899a23e18a1c4e527f63b62dbea9db4a5d1454b720af49ce8c50e6c80a9ca139

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swing-speed-1.0.0.jar
Size 130KB
Sample260924-2vxpvstfpe
SHA256 899a23e18a1c4e527f63b62dbea9db4a5d1454b720af49ce8c50e6c80a9ca139
MD5 885fedf1c1bcce751dc4156c8ff9ca62
SHA1 a01e1d950167389f3fbbca920b9f8928ba07a7f8
SHA512 fa022cc6b6c007b5bca3bce4be81afe25cc86fcce0ddd67bc480c28138a15729de46f50784efa62cd8b37bd03ddb7540f8e0c9c9d40716a62091fc98c9302281
SSDEEP 3072:j+c1cTkfwFm6bHOIt5QslU6YJyh7WvfXDPGQwYzhZZB:KtTsw06LnlU64WgCF0hZZB
TLSH
T117D3126F3E91C315C94F1D700087FD589C308798291AB2BB8A766F8E2AE51171F177AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	mediafire.com
32	mediafire.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5072	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347641077442620"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{DF94368E-1B7D-4455-B8B7-DB975C811954}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5716	chrome.exe
5716	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe
Token: SeShutdownPrivilege	5564	chrome.exe
Token: SeCreatePagefilePrivilege	5564	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe
5564	chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 1140	5564	chrome.exe	90
PID 5564 wrote to memory of 5072	5564	chrome.exe	91
PID 5564 wrote to memory of 1188	5564	chrome.exe	92
PID 5564 wrote to memory of 1188	5564	chrome.exe	92
PID 5564 wrote to memory of 3892	5564	chrome.exe	94
PID 5564 wrote to memory of 3892	5564	chrome.exe	94
PID 5564 wrote to memory of 2820	5564	chrome.exe	95
PID 5564 wrote to memory of 2820	5564	chrome.exe	95
PID 5564 wrote to memory of 5160	5564	chrome.exe	96
PID 5564 wrote to memory of 5160	5564	chrome.exe	96
PID 5564 wrote to memory of 3308	5564	chrome.exe	97
PID 5564 wrote to memory of 3308	5564	chrome.exe	97
PID 5564 wrote to memory of 2840	5564	chrome.exe	98
PID 5564 wrote to memory of 2840	5564	chrome.exe	98
PID 5564 wrote to memory of 5952	5564	chrome.exe	99
PID 5564 wrote to memory of 5456	5564	chrome.exe	100
PID 5564 wrote to memory of 5456	5564	chrome.exe	100
PID 5564 wrote to memory of 4960	5564	chrome.exe	101
PID 5564 wrote to memory of 4960	5564	chrome.exe	101
PID 5564 wrote to memory of 1228	5564	chrome.exe	105
PID 5564 wrote to memory of 2028	5564	chrome.exe	106
PID 5564 wrote to memory of 1228	5564	chrome.exe	105
PID 5564 wrote to memory of 5608	5564	chrome.exe	107
PID 5564 wrote to memory of 2028	5564	chrome.exe	106
PID 5564 wrote to memory of 5608	5564	chrome.exe	107
PID 5564 wrote to memory of 4712	5564	chrome.exe	110
PID 5564 wrote to memory of 1864	5564	chrome.exe	109
PID 5564 wrote to memory of 4712	5564	chrome.exe	110
PID 5564 wrote to memory of 5908	5564	chrome.exe	108
PID 5564 wrote to memory of 1864	5564	chrome.exe	109
PID 5564 wrote to memory of 5908	5564	chrome.exe	108
PID 5564 wrote to memory of 5872	5564	chrome.exe	111
PID 5564 wrote to memory of 5872	5564	chrome.exe	111
PID 5564 wrote to memory of 2896	5564	chrome.exe	112
PID 5564 wrote to memory of 2896	5564	chrome.exe	112
PID 5564 wrote to memory of 4776	5564	chrome.exe	113
PID 5564 wrote to memory of 4776	5564	chrome.exe	113
PID 5564 wrote to memory of 4832	5564	chrome.exe	114
PID 5564 wrote to memory of 4832	5564	chrome.exe	114
PID 5564 wrote to memory of 6016	5564	chrome.exe	115
