7500d627aafa8cfc35b182a6f42afb2c4a3a0cfefee80211ae6498cec7411fd1

Analysis

user interaction
yes
max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Injector (3).exe
Size 70KB
Sample261003-lasbmswzhy
SHA256 7500d627aafa8cfc35b182a6f42afb2c4a3a0cfefee80211ae6498cec7411fd1
MD5 4d1ee647c80dedae545990e1d937952f
SHA1 585f57014a9eef21be020076f299292919fbff61
SHA512 b3fc44f9b42746b6de8ebd6e1e1a3147134fbf130330fec1629b5aeb0530767fa8388603a4526a2a763f54c0b3479f2d9678cb9440518769d698fb6f2fcc393c
SSDEEP 1536:wQrqhMlX7zDJ4l+0erc47t5JuL7uE2w5Vjk:wQrqhMtl4l+0sP/J+uEB5Vjk
TLSH
T1A1631A16DD29907FD35E89B9C9835D06DF72B88607A2A7CB53801DE70E369D85F3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{878960DE-50A1-4E54-B8AC-1D708DF8146A}	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3764	Injector (3).exe
3764	Injector (3).exe
3772	chrome.exe
3772	chrome.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe
Token: SeShutdownPrivilege	3772	chrome.exe
Token: SeCreatePagefilePrivilege	3772	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 2692	3772	chrome.exe	89
PID 3772 wrote to memory of 4740	3772	chrome.exe	90
PID 3772 wrote to memory of 2964	3772	chrome.exe	91
PID 3772 wrote to memory of 2964	3772	chrome.exe	91
PID 3772 wrote to memory of 5820	3772	chrome.exe	93
PID 3772 wrote to memory of 5820	3772	chrome.exe	93
PID 3772 wrote to memory of 4368	3772	chrome.exe	94
PID 3772 wrote to memory of 4368	3772	chrome.exe	94
PID 3772 wrote to memory of 1328	3772	chrome.exe	95
PID 3772 wrote to memory of 1328	3772	chrome.exe	95
PID 3772 wrote to memory of 4460	3772	chrome.exe	96
PID 3772 wrote to memory of 4460	3772	chrome.exe	96
PID 3772 wrote to memory of 3456	3772	chrome.exe	97
PID 3772 wrote to memory of 3456	3772	chrome.exe	97
PID 3772 wrote to memory of 1412	3772	chrome.exe	98
PID 3772 wrote to memory of 1240	3772	chrome.exe	99
PID 3772 wrote to memory of 4296	3772	chrome.exe	100
PID 3772 wrote to memory of 1240	3772	chrome.exe	99
PID 3772 wrote to memory of 4296	3772	chrome.exe	100
PID 3772 wrote to memory of 5388	3772	chrome.exe	104
PID 3772 wrote to memory of 4100	3772	chrome.exe	105
PID 3772 wrote to memory of 5448	3772	chrome.exe	106
PID 3772 wrote to memory of 5388	3772	chrome.exe	104
PID 3772 wrote to memory of 4100	3772	chrome.exe	105
PID 3772 wrote to memory of 5448	3772	chrome.exe	106
PID 3772 wrote to memory of 2892	3772	chrome.exe	108
PID 3772 wrote to memory of 2376	3772	chrome.exe	107
PID 3772 wrote to memory of 2892	3772	chrome.exe	108
PID 3772 wrote to memory of 2376	3772	chrome.exe	107
PID 3772 wrote to memory of 4276	3772	chrome.exe	109
PID 3772 wrote to memory of 4276	3772	chrome.exe	109
PID 3772 wrote to memory of 5172	3772	chrome.exe	110
PID 3772 wrote to memory of 1916	3772	chrome.exe	111
PID 3772 wrote to memory of 5172	3772	chrome.exe	110
PID 3772 wrote to memory of 3868	3772	chrome.exe	112
PID 3772 wrote to memory of 1916	3772	chrome.exe	111
PID 3772 wrote to memory of 3868	3772	chrome.exe	112
PID 3772 wrote to memory of 3304	3772	chrome.exe	113
PID 3772 wrote to memory of 2644	3772	chrome.exe	114
PID 3772 wrote to memory of 3304	3772	chrome.exe	113
PID 3772 wrote to memory of 2644	3772	chrome.exe	114
PID 3772 wrote to memory of 1200	3772	chrome.exe	116
PID 3772 wrote to memory of 1200	3772	chrome.exe	116
PID 3772 wrote to memory of 5560	3772	chrome.exe	117
PID 3772 wrote to memory of 5560	3772	chrome.exe	117
PID 3772 wrote to memory of 5920	3772	chrome.exe	118
PID 3772 wrote to memory of 5920	3772	chrome.exe	118
PID 3772 wrote to memory of 1912	3772	chrome.exe	119
PID 3772 wrote to memory of 3604	3772	chrome.exe	120
PID 3772 wrote to memory of 1912	3772	chrome.exe	119
PID 3772 wrote to memory of 2972	3772	chrome.exe	121
PID 3772 wrote to memory of 5424	3772	chrome.exe	122
PID 3772 wrote to memory of 3748	3772	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\Injector (3).exe
"C:\Users\Admin\AppData\Local\Temp\Injector (3).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb5d4ec728,0x7ffb5d4ec734,0x7ffb5d4ec740
