56d2b4741c3e0566ec53a73ce1ea56845a3a5d0fbec89dd69322d3cc3a642c4b

Analysis

user interaction
yes
max time kernel
81s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.exe
Size 4KB
Sample260925-ffb9qattb1
SHA256 56d2b4741c3e0566ec53a73ce1ea56845a3a5d0fbec89dd69322d3cc3a642c4b
MD5 edc035a356d45e9d3f825ce15a87828d
SHA1 90320ec38280493f84ec81cdff74f68423c1ee40
SHA512 fd950d1863ced7d6213abe267a691d07806196e4a2d3c38acf08732375aa687d4ea44f39c71d4cdfd0c294c661f26f7ecd9a00a1056542788dac84ea51a643a5
SSDEEP 48:9qxwOZv1wOZGZdPkwOW1wAPFsXEJfmbJuor5BPr:4xwOZv1wOZGZdPkwOW1wAPF+OfmduG5
TLSH
T18A915F27AAA437B2C3EA79300A92602A5CE33CE38E5388D5297C140C27251339AF0F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
95	4432	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4432	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347853426230050"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{5821AF82-59CE-4680-B0DB-67CEDDCF2B41}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 2676	5880	chrome.exe	91
PID 5880 wrote to memory of 876	5880	chrome.exe	92
PID 5880 wrote to memory of 876	5880	chrome.exe	92
PID 5880 wrote to memory of 4432	5880	chrome.exe	93
PID 5880 wrote to memory of 5672	5880	chrome.exe	94
PID 5880 wrote to memory of 5672	5880	chrome.exe	94
PID 5880 wrote to memory of 5940	5880	chrome.exe	96
PID 5880 wrote to memory of 5940	5880	chrome.exe	96
PID 5880 wrote to memory of 3344	5880	chrome.exe	97
PID 5880 wrote to memory of 3344	5880	chrome.exe	97
PID 5880 wrote to memory of 4320	5880	chrome.exe	98
PID 5880 wrote to memory of 4320	5880	chrome.exe	98
PID 5880 wrote to memory of 6124	5880	chrome.exe	99
PID 5880 wrote to memory of 6124	5880	chrome.exe	99
PID 5880 wrote to memory of 4828	5880	chrome.exe	100
PID 5880 wrote to memory of 4828	5880	chrome.exe	100
PID 5880 wrote to memory of 2932	5880	chrome.exe	101
PID 5880 wrote to memory of 4908	5880	chrome.exe	102
PID 5880 wrote to memory of 4908	5880	chrome.exe	102
PID 5880 wrote to memory of 3428	5880	chrome.exe	103
PID 5880 wrote to memory of 3428	5880	chrome.exe	103
PID 5880 wrote to memory of 5408	5880	chrome.exe	104
PID 5880 wrote to memory of 5408	5880	chrome.exe	104
PID 5880 wrote to memory of 4144	5880	chrome.exe	106
PID 5880 wrote to memory of 4144	5880	chrome.exe	106
PID 5880 wrote to memory of 5576	5880	chrome.exe	107
PID 5880 wrote to memory of 5576	5880	chrome.exe	107
PID 5880 wrote to memory of 5312	5880	chrome.exe	108
PID 5880 wrote to memory of 5312	5880	chrome.exe	108
PID 5880 wrote to memory of 2968	5880	chrome.exe	109
PID 5880 wrote to memory of 2968	5880	chrome.exe	109
PID 5880 wrote to memory of 1724	5880	chrome.exe	110
PID 5880 wrote to memory of 1724	5880	chrome.exe	110
PID 5880 wrote to memory of 4644	5880	chrome.exe	111
PID 5880 wrote to memory of 4644	5880	chrome.exe	111
PID 5880 wrote to memory of 1772	5880	chrome.exe	114
PID 5880 wrote to memory of 1772	5880	chrome.exe	114
PID 5880 wrote to memory of 3444	5880	chrome.exe	115
PID 5880 wrote to memory of 3444	5880	chrome.exe	115
PID 5880 wrote to memory of 3556	5880	chrome.exe	116
PID 5880 wrote to memory of 3460	5880	chrome.exe	117
PID 5880 wrote to memory of 3556	5880	chrome.exe	116
PID 5880 wrote to memory of 3460	5880	chrome.exe	117
PID 5880 wrote to memory of 2164	5880	chrome.exe	119
PID 5880 wrote to memory of 2164	5880	chrome.exe	119
PID 5880 wrote to memory of 1492	5880	chrome.exe	120
