27c43f90b003dc2d5dca35c294272a7e0de2b07a4be8adb247f797241288a6b4170616f295762bd
SSDEEP 3072:psHPaOmCbeEkIHRczW8iiIqep5IFySAgjVZ79HZVpRHG2JvqN:IPalCbe7IHRdXdIFySpjv95VpRHvK
TLSH
T154D312D2ED8B6927E5DDC326B12123931D98C766C909EBD028D436730BFBCA40389926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 65efb54e80354574ed771c55e21f6476bc7dd65bb2d8017386198e586c9a82ef
MD5 3cf7adcc83b5f4ae0f3f6d29ef2d1d1a
SHA1 dad5130e73719ce66acb5bfe203620044125720d
SHA512 0be768a32124711f1dba7f31cdbc4be2a6540beb36beaa67720498470f65739e1e8bc45f5e94abb75f1c47bb2bbf4222a73e3a5fd2c58951c54b06336f080f02
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5YlDgB60GyvnnX9lbKmb0v4a:xC0PtbKFKu00UUSb/iDUDEEECX9lbK7
TLSH
T18CA12C72A4698D735976D649F9622A03CF74E12BAD229F54D9CD0F0C10F70EC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5924_886900593\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download