74e704b51c1c1d2ffd2c58d2c10026d88c5a50134c9989b87c98db315f341400

Analysis

user interaction
yes
max time kernel
78s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
newui.exe
Size 36KB
Sample261009-vgdaqshw2n
SHA256 74e704b51c1c1d2ffd2c58d2c10026d88c5a50134c9989b87c98db315f341400
MD5 46825ef924ae3de614475e88c95a5e00
SHA1 d7978d31ed5bf27f59fe7f9c0719e804151bbe0a
SHA512 a82213a87bf0e025a882f799346565668616c3df9bc107d2f88d1d0beda79c1249a7865b0302066f4fac66d0620f815d51dd078059570006402de7c34d59fbf0
SSDEEP 768:RAhzDCe/9wiwJcI/ds9wRulxph45IF271VPJRJRQSLA0Nuu+fR:RA5G9uI/dsyRulN+j7nPJnRQSLA0Eh
TLSH
T135F22A33879001B5C51AD5FCC7E97622E667B84557387ADB87E40A273B40BF0BE3AA41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	newui.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	newui.exe
4832	newui.exe
4832	newui.exe
4832	newui.exe
4832	newui.exe
4832	newui.exe
4832	newui.exe
4832	newui.exe
1696	chrome.exe
1696	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	newui.exe
Token: SeLoadDriverPrivilege	4832	newui.exe
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	3300	Process not Found
Token: SeCreatePagefilePrivilege	3300	Process not Found
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe
Token: SeShutdownPrivilege	1696	chrome.exe
Token: SeCreatePagefilePrivilege	1696	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe
1696	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1696	3300	Process not Found	109
PID 1696 wrote to memory of 4428	1696	chrome.exe	111
PID 1696 wrote to memory of 4144	1696	chrome.exe	112
PID 1696 wrote to memory of 4144	1696	chrome.exe	112
PID 1696 wrote to memory of 4192	1696	chrome.exe	113
PID 1696 wrote to memory of 3384	1696	chrome.exe	114
PID 1696 wrote to memory of 3384	1696	chrome.exe	114
PID 1696 wrote to memory of 3724	1696	chrome.exe	116
PID 1696 wrote to memory of 1424	1696	chrome.exe	117
PID 1696 wrote to memory of 3724	1696	chrome.exe	116
PID 1696 wrote to memory of 1424	1696	chrome.exe	117
PID 1696 wrote to memory of 1484	1696	chrome.exe	118
PID 1696 wrote to memory of 1484	1696	chrome.exe	118
PID 1696 wrote to memory of 1792	1696	chrome.exe	119
PID 1696 wrote to memory of 1792	1696	chrome.exe	119
PID 1696 wrote to memory of 4136	1696	chrome.exe	120
PID 1696 wrote to memory of 4136	1696	chrome.exe	120
PID 1696 wrote to memory of 3208	1696	chrome.exe	121
PID 1696 wrote to memory of 3208	1696	chrome.exe	121
PID 1696 wrote to memory of 4940	1696	chrome.exe	122
PID 1696 wrote to memory of 4940	1696	chrome.exe	122
PID 1696 wrote to memory of 2004	1696	chrome.exe	123
PID 1696 wrote to memory of 5012	1696	chrome.exe	124
PID 1696 wrote to memory of 5012	1696	chrome.exe	124
PID 1696 wrote to memory of 3492	1696	chrome.exe	126
PID 1696 wrote to memory of 3492	1696	chrome.exe	126
PID 1696 wrote to memory of 4948	1696	chrome.exe	127
PID 1696 wrote to memory of 4948	1696	chrome.exe	127
PID 1696 wrote to memory of 3920	1696	chrome.exe	128
PID 1696 wrote to memory of 3920	1696	chrome.exe	128
PID 1696 wrote to memory of 2168	1696	chrome.exe	129
PID 1696 wrote to memory of 2168	1696	chrome.exe	129
PID 1696 wrote to memory of 5524	1696	chrome.exe	130
PID 1696 wrote to memory of 5524	1696	chrome.exe	130
PID 1696 wrote to memory of 3808	1696	chrome.exe	131
PID 1696 wrote to memory of 3808	1696	chrome.exe	131
PID 1696 wrote to memory of 960	1696	chrome.exe	132
PID 1696 wrote to memory of 2644	1696	chrome.exe	133
PID 1696 wrote to memory of 2184	1696	chrome.exe	134

