2c50af4953cc33d3531b401e4c741bf8772dafbfdc67a36f2e69abdbd6d23f35

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
unins000.exe
Size 1.4MB
Sample260919-j3gdqsyscx
SHA256 2c50af4953cc33d3531b401e4c741bf8772dafbfdc67a36f2e69abdbd6d23f35
MD5 82c124955425da533efe53bc8c229d74
SHA1 b2ed55f840465c99af02b59b134ad0568145a38d
SHA512 a71a473a7dd461b3ab71808087268269df3a48ceecf2f20002d59e8a73607cb11558202bb9a3c75b3354b454b5e835ec6fe78e9ae83c66eb674d47d606293564
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKoexLxd:cIEJxCWluyZ8UbMlf
TLSH
T171654A12A2E24837E1733F359D2B82946D367D642E74988B3FB44E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3032	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134342791886342376"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{1B88A336-D771-4CFC-A949-4610180A25E3}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe
Token: SeShutdownPrivilege	880	chrome.exe
Token: SeCreatePagefilePrivilege	880	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe
880	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3732	880	chrome.exe	105
PID 880 wrote to memory of 3032	880	chrome.exe	106
PID 880 wrote to memory of 3340	880	chrome.exe	107
PID 880 wrote to memory of 3340	880	chrome.exe	107
PID 880 wrote to memory of 5064	880	chrome.exe	109
PID 880 wrote to memory of 5064	880	chrome.exe	109
PID 880 wrote to memory of 1740	880	chrome.exe	110
PID 880 wrote to memory of 3920	880	chrome.exe	111
PID 880 wrote to memory of 1740	880	chrome.exe	110
PID 880 wrote to memory of 3920	880	chrome.exe	111
PID 880 wrote to memory of 452	880	chrome.exe	112
PID 880 wrote to memory of 452	880	chrome.exe	112
PID 880 wrote to memory of 4684	880	chrome.exe	113
PID 880 wrote to memory of 4684	880	chrome.exe	113
PID 880 wrote to memory of 1796	880	chrome.exe	114
PID 880 wrote to memory of 1796	880	chrome.exe	114
PID 880 wrote to memory of 1812	880	chrome.exe	116
PID 880 wrote to memory of 2936	880	chrome.exe	120
PID 880 wrote to memory of 2936	880	chrome.exe	120
PID 880 wrote to memory of 4840	880	chrome.exe	121
PID 880 wrote to memory of 4840	880	chrome.exe	121
PID 880 wrote to memory of 3816	880	chrome.exe	124
PID 880 wrote to memory of 3816	880	chrome.exe	124
PID 880 wrote to memory of 5080	880	chrome.exe	125
PID 880 wrote to memory of 5080	880	chrome.exe	125
PID 880 wrote to memory of 1364	880	chrome.exe	126
PID 880 wrote to memory of 1364	880	chrome.exe	126
PID 880 wrote to memory of 2768	880	chrome.exe	127
PID 880 wrote to memory of 2768	880	chrome.exe	127
PID 880 wrote to memory of 1672	880	chrome.exe	128
PID 880 wrote to memory of 1672	880	chrome.exe	128
PID 880 wrote to memory of 5372	880	chrome.exe	129
PID 880 wrote to memory of 5380	880	chrome.exe	130
PID 880 wrote to memory of 5388	880	chrome.exe	131
PID 880 wrote to memory of 5564	880	chrome.exe	132
PID 880 wrote to memory of 5564	880	chrome.exe	132
PID 880 wrote to memory of 5808	880	chrome.exe	133
PID 880 wrote to memory of 5808	880	chrome.exe	133
PID 880 wrote to memory of 1892	880	chrome.exe	134
PID 880 wrote to memory of 1892	880	chrome.exe	134
PID 880 wrote to memory of 5992	880	chrome.exe	135