PID 5564 wrote to memory of 6016	5564	chrome.exe	115
PID 5564 wrote to memory of 3672	5564	chrome.exe	116
PID 5564 wrote to memory of 3672	5564	chrome.exe	116
PID 5564 wrote to memory of 5968	5564	chrome.exe	117
PID 5564 wrote to memory of 5968	5564	chrome.exe	117
PID 5564 wrote to memory of 3900	5564	chrome.exe	119
PID 5564 wrote to memory of 5500	5564	chrome.exe	120
PID 5564 wrote to memory of 5500	5564	chrome.exe	120
PID 5564 wrote to memory of 3196	5564	chrome.exe	121
PID 5564 wrote to memory of 5328	5564	chrome.exe	122
PID 5564 wrote to memory of 900	5564	chrome.exe	123
PID 5564 wrote to memory of 5728	5564	chrome.exe	124
PID 5564 wrote to memory of 5728	5564	chrome.exe	124
PID 5564 wrote to memory of 5716	5564	chrome.exe	125
PID 5564 wrote to memory of 4604	5564	chrome.exe	126
PID 5564 wrote to memory of 4604	5564	chrome.exe	126

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\swing-speed-1.0.0.jar
1⤵
PID:5460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdd246c728,0x7ffdd246c734,0x7ffdd246c740
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1404,i,17992221712367794420,3643701775005974321,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,17329612156672808329,9483249143663427178,262144 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,1073561187165055034,832176521538938928,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,11712557540273585010,2702514267875166040,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,12342853911762832166,15012786116246417590,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,5590122824233082950,7368198013843825081,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,1695528775230192675,8990407874018801835,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,13738197207801469007,13287865504671896481,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,4291921825856623570,13453459749283758518,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,5559766928936868318,3037616983624969052,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5876,i,18040807018254169976,5477354006501076745,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,15896077447840001134,9270038308170200029,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5984,i,13976546026776022208,11738409349284754952,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6112,i,12846085318128442093,15891256653774626760,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,316868313998620602,5363494471438557690,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6140,i,142772531913953106,17228184222840047389,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5520,i,1468263289436143320,5180027237843358235,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6528,i,2984469365104849625,6765864457172834315,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,1259919525088281204,8851760021416260379,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5744,i,8622141285745551072,4925209880689271882,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:9
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5656,i,4729503110010006896,6508980021861742146,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6520,i,11179716201667508879,3117244689806719742,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5804,i,13814045376774492587,11852997431388592456,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,9570834587387575269,766101009683847898,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,16997435980207533962,9077412847105249881,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:12