C:\Users\Admin\AppData\Local\Temp\newui.exe
"C:\Users\Admin\AppData\Local\Temp\newui.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9f4cac728,0x7ff9f4cac734,0x7ff9f4cac740
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,7978121574800458742,18406798530248687128,262144 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,7092870225805914400,11743009349873268896,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,10349407005594388826,15648401172533512347,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,8684237508325216938,963841152424695543,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,1209606775515317687,4611290733780145398,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,643856065319536088,7811578061027403970,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,15196835253434948679,1149609292507008418,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,1711527033510609921,3187786749640833232,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,9394780837723886478,10274354597339921492,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,656944550946744998,3220119024571260910,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,7031413992487832860,12896261412207377724,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,13318652801975109042,12655062816829214503,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,9617188392737839712,16624688816044193379,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,3332307349594652701,13946751901421497160,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5600,i,14098656985461969820,15217913510980265259,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5920,i,15635654315143788563,3121514005553288027,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6504,i,4217012794463844053,18394220352896513301,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6204,i,2615830898398654288,8355077413751300904,2097152 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,1594608586313092100,8842609666532720149,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,4982329677716992814,13443499532263298823,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3528,i,17164007063524161586,11727194845434148964,524288 --field-trial-handle=1876,i,10304983895804767091,8061964466330604185,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c393bad-f197-4a34-b844-91c5f26142f0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1c393bad-f197-4a34-b844-91c5f26142f0.tmp
Size 267KB
SHA256 95d1b0f19132fe3ad9c2bd828bc4d172b3a0b1d9363c423c8be8278a19f37607
MD5 b83a730deedfc448cb35dec736ebacd6
SHA1 637fb6df0ea93cf154001bad2e936776f96e9282
SHA512 d1bcc887f74bf38f25202551edb78e6c7144fe0fddfb7bdce4d9586a22fc073869783771aecf8270665055e4dfb83833582333a4251c3b5e745e912bdf901eda
SSDEEP 6144:xwH5lWm1eFCvUdCsJPdGtQyyshbU+hFD+7t56OD9ZfSApprH:xswQeMsdCidGtbysCyFSXD9ZfS45
TLSH
T17F442371B6A1C87FC8B81249F037B614DD619DD090EE4A2F45D69B46A1CFCCE0276A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02c36e86-8892-4f25-9038-a53e77383f27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\02c36e86-8892-4f25-9038-a53e77383f27.tmp
Size 12KB
SHA256 16a97c951f4fc10463ebf3c9607d3814ae1ac6b0b6069c2abed74e977f5402ca
MD5 a8a798eaa3a93a1eda5c13c5184f3fb5
SHA1 b9066e833b8bbf78370db70dc7e2357ff0699b14
SHA512 5cc6329025bd95456b5fa16ba1c6dee42ed80894f10509e84003e7ecdda8e8fb647a2055a6e3a1a9ca4b97ff7ce9019f09f4f311ee6ddac140aaad1755b9a593
SSDEEP 192:1Rs4BpLkMt3Wv7VNDpAPRp289QHsb+WNnI20nq2eeEfap+VyIsnAUgMaJ:1Rs4n7iZxUXDWwx0q2kap2J
TLSH
T19142C42DBE10A53F8CDBD22AFAA67B53D3F4103261952D84EAF9893C14E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65b8dd6f-9f47-458b-84a4-007f320e76d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\65b8dd6f-9f47-458b-84a4-007f320e76d7.tmp
Size 17KB
SHA256 2439b35465e181c81e809dba3b224473beb5a9a7f8231e813d0027175b7f9da9
MD5 779f99a39006c05146c42f6fdc3bfa6e
SHA1 b0caace64ece1d405f10606fd59f2ac3080b0471
SHA512 7b4bae0ba951f22e109e53162ef8a156516849484cdef1634c0ce966484ae02e5310cb5645fbca79800d9f08eeaf06c85e2bc5250bb657e42fb2b97614ed84c5
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3VEHGEtbuwT:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pC
TLSH
T11772F8777C4C9A370FD4CA8DDC167B4FEDB5025A65EA88A442FA982503D4ACF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