C:\Users\Admin\AppData\Local\Temp\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\unins000.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff952aac728,0x7ff952aac734,0x7ff952aac740
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,4978444644967029754,11227439971313380042,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,11084323441467624246,3727235167074844465,262144 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,9836004600806433080,6374414725453192093,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,13612192503134702237,17914924614695014713,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,8575315708173927733,14310978964936890160,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,13396947982100832942,13532986043696504200,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,5732804468725396356,8831345791628957470,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,14144064743610510145,13807543497099727653,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,8572944639767329144,18348338668610015186,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5728,i,8266839362028745021,14315309454705439215,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3436,i,8736572992418703077,9470438217672576145,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,10323137060815171065,13390799429216332983,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,8990579479647815598,16004229115816010420,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,12168708397642094900,11686011821611740945,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5916,i,16967975189587075968,18304190053357210763,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5824,i,6523872480666696916,8182891668768482890,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,17981129045491915387,4758065032689742493,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3412,i,56633382387046692,16347481427286175765,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,16914257158694160647,8239220091513148837,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3944,i,16497579654993359161,13281218819618817369,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3308,i,16777945691386704151,6708286062561233649,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4736,i,1359680156273995533,13660819441619382883,2097152 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6620,i,11384771928605403184,14321971931137856724,524288 --field-trial-handle=2016,i,10239960690069885005,10271863601467471353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 14d9366ce435ed71e5995e3ff5dc10f47b8f21afc2977470e795066362cc211e
MD5 9336e0c6a2051163da07293861c77fec
SHA1 cd982359fb1eb0e79fffef64ba5254c4e7f80ca6
SHA512 6e698811472b4181a85f9be5193b26e46050720932febd8cb8ec8c5c0171f5cdec0b445dfec30d2b44dbec50e32cd61f8cecff093a0e8faffaa4a441e9a22ce7
TLSH
T1EDF078A9D832EC3B08FD0B1C60654B46F75013673B82584B3B3D830D4FB427B418686C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 14d0ef41008c5022410ad0a91f104e39839d22bd9c735a999e052b8ede50c099
MD5 fe512d717ee6a8f672e1aff4be0e3c4c
SHA1 9e31f9f4daa4417302d52f252d2379b5d0fcfb1b
SHA512 303a0ec994e848924c90b34f54018ece17a9421fd1b95c486c28defcbcfcd3e4bce5bd86890a087fae1395ff91e212769ebdb93f20ca1242157094d34d584020