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4384,i,16364760981578660212,14579415925583449633,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4364,i,11526137784239407382,1290132425721467892,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4352,i,8239940043409433994,4536201947264620600,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=4368,i,18226476957196925672,5304256692478334753,2097152 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6468,i,9023260531359872514,8888825104749300178,262144 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,11602980789646900907,15676784278087047728,524288 --field-trial-handle=1976,i,18379594801001590299,2345296875152010848,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:4604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 f93db81bd26486fa422dc3958af963fe94920a4ed4caa8870bdacf14b0691a7c
MD5 ae60d41be9ab67831cc44e4889e9e00c
SHA1 90152fb83949884e61ec073f190533c0d042e3f2
SHA512 f28a790fd9306d257ddd18455e3519f04b61ddbdeaad4f6181bed1ac61b1112d906ec18fc125c5291678f3cf1b0566c3332cd321289f534a079b209655a0c974
TLSH
T19DE0DF42E4A5A381DF0AF83454E66C755434459F8801070EE58F943E43736E4C027C57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 9b3995644a352aeaa3a5e9f2536fba7b8fc6522ca3ef40edb58151ad755eec8f
MD5 5a86d92d92c3efda3c94d53be7e07497
SHA1 7e670db2b0c406667241aa129e444c90f8b54f85
SHA512 12ccd1d7f7b3177b36aedfed08114d2f8ccc0f43946844b0be3b09bdcf369b01e7d74872fa30dfec1ef7099fbd0dd33bb8a2ac06cbea173c32b073aa615232fd
TLSH
T19F01C245E7EB4302DB8AF43168EA5C316536844E99375B0BE18B04750B733E7E18B967
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 94bf09cf588c5aa750c9315c7421e6b7906264a89d1679d8076ffb29f90a79b4
MD5 a51767a55417ca5098736d4eff2d9da5
SHA1 18f424dbb45a4050d80228cb8cb553deaa34eb02
SHA512 f42ef245ec3cd81bc421abfde897b6fc35a95d57e9a69fcd91a95570266214384aa8a7e02e7e6904376979dbb5c0f17898cd3cd0f8fe47f58e006ac9f7374366
SSDEEP 192:DQCngTb+eM514KTfZFaKV49xOUL4VY2s4oYGb4VRae3t5sbtjhq:D5gTb+eM514KTfZFaKV49xOUL4VY2s4t
TLSH
T1F9029EF3C3D5C56E880156F897146E1BCE1D1A19532C3C16C8D5EE4BD3E2472E25AA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 1bea769a80d5f0c9f022f8834b33db386d2db97e136307bcad7e4a877b08ea4b
MD5 c49abf6d922334b87f3ae713fd817039
SHA1 e10b7b11b1964a91319bc9fe52a0736781b6d801
SHA512 212cb6a1a62a3eebeb92acdd28f601b2a8682eb95c1a61dfabb07b61562c063ce1ff90c033e7f84973cdfdc1304ee6773c2985bc8bfde542780760b04e93c8bd
SSDEEP 192:DQCngTb+eMa/x8y14KTfZFaKV49xnY2s4cG4VRGt5xtjhnmG86UVqA4rNdK:D5gTb+eMa/x8y14KTfZFaKV49xnY2s46
TLSH
T1B2229EF3C3D5D66E88015BF497146E1BCE1D1A29432C3C2688D5EE4BE3E2472E25A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c3d7ee24dd1fbd3d4ba9e63b8ba5e63bc396c0081c90c17480b5bb171de422d7
MD5 7ca917de8a4adeeef9366b91e197dc1e
SHA1 a334a797bfd862bc8ae6574f16c6455b7320922a
SHA512 d677219808677300557c7572bedb10f189fa0390e7fc492ed0f400e4e291f99f46f3ed48caab74d2921243a4fa50239bdef0cb1b44f40b8fa45ac2def0987912
SSDEEP 192:DRo3X+WeVvv7i1YPRpuem9OHsb+WNn5Gjsr2fZPea25XVyIsnAUgE:DRo3Xon24XSkwg82R2vE
TLSH