PID 5880 wrote to memory of 1492	5880	chrome.exe	120
PID 5880 wrote to memory of 3408	5880	chrome.exe	121
PID 5880 wrote to memory of 4380	5880	chrome.exe	122
PID 5880 wrote to memory of 860	5880	chrome.exe	123
PID 5880 wrote to memory of 2784	5880	chrome.exe	124
PID 5880 wrote to memory of 2784	5880	chrome.exe	124
PID 5880 wrote to memory of 5316	5880	chrome.exe	126
PID 5880 wrote to memory of 5916	5880	chrome.exe	125
PID 5880 wrote to memory of 5316	5880	chrome.exe	126
PID 5880 wrote to memory of 4348	5880	chrome.exe	127
PID 5880 wrote to memory of 4348	5880	chrome.exe	127
PID 5880 wrote to memory of 2280	5880	chrome.exe	128
PID 5880 wrote to memory of 2280	5880	chrome.exe	128
PID 5880 wrote to memory of 1008	5880	chrome.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffbbb88c728,0x7ffbbb88c734,0x7ffbbb88c740
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,8773926999782686923,12435771811116209853,262144 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1400,i,14514543270906206539,13387481545777597872,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,13130795067531588821,3732288209608317635,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,17436903185757920959,13669088766764847089,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,14889931631092453712,17734173089093392613,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,13807394746728629942,9506502180795068835,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4860,i,17334254483343391060,13255504952586728388,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5408,i,12627214744981262245,1784170417769848465,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,11784194059325246981,7767328713520341072,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3164,i,2891446479780849972,12136934351259527140,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5604,i,14395830781520130053,6269482688180308127,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5864,i,9543785026805262937,7248846369408877220,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6004,i,12416727376764907746,9741295756308210543,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6212,i,8159676593229929932,7747159618713326346,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5904,i,2806304082599242238,8755632495035360413,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6428,i,15939625920682897416,15628742954427497294,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5908,i,444534427421333739,6935419519861693457,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6752,i,10882117109085011541,761281032285959166,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,10604732558464692500,11893888279416757571,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,10255964925710353509,12380876904427997943,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6508,i,7284128509723351425,12518174855686582824,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:9