TLSH
T1E141CD25D271A9D2CFCD3A7045938B701EFB713D8B071ADFA20F281966952F682DC887
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 49KB
SHA256 aea7baf3c55309adcc1fc3529543dadb8d8268cbe82b341952ee45565e4d283f
MD5 160808ae7e09aad2caf49088b7e06130
SHA1 8bec2c9a55d802142f634e84dde31a621e91b4c5
SHA512 16f26ca37f4fce5b976adff5e3d7643de93fc50d2f1b0039cfc2a06497e2cec0f2a3c5e3924cba4dc6d3a70ead002f74ca61e1335d8087a1d63ff28de7aed17c
SSDEEP 768:7j5FZOTZPRTJnMy7vCZale6I+9zgTOstyifQTmKAwwR0pY9KulSGWfMKWpYNl7Zo:7j53RyTeiUT4iqWmNl7Zo
TLSH
T1E333C55F5BE4ADEBD64A81B248120FE5677B2E087C88A0CFE0D1776DD972E805634B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 32f9ff430d26fe41e8c5db8ec181afaa9d904770318ca03ccde0b83d21fb5648
MD5 e44214b41979ab673f60851c027014fc
SHA1 0deb63449dbeff165e02055fb5f77ce45709ee35
SHA512 21fdfb3fc0e182146acb8a1a2ff4562472ad64e1aff752d38a964187849622781b70ddf26514a13c1efe693ea338389e8c16ff2e1ac20c19cafe6d77799bbb44
TLSH
T1ADE0D82D95C9D55F1194C0A665747B0FD9D6650D96CDED550F86E41870C944850A8250
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 0863f31a99ffd90b94c11f64767ae53a4d1ea7af087e001c868e2f54a920eca9
MD5 b8cc89ae8b7dcd39e0a61ab1a98296ea
SHA1 2aefb5023459d378ec0d03f9a788c5b692d30738
SHA512 716a67cdb88206351162933ace2164a32413f0d8663c1233b1d3952ba166f7679c92e09fd6b9b4a94a26e85f58b99467f252726ec43f6ec8bb68d3709cc1231d
SSDEEP 384:DM8dAd5cDLJkJulMKkNlHKIV04XPUGDsbMIWUI3aXaTqJsf3bNyN+JgoFPKfnE+H:fe4QnPpo
TLSH
T10A42ABF3C3E8C72DD85156F5AB297E1ECE2D0E6843283C26C8D9AE4B93E1471D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d76ec610d33d996cf978264efddc63095e0dbd891635007fd80a2e2d140410a2
MD5 fddd338bbb43ac76aff572a8aacaf4f3
SHA1 a1944af37023fbbd5c855c8baa0280e35665d9f6
SHA512 a5c0e60088307136289d09711fb466e7f91951e80252f047605767c8990bec8afe1fa8844ea0d2fba1d5a47062f3299185cddec7ac3e20ee44c5d07a61cbc400
SSDEEP 192:6RfEzynzjOvv7VNDhAPRp289QHsb+WNneN0aFEkwA7b+VyIsnAUgtaJ:6RfCZnZx8XDWw401gn28
TLSH
T1D742A52DAD54B57F9CC7C22AF916BB43D3F5102160942E84EAFC8A3C15EB9CC2217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 00764f2fda5849f84a82363ef9df5ef3a8977c30654773f4fd4d526ef5776dc2
MD5 de57f9a014e0c2f4100ad58fc4f14a58
SHA1 c3176b238d4c24f2eccca8e542d95e250f00a873
SHA512 07805ac37b786a0f7c08585fd7caa8762b07b8659614789f25e4fc3b7fac064ad94c008ecb9c8e96432e557ff9c7e4a3b1c431e995dbbc2057377bf977f156a8
SSDEEP 192:6RCcBhEzynzjnvv7w8NDh5PRpduMHXFg19QHsb+WN/NOeN4qhs7R8QFEkwA70+VK:6RCmhCmnc8xHXMWw3Pm8bgQ2e
TLSH
T18262B52EAD50767F9CD7D22AF912BB16D3F11025A4942DC4E6FC8A3D11EBACC6217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ddb9b9c01c785e5729a31acc005c434565ce17dc3d5d842140d0c6d3869cf6d6
MD5 96bc86cab92c5af5a58e910b384330af
SHA1 7c1c80afcb37837b2b3810a58502929b1da42447
SHA512 aa5394646f6bcf00a216da0518b2fa971c14dd990bd338962da7d3e64e2a62a8629f47d560f3c60e85e55d7a1652e6c3436a4663e8d38254c0a3184f536a96ef
SSDEEP 192:6RjcBhEzynzjnvv7VNDhAPRp2hW19QHsb+WNneN4qhe/FEkwA76+VyIsnAUgraJ:6RjmhCmnZx8XJWw4Pe6gm2e
TLSH
T18852B42DAD50757F5CDBD22AF916BB13D3F11021A5942E84EAFC8A3C11EB9CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3b49ee5b04b9c9c46ffdcd15e5e4085fc3b49e2fa38adaefaec2f9d066ac273a