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,17645498596505893070,9703137562520307114,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,3110491956152195643,18205870120331384256,262144 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,9220428780355158798,8377822745950802128,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,11991142991178000026,15459644017393290217,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,1261895567165528319,5832270100894226865,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,2183729456460968719,18423273542208443292,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,1603497366982774499,8976427172204805026,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,1273657168365087942,8018583578448737988,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,11548741111272998888,11554123469903882380,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5508,i,14802554434099078726,7901669836266416017,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5860,i,1400774940887805858,15928997090357745224,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,164179523169054777,9255497995441821640,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,14625038776178728908,14339880091867314173,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6132,i,15299622906911120408,2589956222029436884,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,10068273040811490640,15558077705160958444,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6124,i,2020409761119484814,4218657328270647792,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6112,i,3063948817284735461,12027044115868617409,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6464,i,14788813434965274842,13764401484570478910,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,16254090251078948348,15278510218302204478,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6396,i,8744243016002839011,14088959701335793805,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:9
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5580,i,13059360363040390772,3813560693881727155,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5740,i,9628899466266055757,10372219194053177158,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5960,i,1655365224967633341,2943218580743185600,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6244,i,5266499338360071604,17121691019257298141,2097152 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,11843459497934369460,6459157045856513100,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:12
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,6166981480076553106,14147631673901500238,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,3164014531639459923,12550292627380339157,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6348,i,16060222093827282261,6892990956296128132,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,17738968198369350978,17466925092070017715,524288 --field-trial-handle=1816,i,14096696093305429040,2666328124796328842,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:3748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8e6d2b25-47ad-483b-8cf3-32f66477c449.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8e6d2b25-47ad-483b-8cf3-32f66477c449.tmp
Size 4KB
SHA256 1b09da085d47791c93820972de14033e1797e297f2d3f8da36ba6c215c15784b
MD5 2b0aa062abc39202526e09385e024ab0
SHA1 11537864c6113701034c5dfb77ba0998620ef587
SHA512 6406613cfb2bc2442633bad353ea62567076c8a2493ccadfc4e9c5dc30fcaa7d3103f0169bdcf20924867e8be28118b9eb69b03be489a953dde2b3cbf6bba6cd
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5k8D1B6vGyvQH4SYE0bblDV4a:qC0xJPz8/CkqDUD3Lfr4SYE0bbX
TLSH
T1CEA10931A86D5DB788B6D585B2832E03CF64B197E621AFC4B5ED1E1C14F70E81781A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b5bdc66-d4b3-4e7c-8b14-897724722f94.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9b5bdc66-d4b3-4e7c-8b14-897724722f94.tmp
Size 138KB
SHA256 b1d47bc9a89203d219d58a955124837721b65d40c54c6f01a448a96fe0730e93
MD5 4600d3da6b316d18ecb961db205b33a2
SHA1 e7e99622a9fe4e4c5d4ec1e29be7880b916a3e4d
SHA512 88cbb42bc688cfa03914b51674f1853191428f7ec36d30e662e2a6db30ed05fbad90da0d7486f5fdcb8bb042925b7e6f9b45cfe40343fcd36ccae69df00c3e9b
SSDEEP 3072:3rdeocfNgQOXnASkVWQZm6GLLXO1naOOn7:3rM6ASEBkdY47
TLSH
T124D312B67F459C1BF3ECC5B5201B0E3365687EBEA08098D295D0669C0CDB8C83B69E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 55d4100633aa6320f5ea53eadcf8acbc5919f2cf4c0617687f15fc627ae7e4d9
MD5 fb38cf4cb204ee72ff5a7007a66ac321
SHA1 5f2fb51d343bf6a525b3880f0a46982813efebaa
SHA512 552661264ba5401fa865c959f7752d9991603990938a7324c9656b6fa4d7915edb167410d7f894c9e3a92a11e2c95d2b513e1b22afe0dc09cf4134e4debee4ec
MD5 SHA1 SHA512