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6740,i,14052108354624005350,12360992958951387154,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6312,i,16481762861977979234,15766890445790096295,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6780,i,4487472292602755235,4071407739993451174,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,12217249151764857533,8751608926133269307,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=268 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,15681470586875792442,7776729326296209339,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,6358737881375317333,2734467523070612073,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6188,i,18332890531905096242,10100020960541470194,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7100,i,1075375932990425364,11780272712063824546,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,4667034452334718278,5669183961234212542,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:12
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6600,i,17478513740916171590,13794225103420614310,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6096,i,9662259427935811943,12390343007085561132,2097152 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7152,i,3434026039203178163,10883104060162187524,524288 --field-trial-handle=1892,i,1676559602649587422,5019020126645019176,262144 --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:14
  2⤵
  PID:1008
- C:\Users\Admin\Downloads\Monoxide-GDI.exe
  "C:\Users\Admin\Downloads\Monoxide-GDI.exe"
  2⤵
  PID:1044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 443KB
SHA256 5c406fa9f587e72c499b77aaa760252136419e986664505421649a55ef5f14db
MD5 a5ea09dae5a36130008471004d22f63b
SHA1 af8924dc9d87bff8de85ce099b659748304d822a
SHA512 8e5c221db5536d5c1efdc9206d6ab1617883fbe8a2d43c3cf87628dc48046c9a615257c9d5585c2a55922d6bb723edda2a0af41b72b1266c1724a6fe87b99440
SSDEEP 12288:9trezBqAVNlVXHH+TEZXvNFxL9BqNDAw+3yFfy6pyY53cKd:HezjVFXHK4hBw+CNy64Y5L
TLSH
T1D3A423010E08F90C4BD863E43B72157D1E6B833E91DA55BFE8519B6E689E3C0D2CDA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 83e09db08ed6e6b29e37e28af1de88adebb428f74c97412d3be65620666a8dfc
MD5 999007c86d55e2c6567738f445cf8da1
SHA1 7bed766e262ff4481cb6b170d2ae5b4b9a105895
SHA512 66c975a44c9c260ac55e08b9a69ae0e8e1a0a38cff8d66f1aa577700acdcac17c33174ff78894aef02711c8132aa72a947594045ee0fe547ab03335d07c2782c
SSDEEP 96:FCRLh0yhcsB1baa1/lQav7aaZUqds6LjX3l/Xybqc:F6t11ecs4xgd
TLSH
T14AA1A3000493C0FCDBA43970A8E976BB7435A0DD4D270EBB7E579538338E39A785945D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 5e4b08e34ab4cb850f05735901cc0b333cf0d21745dfcda699acd46dd24ce6b2
MD5 1c40d65c075520e10ac78a4977628f59
SHA1 f396816726764e079edd4b24650e0316b063d634
SHA512 433b67667a453da2cd05c3e03e8b72a92e1e10d61f9ebcab1d461f81a235ea3588217ed262f33e1384845ecd54cc1d3a05c1294a8e57ed5a519813f8ca9bdfb7
SSDEEP 192:D15tomX1PSx4JP2JfamYmeAgf8W2FAaP1ICuswQX18YHNv7Qv6fPUIZIyINP6NmZ:D15tomX1PSx4JP2JfamYmeAgf8W2FAau
TLSH
T10F32DEF3C3D9C52DC95156F4EB25AF2ECE2A0918432C3C26C8D8AE5B93E2471E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9169cd333335e64a73c21d8ae47ad2cee7fe988aa536817e367c0a8ef08a16d0
MD5 f30610f29dc88d11e06297e1136f219d
SHA1 99010329e811ea4c6342d2dd0e67caabb520fe9c
SHA512 07b993f7c949ca1901b005bd4f9d01820ac2ba0dc1d90593f73a037f194d194f3ece94c0eaf95f41fbc08e8d68437fca68ff9ebf9338da504ee35f22d08775ad
SSDEEP 192:QRpOT8uoTv7AUAPRp2Ydl9BHsb+WNnKa72z6/2jxHMQFkwdVyIsnAUge:QRpOQuorMXBDwrq2/2jaGLe
TLSH
T19542932EEE14793B5CDAC21AFA267B57E3F5102175942E84EAFC892D10E79CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1e757261f15762675ed5c70fd3a1367914b66aeaf3ca8d1656dadceade2a1499
MD5 02ad4b2b342613320e6df1a60b00f88b
SHA1 a48817d2d69ab2eb9fd5bb3bb313863ffba7cdfa