MD5 085f2497c62265877f25fc0e8a64fdfb
SHA1 6d60fa5652f62bd1a7aa3eee2cf33ce17a66e30e
SHA512 78962eb3b7c6f5ae046443afbea347452308aebefb08ce7255ee8b8262a36d82faf2f4785d998010450841130cb2397ae8003b12acca3ba88a090766f5d8268f
SSDEEP 192:6RjcBhEzynzjnvv7w8NDhAPRp2uMHXFg19QHsb+WN/NOeN4qhe/FEkwA76+VyIsB:6RjmhCmnc8x8XdWw3Pe6gm2e
TLSH
T1EE52942EAD50767F9CD6D22AF912BB17D3F11025A4942DC4E6FC8A3D11EBACC6217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 325dc332da99024963dfbd9936e86c5e5dcd702d804e6fbcb8dd63c3509ec218
MD5 edeb4b184a6d30631250c6cbd022e82c
SHA1 50f5b2603df09b1f3593c4d43d42d5f7a631b2f5
SHA512 583bffb04a754303db41c6238f5c3c15d2c242b8b470a97e6836be18c3f29b59ecf9c6ffeeccf6505981c3eb83476b494c854c1f50aa946cc5fdca1a77b54783
SSDEEP 192:6RjcBzEzynzjnvv7VNDhAPRp2hn89QHsb+WNneN4fH82JFEkwA7b+VyIsnAUgtaJ:6RjmzCmnZx8X7Ww4r2kgn28
TLSH
T1AD42A32DAD50B57F5CDBD22AF966BB13D3F11021A4942E84EAFC8A3C15EB9CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 b494e61f07372ec9c7e51cecb31e35f7b1764c9454464712d269b67764c84218
MD5 779b83eba2269d00b677242dea1e1e0d
SHA1 4c0eeebf4312622db708a61e247a5a2a742d6b5e
SHA512 a0dafae9dea8b578fc1e281968512282b6ec5965118828fb163155216d9e94f3cdfc5a61b7a4f5636d6bb5bcc89c2c71d8f6810856f0ed434ef44469c50837c0
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3Htb5w9:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pY
TLSH
T1E562F867AC4C9E3B0FD4D649CC177A4FEDB4025621AE886482FB982503E4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5dc7f50f-017b-4236-a97a-ba80ac09fcaa\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6e9743dc-b763-4e3e-926d-6fe3f8a518ac\index-dir\the-real-index
Size 2KB
SHA256 553337580fbc27953188246e765d3af7410f58bbe2418e8d1df18be8b258e2a4
MD5 548f9acb7d33962e97f23b63fbf96e18
SHA1 760727fd9fa40cd44692029c558b2b4ad9c95bef
SHA512 2f871f4ca24b997b8acea2221f67be5b89b242bda0e8744255811ca59f28be3dcb77e60217bd9e9b39503371105b362557219abb8c7b2085dc1723564c79d359
TLSH
T1A541744CCD9067EEECB5517A2C9419F257B22C38FC69C39281A8B1B034432B41B479FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7abf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6e9743dc-b763-4e3e-926d-6fe3f8a518ac\index-dir\the-real-index~RFe5a7abf.TMP
Size 48B
SHA256 58f7a0551635ce4202dacedd3ba4d6e4365b1115767f68cbdc17a1cf127fd593
MD5 a00111c0b9ac477e1c823b210cd0ce8d
SHA1 5e0b90618657a9858ede52996bb40221707241b7
SHA512 b4b0792665f95863c6d994a1f11c524ac66f91caaedb0edc399d8b8a9123d52d1f0868acdc184f45a9e2ecc7296f5179de139e4a5b2efff8429877860a47aa5c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 7e14e001a91156fc118e330bc871ee8f04c6ee83e31c04c595bf17ffcc7b5ea9
MD5 f73db183cadc86e99b0cddc479d3217d
SHA1 a105b58184e8414fc03a2e13e7c470f5bb7ce63b
SHA512 76f47c333eca9bcc99c240014a964e7f79b8440daa5aefa524db30d76de5a33434a069c0369db4fad1c3e50c1f66131101eabd09548bd3ad2b4cbf501a345c63
TLSH
T1CAD023D55830C4C51B74EEC51434338C511ACD16C8C6CC948D40701B317A103C401575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 5ec7c38053eca4b991ebfac533b134ba8b60db262f0a8a5cb049d6dfa8096e1c
MD5 9bfba049e8baec147464b04c09932b28
SHA1 ebe63f3dabcf0a545868a437f2edbaf3fc0af8c4