Submit Download

0b962764-d33a-4b8d-8fa4-e24627b3a0ea.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b962764-d33a-4b8d-8fa4-e24627b3a0ea.tmp
Size 12KB
SHA256 7da6bbdb92b990602639b24725016bbf25e92a5c704df29bf01d5aa30cb4fe2c
MD5 c25f3799025f538e7f135fa4a1630398
SHA1 58987309bb3f530a1281387e2ee2d4461dd30cac
SHA512 c053e196498d08ed49d5fc123872588d701d9017c6e1068f745cd0fb3c09577bb1c7c2f55d0434a32514df6ec0af97ea953e2f76122956d8de84cdaac76b83f5
SSDEEP 192:7R3KcAGKAv7FdAPRp2o69bHsb+WNn5etHse7+eqkwZL0CHVyIsnAUgE:7R3KczNqXeBw4aem5QChE
TLSH
T12842B62AEE54757B9DDAC22AFA627B97E7F1102170942E84E6FC892C21E75CC7217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cb5f66a-769f-4e77-ba01-625bddd8be46.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0cb5f66a-769f-4e77-ba01-625bddd8be46.tmp
Size 13KB
SHA256 aa271ac301a42650f08f54ce96ea3db57b1cbc723a2b8c2234425c255719379a
MD5 e52bf3ce15f77afda3b9c960b48929e3
SHA1 bf012eeb71d78a774f5c2a4b239c19f1e8fd018b
SHA512 b31c8d1bdd6841627eb2064bd12007adcf6d3a116163cba289da6e7cc2832557330233b8e0405062e2dca078d2b0f3ba9f85897faf25f5570cc111297cfcac07
SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU31PHGJ7sXSgbdpiFaLe:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOtE
TLSH
T1CD520A67A84C993B0FD8DA8CCC267F8FADF5025662640D6492FB9C1803D97CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3d73c387b93b36cddb06332f7fc93ab85acc4172602a415d043fe3f1b0404f81
MD5 eb8cac3959471b96be2e58b401124882
SHA1 8f7d77f61857ad03b138d85253f7bc54589e65e6
SHA512 bf35e142f11eabadead97431095c1f2fabab3cc326764c568bf9194083c4fa7eb0b77b2326123f5b02bc9ec65aeb9bf5b6fd86023a2e7c6f45d89b695c735687
TLSH
T1FA510C0CA3D4E558CF6C0D311A856C4DEAE73B9606E20B276A047C943D938FA6E033C0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

20afced3-461a-422f-9fdd-7e3a3210c49d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\20afced3-461a-422f-9fdd-7e3a3210c49d.tmp
Size 5KB
SHA256 fe28b67705a9f585f3208fc1d7963936536ca41eb49b916ec349fdadf52dc55e
MD5 7a2119464523f18c212e5ea857f74bbb
SHA1 e74b2c0d80a3a71d96538e23995599936700e126
SHA512 62329d0367fbd7826dfbd14c3c83f27ec1e2d1d3b99952a86579dba6c64b1cc4e658be9f973ba241f5ee1bd59f5e4b918815dd8e8ce377b65a429bc33dd1e2d4
SSDEEP 96:D/e98U+/I1Qo2ivO7GMQg9fXO3h8z4cP+Qt2HA:D/e98U+/I1Qo2ivO7GMQg9fXch8z4cPB
TLSH
T111C1BDF383E8CA6D890597F49A156E1BCE590924131C3C66C8E4BE5B93F34B2E24179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23e61be4-1af9-42eb-9f27-80e42084538e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\23e61be4-1af9-42eb-9f27-80e42084538e.tmp
Size 2KB
SHA256 261a2c8884ab5a690adeaae9af05797ced19a9e6f6f45964d8f9d3a30138db83
MD5 db48d8755570e63a85b1f084be822e22
SHA1 dbef06c573cfa554f0c7a105d3c3161cde7094a6
SHA512 33750738ad7dd747028bd38d22fc170551d56590ac261b420a81a9c5138057df150c7a5bd565d875be8744ff280cf3a885d9e6aa1b0a43d9d548c7e3c882d16a
TLSH
T1045168ABE57AB46B20688AFF1E50FC0A19BFB8351191F8F8CF57816C70818F60B25057
MD5 SHA1 SHA512 TLSH