T19C42C72DAD24B93BACDBD219F965BB57E7F5102620C41E80EAFC8A3D15E75CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 67c683315de3f6e00b4ad5e6ead023dc7d9335f8b65dcd65c418ed2a781a666c
MD5 e383a8456cb61882f32e3a1ce977caa5
SHA1 6af0c1854ca67484b40e1cfd48af3e5210e947b1
SHA512 254640a927a7124359ff439a5bbf5ed4df5f83a033c65b6e94866948692e4d28fb194646eed82c9c47d366dde67263250749e3ac986ce31181d15c9f7ab4e239
SSDEEP 192:DRo3XcWI9v7H1APRp2b9OHsb+WNn5G0kPea25lVyIsnAUge:DRo3X69bAXokwg0W21e
TLSH
T1C432A52DAE24B93BACDAC319FA65BB57D6F5102530C42E80EAFC897D15E75CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a4467a7c3f1f39d4ef9824872e666d2dcc2b28e163179a307560dd6958a15c44
MD5 29ad3b2d616b618355cf86aee1077065
SHA1 f57a3eadb641441b255c8557bc6cfc82f1646d00
SHA512 2cdf438d487ec8ef409fc730b9cd05b0f6b2181b6670532ac94840d3f7eda2a4fa30f835ee8fa3ab969f4df94677c01dd98547b42d1b0a9274be5755c66ad4d4
SSDEEP 192:DRo3X+WFvv7i1YPRpuem9OHsb+WNn5Gjsr2fZPea25XVyIsnAUgE:DRo3XJn24XSkwg82R2vE
TLSH
T11A42C62DAD24B93BACDBD219F965BB57E7F5102620C41E80EAFC8A3D15E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6d035468bc367df2881473ce0a92903f98398d36c9788fc0d08a66f6ef24e5df
MD5 90303917bd85b58b359643cfcbcf7489
SHA1 b357a33ef8db36113be507d0248277cc7e124cfe
SHA512 2ec0c6482c2e05cdadc7319b41bcc15d40edf6d76a25cce2a2c7d9dc2e6196c6ffacf48c9f2bf4c8789d0b03f4fca0e0e01429f1ee13b4d8c913a95e02687d05
SSDEEP 192:DRo3XcW7rv7i1APRp2em9OHsb+WNn5Gjsr2/Pea25lVyIsnAUge:DRo3XtT2AX6kwg82L21e
TLSH
T19542B52DAE24B93BACDBD219FA25B757D6F5102630C42E80EAFC897D15E75CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f7ad8fa5e5d9edcb43ad841c847b5dc58ce5dc9a8e0c7afc1e3271eb0030f7f0
MD5 c13fcb55e819348a75523c1647d23ff9
SHA1 83d1cdcc6e78136003e6350dfd828290539234a1
SHA512 8ce3ab969a07e4de56c5179975e72539bab665d1f8bdf44b99cc6bf0141e905954aba4daf3a699cee162b2bc1ee32b1acc875e25b6244e1aa582df2c559fac4f
SSDEEP 192:DRo3X+WFmMv7i1YPRpuep9OHsb+WNn5GjWQWtZPea25XVyIsnAUgE:DRo3XJD24X1kwgfWT2vE
TLSH
T10242C62DAD24B93BACDBD219F965BB57E6F5102630C42E80EAFC893D15E75CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c75df55c8bdedc86f78cefd58c16cd68b8829da397df2841837a8f2b3a24700a
MD5 ea0d14501ac97ea21e3e5efd74356066
SHA1 e633219dfcba01199b3aa2c4827bb636d37e2220
SHA512 543e0fd84b4d1935568c168d8173513abd3965b43356298e50e4e1fa1bb2914c9c1a146176a852429db949380488da28fcc163242ce9cc05f2ba26f5949343aa
SSDEEP 192:DRo3X+Wz+v7i1APRp2em9OHsb+WNn5Gjsr2NPea25NVyIsnAUgE:DRo3Xn62AX6kwg82V2JE
TLSH
T1A842A52DAD24B93BACDBD219FA25BB57E7F5102620C41E80EAFC893D15E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 b54bf0c3348f70acca76ac998a16e42b1d8c70140d0ae56ad1159725dbfaa6da
MD5 43698373d80b59c2ea30f6eb98517edd
SHA1 f8e6121a912075eb42f1394c8abf215259089a1f
SHA512 aba6760688d3c1a13e41e64f9fa3c369d9f6dedc87481d1f47aec455ede9464db013708641438a8e44ebf598f55e75b29f5e67e0213bc6fe726b0141093ad905
SSDEEP 384:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLXODgj+ErU3WaHGQY23VGji:QmDC7KxkXqKf/pUZNCgVLH2Hfgs1TOEW
TLSH
T1C052E827A48D963F0FD4D69CCC17AF8FBCB501566678092457FA9C0903A9BCB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a6897952f999c473ccfcc526d7be301bd6edfd9d3f8e86dc85eecee9c7e25aea
MD5 fed15c11f9cea527b0b966a7f08bd156
SHA1 bc662b7717e5bc5f074086f36d943344664ff27b
SHA512 4f717073f13c8d195efc53bb6c8cfd36a07dfc59145ecbb1861509387d20a155a6828b62ac38839bf0ee5315637d21a721764c55f547ac0ef882e0fcdab7d435
TLSH