SHA512 958c298e993670825fc53905f115c62f45805989cf83d5686beebfaf33da3899e1aa84874e68a49b65a0735937173dc563181d931c24c74643ae8c9bf25190ae
TLSH
T112C09BD7143085D617B4FBC52538775DA25FC64CC4D5CCE8D504600A71395134C42975
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 bed2dc7a474ac7ff3ab558fc41dad86134635555a0ee3d02571b6c8b50d35ca8
MD5 5781160a4e9dcfbd13f0ac2421b84b9c
SHA1 5f909cab854e527eaa1a15d40d5dbd54ca56585e
SHA512 1b929e5e02edee89fb1b257cff26a0e9c693c17ca3cf2e2e29c1dca3f376b201ad14ea86d918a0d8ecb4ec34e377592c642088d4b17d080ada5bf75712985770
TLSH
T10EC09BDB183045D617B0F6C53538775DA15FC55CC4D5DCE49D046007737E5574841975
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2491.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a2491.TMP
Size 137B
SHA256 81703b7bc79c0be0d927ae27c89c2996702ec552fb49f5aa00e0106106eb124f
MD5 e1a9a2f8febd8a656a309a706467122e
SHA1 6327d63680bb820b2cbd18f8e82406ddcb1f16cc
SHA512 d0cbe2c96afa4eeacce8934fc1b29a86ff3124c9aaa27f39d57d64de444bb2d978552801467b1239944f764e9c7e26474da9510d2fa1b68ff2e903fe87d4e2f1
TLSH
T1E1C09BD7143045D657B1B5C66538774DA16FCD5DC8C5CCE49505700671395138845965
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 70b95c19b7f03749571a4241cbf756be515fd501c5649c2f9a95fef899b6a9b6
MD5 0a1c9182d4f5271783b65c7e42b744d8
SHA1 6b97eff4f12fd1f6a24e80d5d4c1cb9e41e0af87
SHA512 5649a356fe4ac6a2b8e62e2ca25a9a3720d7a012badc9c68fd0fefe8315300f8bdd1cb64504154fa7ec2a6ef0b27cfa5a29a8aed6f37ac0012cad836ab8b265c
TLSH
T162C01289C4076203C89703F51C91859C7594DF75F605238885E42D92FD351F0C51F26E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6fa4bb1dc930383e8019b80292cc3056b9820c1ca065f83142fa7faaa561432f
MD5 03f2e6b567c53ec3254eb90ba47682d6
SHA1 91053b3fa12589a4ab8caacd714b903cb0de5445
SHA512 e753c0568c73cc0ada479a566264a864b6ac6ad7146489a914d6aeff12be9b5a32c38387250340d3d68396d3149c32f8d3e51379ff593219036c2a78ef5b0407
TLSH
T1C1B0125480415303C00202F41594188CB594DF34AA05134541F10D01A83D150805B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c431.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c431.TMP
Size 96B
SHA256 0850e3d7d4be0c6cc2dffdd3189c178bb98dbeef04c915ad2a4d6267dfa4ee28
MD5 82d686d448d5b8aebdc0f7bc6237c430
SHA1 d4e617c4e8e802b44702b183b1bdbbac3538a64e
SHA512 e5d1496790a7bae9094a0af59a6459f7926ade4d719f36ad658dbb5e2b34060564c4679b9778a0726f691411f44904a86a4291376bf0ae424eefdda4cbc751d3
TLSH
T128B00255C50373A6C04213F1A9959AEC76A0DF2DCA43122E92E15A66DC256604525D60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2378b591a1bfdf11114e925e3500b397e8093df3ce4a231de2d23328be33b684
MD5 0ccc9d6988a0379ef8c51388bc62515a
SHA1 01224d50dc606297642d50830e122e117caf30a2
SHA512 2017ec09e6d74c86d9669657e01f2f073143cb3c4c69962b0f6f7af4f4a6dd9230dbe21cb169b5c45e8e00d0d8ef870bf90661b1ade0e839f18add2ba16deecf
TLSH
T123B022CC2382AC03CF0303F08AC0C8E3F3322C802303820282E00008A8822828300200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a82a94562c272684265ad875f46b427a8d32cbe02f64bad44e9d2fd6c8ebb0a9
MD5 d90f9b191f471a228dddd752d465033f
SHA1 5c02e42b91d4604a316728b90290eec0b37c0b7e
SHA512 66ef6bf38e25393b03a8aab59c92192004890adcc842582e3300eefa4399c42270a5a9b0ef3c7b24133bede8121a7c1adaf739cd5929b08ce5ff282eef72e628