Submit Download

2a335b26-5794-4e70-859b-125d5ce9736d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2a335b26-5794-4e70-859b-125d5ce9736d.tmp
Size 1KB
SHA256 a2bba4db852b66af54f533475d3f4efbd7412f069ffb4de323c68decb9efa72d
MD5 72af339afa3d27a9ed7451b915954b0f
SHA1 c137def1f5633ab66d36aaa598b526b39cf5a850
SHA512 a96b21ec14e28aef292b6bc5ed30959d57981df9e2ef4f38bf94e5b7e5d428bf6cadd396204693e546e4e6ec01e3d439c03fbae7fe10eaa37d3ad21b09d4ab0d
TLSH
T184315AF7C3D89A7D890166F8A715AF2BCE290A14525C3C5AC8D4AE1F53E28F2D24065F
MD5 SHA1 SHA512 TLSH

Submit Download

88826090-ac1f-4632-b462-7c18bc4ce0d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\88826090-ac1f-4632-b462-7c18bc4ce0d6.tmp
Size 1KB
SHA256 971e3ccb9910416237bfb83ed2e83b5d9c8af945b10c42e9eb4475e97d0a24f3
MD5 0d8db2a4b87ed22612ff258252d2af66
SHA1 e587c67191ed56aa57392221263634aadf014036
SHA512 3cdefceda5560cc7a4c3a49f6c279a1e5bc41254d23e420a9757dae11f1ca6e5011ac9aa92998f238c83472d4c4a006904ca485c02efa7c85bbe7bdecdeb3c06
TLSH
T11B315CF7C3D89A7D890156F4A715AF2BCD290914525C3C56C8D4AE1F53E28B1D24065F
MD5 SHA1 SHA512 TLSH

Submit Download

9e1eb76b-4553-48c7-a3dc-b4b1a65ce11f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9e1eb76b-4553-48c7-a3dc-b4b1a65ce11f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 a8f67fa1be2c1d5accf6f6265ccb60f3f92a9f5fa0410e72c8e5d8fe30dafb53
MD5 685120c11e43db4a4f24024fe58b4710
SHA1 5bd6752ee658575e0512d3602a370eb4b5634eeb
SHA512 e5a19d50e4fea9903c021efb18905aa7a2f3889c43106c0255172b3d446ffac9dd1e4861f040c1408ca0c6b7c269025b94ecb3306d46f1a5cbc1f8b47b8847ac
TLSH
T15AA002D885D10451DE9042B5F062854122D3581C55A5430B54F24C44ADAF2D44911314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 01a590d901149a2da100fc2b206a2ecc1c7dc14f668431f15f099b6a3a6fcf35
MD5 b478c1069735098e4df0301c1e48ecc4
SHA1 459636b1a31226c433d2afb660edfb7f9e57d7a1
SHA512 ceb22498a75fc9cfc4cdad91e1cd1b395fa9d29ec151b65ae65cb1dc3ab3aae604e34616b0371e1bec4f312833bda1a1b6eacd303e149bbc65aa1af918383ffc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

23d9bbe3-ee2d-4949-9a88-0712f715ae69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\23d9bbe3-ee2d-4949-9a88-0712f715ae69.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