SHA512 0ea22fcceb61dda6205aa102d0a850c5f8d55fefdb0597391eb8f960bfb1e1e21e82a0946f0f3842572d76716d9cc0d21b05d7c99df2854ed56f977c95fe08d5
SSDEEP 192:QRVcBhOT8uoTv7AUAPRp2Yse9BHsb+WNnKa72z6/2jzHMQFkwdVyIsnAUge:QRVmhOQuorMXBDwrq2/2jwGLe
TLSH
T16F42A32EEE14793B4CDAC21AF9267B57E3F51022B5942E84E6FC892D10E79CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e3734545f41fe89a7c4abc882eff35fbb02d12cf77d470fc44940cd31c68d455
MD5 e3bc27c39572b89c327dd34e2fba993a
SHA1 5a4d8035c55f610c668f5c6cbb8658576c3fd285
SHA512 48c1618882436ac3ffe68f28801f01a81ae1dcb74ae5d5bfecf6160d1b2084e042e7a3f8a03a34af110b8399885be5e4c39a29ba24ba0fa5a20abf475dd192cd
SSDEEP 192:QRVcBhOT8uoTv7zUAPRp2YHF9V9BHsb+WNYLXKa72z6/2jdHMQFkwZVyIsnAUgE:QRVmhOQuorNXnDweq2/2j+GfE
TLSH
T1B942A52EE914397B5CDBD21AF9267B5BF3F51021B5942E84EAFC892D10E7ACC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1264b1be69fe63d18d9dd196059db6c3a154b74ad6a2df78efed6fec4f24b628
MD5 7df8b6f7c4edbf9e08ebd03d734f3d40
SHA1 df04a84d800cf36d10d6f011802e5cc913296871
SHA512 c6486abf6757fdfeb74b5dba8726f895e07484e18e4db6159f743a4ed08c33f50dead4108e03fe09695a08c635ffa976fd576a6116221afc6050b02ed2d752d2
SSDEEP 192:QRVcBhai8uoTv7zUAPRp2AMHF9V9BHsb+WNYLXKa72z6/2jdHMQFkwZVyIsnAUgE:QRVmha1uorNXoDweq2/2j+GfE
TLSH
T19352A53EE914297B5CDBD21AFA267B57F7F12021B5941E84EAFC892D10E76CC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5440c4a9a602a76d1713d04946fa4042d275b7ecb53d71aba7fe409752f66db1
MD5 1c689a7366c768b17275ef99211ebc28
SHA1 9014f25cb2769e1c53fa5523461ed236965fc839
SHA512 40c06fd7dd654629a9eba30d94bd46ac699faf710820122e46edff4b6fd6bdf67aa14217907569c1574557229d608c233b1d8291d9c2fa3b12d5c6aaa3b91def
SSDEEP 192:QRVcBhai8uoTv7zUePRpVAMHF9V9BHsb+WNYLXKa72z6/2juHMQFkwdVyIsnAUgE:QRVmha1uornXBDweq2/2jxGLE
TLSH
T11052B67EE914297B4CDBD21AF9667B57F3F12021B9941E84EAFC892D10E76CC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 e99ae42f5bf214b63443a374241fa6292a76573fde4a3945527f03040fa067df
MD5 ac72b834ef2709bb795f407f18197169
SHA1 1f1a549da79219beac379f97e1121b8bb39be22a
SHA512 f02ce7f2f2f22377692dbb5d6aac8f17187a18045e0564cb250a97d669c2e494d194c77e7aeaebb38d750b27c82bd2f71c7ea9c1ed39981d19afc809f0c3dca5
SSDEEP 384:XRjg77KxkXqKf/pUZNCgVLH2HfgslwgXODg3+ErU3iXHGAZP6WeBfn+ie:Xxg77KxkXqKf/pUZNCgVLH2HfgsOKO89
TLSH
T1C652086B648C9A7B0FD8D58CDC27BF4FACB502566268492446FB5C0903E57CB124B2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 22f54befbe5642931a82898e4ed011d294da6ad898f4a98d8390d05bdc087fca
MD5 8fbc48d1a44fa6b92249cd6bb49e26ee
SHA1 0e2aec5d0af55b427fed72366decd79159100c2b
SHA512 bb01c1cc1bf0c7df6ab05035cc2a491a3a83ea95d56777e08f233e6011a0dd9c3cb45d034da4daf437581135989234dfa9c5c5aa5797efa41d4d4581742a5887
TLSH
T195A002E081641651D85C0674D6E511C02B206A2487832F477092815D98652824705601
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 64992e8575f533c3a9ff8d12184fa6979cf2865d32e587ddeb0ac1a2562d490e
MD5 b27bb96e8f93200a7a3e0ff450da0129
SHA1 bf0567a6ae35e4a4865971442af39419a2cf69f2
SHA512 519aa61f8c989806f1b6172554d637812481e6b703af19a64a2fce80d3d75e891f8efb0a4868e2ffb042ddd1970a2887795a7b446d8d1f8b5bc4747817acaff3
TLSH
T174A0021559C91631DD0567B464E625523652C81C2952870369D2076DF95B2C54142A82
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d7c40ddc12fccdc4cc4bf5748a20aef8069ea7f283f920f9e6df0a8bc59a9a8d
MD5 8e3806f9475d98dc523194952fa3a74f
SHA1 cd7a7ccafecab926804802e4a15d8d8e81753ade