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b7d50a2a56db4117f95fed2e85df28184787e653c8632b6df269f19ae899c4e0
MD5 c71975ce5f1c6e953da5e73a0bd8977d
SHA1 b0b17a21941d6f4ff05130c7da17edd40822c3bf
SHA512 1530fafa483df6c5d49cd344417ed02cb847b280f5a3497d19d2ab824fa316e93178b4b62811872a78920d28096bb331a0377c2a3e3c13fcbe5ade94fb8b3a55
TLSH
T1E8A0026042C4049ACF40A3F060A1058372F1681D956687037597494CFDBB7C591C9E43
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir880_1053006027\Shortcuts Menu Icons\Monochrome\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir880_1053006027\Shortcuts Menu Icons\Monochrome\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir880_1053006027\Shortcuts Menu Icons\Monochrome\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 b00dc8f8f9139c447462b93a80280a747950e6afc0efabba7faacf11b99bff39
MD5 ca0e2188b9a149cc15cdd99347b9462a
SHA1 62595bf19a9c9aa1928e33cc01ea95cc84a46d73
SHA512 c0f299828c3a716603b7bf6977e96335ebe48d8a9d2ec9de3561575ae3696aed6ec135bc30dc16eabd7b02f20a8e7a59aa14046c2db834d601429c1d6167969a
SSDEEP 6144:V3DEsJTxm6IihibBSuqJwLV8+hFD+7t56OD9ZfSAppre:VooTyi0IuqJwLmyFSXD9ZfS4E
TLSH
T1D7441233A6E1DE6FCAFA6460B05FA1158EB57DED21C75C9848821BC794CD84D03B2B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ed0992e6098d54bc0710b67dcee20ddfcef3c5cde05ddef42c1b423659d3e8f8
MD5 b9535e3a458e65ec0a7f5ad016db131b
SHA1 9bb9d9a8945350e40bc647bc0f506b0e003f2d2f
SHA512 161c3f3b3caa84f1014d923d13df64597bc874e555102f6d02c06463324be1be8a08d57035aab30c2892cf28d2ca5880876d4dede96574ad5f9fdd8d432abe08
SSDEEP 3072:I+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:I+hFD+7t56OD9ZfSApprr
TLSH
T145D31232AA95D9BBC9BC6541B157A300DD76ACED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 e7620c53430f0dd8730ad9791c62522d3253fc455bf31b92e222b05455fd0f4c
MD5 2d0fff57b8d8a4dab4ba9468b732b4b8
SHA1 c4c8034a329dc45ffc5372542b2046cccddb03ed
SHA512 750450aa765991f561b7dd14cc68471a07e531dd48a80cea9977f5bb9fe39ae58f2118936e2e2b97c00bf18c03d259484679fc152beee094ecfe4ab20541d163
SSDEEP 6144:s3DEsJTxm6IihibBSuqJwLV8+hFD+7t56OD9ZfSAppre:sooTyi0IuqJwLmyFSXD9ZfS4E
TLSH
T1F7441233A6E1DE6FCAF96460B05FA1159EB579ED21C75C9848821BC794CD84D02B2B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 af9117501757874ae493f755c3ddf8de6f4e1d0d6faa9a38109b6d953f025ad1
MD5 032f30c6b50b217afe582cae6dae1a61
SHA1 faec81b98eba79fa192973723b7a794bddfa82ad
SHA512 d80c13769a3500dc621afbf8ff951b86f44175b5ef9f920025e111d9a78815bd4d4d0002c1b7b501b1ea3f978bc048cce1f9546c7b064ba38a98523ee2ce6870
SSDEEP 6144:k33DEsJTxm6IihibBSuqJwLV8+hFD+7t56OD9ZfSAppre:YooTyi0IuqJwLmyFSXD9ZfS4E
TLSH
T18F4423339AE1DEAFCAF96490A05FA2058EF5B9DE52C65C5C48411B8794CD84D03B2F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e8d6c1a-240c-4ddd-a064-5f530b6b425e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir880_1297140901\7e8d6c1a-240c-4ddd-a064-5f530b6b425e.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir880_1297140901\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2840-0-0x0000000000558000-0x000000000055A000-memory.dmp

Download

memory/2840-2-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/2840-1-0x0000000000400000-0x0000000000578000-memory.dmp

Download