ea3191c2-6eb9-48d8-9d24-ca8c38b6d4c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\ea3191c2-6eb9-48d8-9d24-ca8c38b6d4c7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ab761ac9-1abf-42db-aaa9-42b2ba372be5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ab761ac9-1abf-42db-aaa9-42b2ba372be5.tmp
Size 11KB
SHA256 28f927e8abb27ba8e020cd07229e2f4d46be3ce48a884d69d52fde089c9b5fbf
MD5 69adfa235bb713bf0874ccb1f5ee7061
SHA1 0c3130e66784e03915bd9b69d5690c7176d7ad3a
SHA512 f4a329948def6231e4dce52dc16df9c8b2831a8cc013fea9357647861cff57dc72444732b41f4ca5dd38e92d4e78d0cf85bb667d45a053d8a69283644a45aefd
SSDEEP 192:7R3KcAGKAv7gAPRp2o69bHsb+WNn5etgX2K+eqkwZLKCHVyIsnAUge:7R3KczNdXeBw4a295eChe
TLSH
T12E42B42AEE54757B9CDAC32AFA627B97E7F5102170942E84E6FC892C10E76CC7217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcae3985-9d66-4341-b3f0-82bb183c127d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dcae3985-9d66-4341-b3f0-82bb183c127d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a9c0d621-dabe-4b10-9a97-0d1a2e15c3d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a9c0d621-dabe-4b10-9a97-0d1a2e15c3d9.tmp
Size 138KB
SHA256 8b7d6429343c76a5de2f5ae47ed33966e19f3308d79e7315c0fceccabc76ff0a
MD5 f3dc495f900b2a686aee9d491a24e4e0
SHA1 b3f39fa30a59ef8ff1b82aa4e8571840450b3b4c
SHA512 26cb1bdb8f2e7891a6cb7454bdcc81cfa563ce4266d63aba411a8564397bfda7aec0ae810d721e5d62ded5e5ff76ea8437840451f87ef6eb3677e8e6f8090cfc
SSDEEP 3072:KrdeocfNgQOXnASkVWQZm6GLLXO1naOOn7:KrM6ASEBkdY47
TLSH
T105D312B67F459C1BF3ECC5B5201B0E3365687EBEA08098D295D0669C0CDB8C83B69E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b172a40f-e0c2-4673-a978-a15c5cf98467.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b172a40f-e0c2-4673-a978-a15c5cf98467.tmp
Size 138KB
SHA256 48dfed91918572f40cd051a52a7fd3ab79f8d3d100bcb8e8f46e13611c499f81
MD5 61bfa942d355d7287e657cd09daf32ef
SHA1 be0f0de7e7803afb78d9d77e4bf24d8fd506d31a
SHA512 57b71c5801f3b378dc2c02cc72080727924aaa76ebda0b5c237ffa2f1177d6c15541c95ce8323a739c9a91dbc0267dc042614e60819bcbc1d223e73ad377a2f0
SSDEEP 3072:4rdeocfNgQOXnASkVWQZm6GLLXO1naOOn7:4rM6ASEBkdY47
TLSH
T179D312B67F459C1BF3ECC5B5201B0E3365687EBEA08098D295D0669C0CDB8C83B29E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84ee8770-c0dc-437e-985e-f1ddc8b342d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\84ee8770-c0dc-437e-985e-f1ddc8b342d9.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yqm5ojs1.ysa.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqm5ojs1.ysa.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3772_439356606\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1120-1147-0x0000000005700000-0x0000000005722000-memory.dmp

Download

memory/1120-1160-0x0000000006AB0000-0x0000000006AD0000-memory.dmp

Download

memory/1120-1149-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/1120-1148-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/1120-1152-0x0000000006020000-0x000000000637B000-memory.dmp

Download

memory/1120-1153-0x00000000064B0000-0x00000000064CE000-memory.dmp

Download

memory/1120-1154-0x00000000064F0000-0x000000000653C000-memory.dmp

Download

memory/1120-1155-0x0000000007680000-0x00000000076B6000-memory.dmp

Download

memory/1120-1156-0x00000000703E0000-0x000000007042C000-memory.dmp

Download

memory/1120-1157-0x0000000070540000-0x000000007089B000-memory.dmp

Download

memory/1120-1145-0x00000000031F0000-0x0000000003226000-memory.dmp

Download

memory/1120-1146-0x00000000059D0000-0x000000000601A000-memory.dmp

Download

memory/1120-1161-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/1120-1162-0x0000000007E70000-0x00000000084EC000-memory.dmp

Download

memory/1120-1163-0x0000000007830000-0x000000000784A000-memory.dmp

Download

memory/1120-1164-0x00000000078A0000-0x00000000078AA000-memory.dmp

Download

memory/1120-1165-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Download

memory/1120-1166-0x0000000007A40000-0x0000000007A51000-memory.dmp

Download

memory/1120-1167-0x0000000007A60000-0x0000000007A70000-memory.dmp

Download

memory/1120-1168-0x0000000007A70000-0x0000000007A85000-memory.dmp

Download

memory/1120-1169-0x0000000007AB0000-0x0000000007ACC000-memory.dmp

Download

memory/1120-1170-0x0000000007AA0000-0x0000000007AA8000-memory.dmp

Download