SHA512 39d1be360a47c4ba0311282e6db959c9afd5a3cef62e619b33e2c3a96c462a5d6e7f87c764f6043c643d9990344d0a4e5b313c43ae390bf616df9a2c136c5219
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f2d07179c3e13eaf69619d570d184566aef5809cbe7ecd0433d501dcea92d5b0
MD5 81600da5b045d9cf47267d0f5c98708e
SHA1 eb57b6c8fbae2a381b82c3c78dab3a67386a2d8a
SHA512 19e2f40f1bf18ee39170bf86082552c9f2ba399d2c09e675913a72547166e66e8e6b95fa54c09c052ad9d46290a738c303ff452772c632df8afcc55b19683ca2
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5NgNDcNB6ndGyvze9a2jbfEv4a:uFC0t+W1I04DUD6cT4wL9a2jbu
TLSH
T1BAA12B31E56E8CBB58F6D985B0573A03DF79A26BA8215F94D9ED6B0D04F70EC0782123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 445da97377439f11b7ec8dee4f00b0c2840b11e7f86587548005beeab607ea10
MD5 850ef1eb7257e4a5c632fc55d7d5ea39
SHA1 6ec9e06f7cacf61155b18ed0f173bac4b832e6d4
SHA512 2e5b5dfcd682838fda4f11ac0d2e5caa714e47c0545bbdc5f10b2619df0b74cdd0068c392bd8681ac072ac45743059d71ed861056269c3251676ee5d940c7367
SSDEEP 3072:QAsgwHERoUaeAXz2VhZwfTFmy8LzcLTCuq4zJ2Sfo8wkuBncMqO:Q35kRoNe+kLw7U1zwnq4USf7whn1qO
TLSH
T144D31234B97CBC01D2F9193FB8290C2B6DB4C17396E10698FEF235649A5A9E10337D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 f53d58732e733ca756ea06032930558d952fe783dbbac24abcb2c93e4be17815
MD5 faba9cd2e06c3aca90bada944eefd4e3
SHA1 d0ec4e17b191f1daeeb96db558f3c2ae00f7323a
SHA512 34d259672b01ef59a7b1392d85772f0b61796623e3b440f4aa7ea138399a6616c4d4bb073890e84ac7fcc1cf693e00f3aad695b9bdaf336a48b0d9472603a90a
SSDEEP 3072:QAsgwHERoUaeAXz2VhZwfTFmy8LzcLTCuq4zJ2Sfo8wkuBncMqO:Q35kRoNe+kLw7U1zwnq4USf7whn1qO
TLSH
T1DED31238B97CBC01D2F9193FA8290C2B6DB4C57396E10698FEF235649A5A9E10337D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 991bf25102be88200de3e3b5e5be06b41da76996fc5ddc8edd979b611a58dd63
MD5 c90a3d2ae3d81aee9c0583a4547d70a2
SHA1 6c507965a52e10d558aa9b1dcac58a9572576e38
SHA512 05779d69b9747ebe16a71979d31a48ed2be6b80e9d02ce3d645d046a17ba0ffd0843434e1891d3e38525e90f5c913cb6990f7d4640d95aebc9455d84b4254ae4
SSDEEP 3072:ZAsgwHERoUaeAXz2VhZwfTFmy8LzcLTCuq4zJ2Sfo8wkuBncMqO:Z35kRoNe+kLw7U1zwnq4USf7whn1qO
TLSH
T10AD31234B97CBC01D2F9193FB8290C2B6DB4C57396E10698FEF235649A5A9E10337D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 83e8af2574e44f9d354c38af9cb86eac97efdd53122dee219d379aa954ba50ab
MD5 2b7886d5a88f35992122490709da2604
SHA1 96a516fd6c18a15684e704fd69f4025ef4291298
SHA512 a571c662563821b04e90dcda2d46f71059eb2101a38c8430cd02fc0640bf73ad80a888092e6b7e7da9297b456fe0db4c2c67ca0e56096c24fb2d935b0bea58b3
SSDEEP 3072:NAsgwHERoUaeAXz2VhZwfTFmy8LzcLTCuq4zJ2Sfo8wkuBncMqO:N35kRoNe+kLw7U1zwnq4USf7whn1qO
TLSH
T108D31234B97CBC01E6B61D3BA8140D175DB8C0779BA11B9CFDF239A19A1A9E60337D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5880_257235268\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Monoxide-GDI.exe

Path C:\Users\Admin\Downloads\Monoxide-GDI.exe
Size 116KB
SHA256 a4ad6bb531bd8268d624f264910b15600f902fd634cef18a500c0f75a25a8042
MD5 567807ffd4dc5918c342138051a07902
SHA1 b2e19490673977db2442a10cab691f6bae2a07de
SHA512 63f776e3df52662dab41e97fe934b08b590a055126db4ba6d829208d627e79ecc367da19e433e981d7f4ea8214d9114673bf10c1b3bd88c12bef63fdbf6379fc
SSDEEP 3072:j+HVWvWAJhX3OFeOc7l+BoQ/40bMBNeuO9dH3+n:jGVWvWAf3gI+//Ngg16n
TLSH
T1A5C37D50B4C1C871E5B6093118B5BAA24E7DFA704B259FFB2798163E4FB80C09A73D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download