T163A002B457C7555DED105270F1A105412655982C5D624703E9D30699DC7B2C0A245713
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4354.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a4354.TMP
Size 48B
SHA256 0617354838eb4153322e77e1ed96873f28a9bff5d9e39a60bf54660477ffcca9
MD5 efed61f901d2aad70df875d939b608ee
SHA1 fec37bb85b65804592d838c660134995728d3004
SHA512 3f565c9c61f49ee1c48f607d21c0e0ab80f2e19c36b522ae636b4a43684ef24389cccae793411e986e64b4e43439a743e316f009484b6cc14165486d0d20264a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 7a17136d248ef2a84c6ccb82a5f811927a0d8d15dec731ad0ac82c6ca2ed0853
MD5 22af5d2d666751223fe6946b90e3af61
SHA1 119fdc81ce7293ea5fe6c528f37e22b490994c9a
SHA512 f7303e4e05520163ab1ee16ff0426b4041fe168afc2ba8330cb8d57cd09c2bbb0aaacf8c54afc89e0f32967ba8712d5cf6690209d85ff7dc051f34535d4c2cf6
SSDEEP 3072:TAM9JYonWG5+ifFgOTyH4FC6sahipMRq1kJlwgX5bf7L2:Tn9CSWohF/WH4FJVI8tlwgXJDL2
TLSH
T102D3123322466C73EBAB86B5875F0C30487068D6D699B6244AFA6F49C6CF6D60713B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 2e669f77df15bcc6b8a07ee4dea12e2cd807318698c5229d404a3401c4bb6f7c
MD5 2b96e45655abf58d4e4ca898890dd407
SHA1 8031478dd9094354515dec578cb43d45a95efdff
SHA512 2344956d08da5684510ace64ed6e2233bc809b6b9a4bbe1c1a78fa0e740f35490860fef3d4e1aa05593aeec464a9a332d893a9c98c42ebc326577e18135003cc
SSDEEP 3072:L2AM9JYonWG5+ifFgOTyH4FC6sahipMRq1kJlwgX5bf7L2:L2n9CSWohF/WH4FJVI8tlwgXJDL2
TLSH
T13ED3123326465C67EFBB8578470B2C304CB0699BDA49BA189AF97E48C18F5E54B13B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c992c3e8ec66ab2112233d09d1b21e599c92258c4d74fc3cedd76f7fca36268c
MD5 908807b82f34b1339b650caac2f855ce
SHA1 6f862662e89e4060a7223adb4fc191ddaafee0c5
SHA512 6d69afcb5c1a078ec71984a2e4b77e5294e87d547a8b69b7d5b5cde17c55a6fe638fa7ed8a95c82bcbd86f83d302ee24b74a93b8bbee702f274ccf4059b8596e
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5siDnB6m8dGyvELkzAkrbuj1v4a:kC0pB+fTbnvDUD3B4w/gAkrbu1
TLSH
T1B1A12C31E4B85C7754B5D584B5863E43CFB462EBA8109E80D9DD1F0D10AB1F82381E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 c067ac6a3a9b2ba1cc4f2c0332f793b309064af6e530cadd85da0f9f2f1e59c7
MD5 2d98939ee0806fbc3b2a5426acb46b06
SHA1 4cfe1e346d146678d86e0678b77811a0c47f2f6d
SHA512 2ed1e3313acd2b4e6085db4fb18d215a2a6ea989c1e49622b76ff7abb183e6950298bc9514d87c5b6c4bece9b043430004f4296b56e9a82be4577e990e7b0850
SSDEEP 3072:n2AM9JYonWG5+ifFgOTyH4FC6sahipMRq1kJlwgX5bf7L2:n2n9CSWohF/WH4FJVI8tlwgXJDL2
TLSH
T117D3123326465C67DFBB8578470B2C304CB068DBDA59BA189AF97E48C18F5E54B13B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 b0444a14304012ae672a2f202dff34dd7b9c9703dd6bfc031e64cfc7aba32939
MD5 fc55d7304517d806f4239b165dc4744f
SHA1 0ff6941976c4de403804d66627b5ee25844c9723
SHA512 b8fd8986294545230c7415b51cd334713f61e8112d4845e822799b8e84d3e65a33eaf620930c08e46a5e25d05d500e42d6c6b5793f2dc10c23ff2dffb9eef60c
SSDEEP 3072:aAM9JYonWG5+ifFgOTyH4FC6sahipMRq1kJlwgX5bf7L2:an9CSWohF/WH4FJVI8tlwgXJDL2
TLSH
T136D3123322466C73EBAB86B5875F0C30487068D6D659B6244BFA6F49C6CF6D60713B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5564_1146925705\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5460-2-0x0000027EA6570000-0x0000027EA67E0000-memory.dmp

Download

memory/5460-12-0x0000027EA6570000-0x0000027EA67E0000-memory.dmp

Download

memory/5460-11-0x0000027EA63E0000-0x0000027EA63E1000-memory.dmp

Download