850bddd9-49d1-489a-8365-e8d38f08bcbc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\850bddd9-49d1-489a-8365-e8d38f08bcbc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 21b3515726d58c6cdab3f493409071e7433ea6d7f772716ef64af65de2336e89
MD5 f77174939e0a6fbc4d71b8174edb122a
SHA1 ec5dde75dbd4b2c7afe145776fa17ffa492f728d
SHA512 9fdb71612d998b017bdd6fe5ee375ae61299d89fdb65fd543eba26ff55ee45480f4c94a67e1fcd00dac0ab8d138ef3fe63e30a67977a21781def920301a50fdf
TLSH
T1C0B01284C0816301C41202F42151B8C831A8DF11BB09170141F01D89A8361D0902B094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 aface2355509d94cb3ab78aa5be2bd72c21de45659117aa080c8ec6863894b67
MD5 94e0bcf763646f9ccd17c435d3f24219
SHA1 5e8760f13575879c3c963cc1aef87ef826074248
SHA512 4a80736d99746b8eccd2923b79a0c92aad8fac23f8eccdd8a5394c69c3d04ef4f31215743ddfebc781ae561d57a07fe7e7547bf979c47aa36331dee8cbd19f30
TLSH
T195B022C0C2022202E08203B03CE2F0E83230CF22CA03020AE2F02B22CC302B000200A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 328985ffbb141f6078501add5c40c51e6e4721343fecfbeb040d2328fff67e46
MD5 45f7389e12b5b751f7c2c925e72165de
SHA1 4452865070a7a34135c127cbdf297ea7fb1f871c
SHA512 6bab24021ca69425c658fade346f68b8882aa0d1623b72f0d9caa1dd76b07f256080b59d3688a09fe11a3f6f7208fcf9cf9940def7135b1451a725dbcd52154c
TLSH
T136A0025045C2A411ED4047B4B461295263F24E162E53C3075691754CC99B1C2CA115C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e2fe744e6d35a71bcc32431963c7f20f2f8f0ccfe149e72f7fb271667d859f6b
MD5 826f1fcd935cc9cf861ad4a2ea442d5b
SHA1 0083c1641348df74dddb9f9db27a69a66a8b669f
SHA512 20c4e62e5418ad4b9534da0f23dd72ad434c61c8ca61bd87159a3c810914c33087acd08cb353fd71f2809d84937a9ffb814b41f38a383f00df70ff799ce6cd47
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

af779ecc-cbee-4839-8b5b-176f94601139.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\af779ecc-cbee-4839-8b5b-176f94601139.tmp
Size 414B
SHA256 cf82b6e879ad2483e765cbced5f65047b66b8c202337b14f9796f730fe88579d
MD5 df4a13afc3f285251085f4580f92f165
SHA1 a051ea900db8a49b40c8ad76e84bae6270e43d5f
SHA512 914826e888ed00ac188c1dcc48f6a20f2f0b810fd090d832a4436efe036eec314fdf67cbee859132fe6632bf16c9a813ec316fae628203a180816980ff9c4911
TLSH
T10AE0A2A8D822EC3B0DFC071C60A44646EB2003673A82580F3A3C920C8FB022A00878AC
MD5 SHA1 SHA512 TLSH

Submit Download

b71ac956-bb23-4862-90ed-c968872afe94.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b71ac956-bb23-4862-90ed-c968872afe94.tmp
Size 13KB
SHA256 47569f4f331e9a6fc34fd03d53b19ae00da77c74590edb4c7b0ed2d992f97393
MD5 33a017092e34aa7f21d5026efc0bd361
SHA1 581d75adbe07674e163f9421fd05ad7b7f24eab8
SHA512 306cc3a3fa9f375f1bd13bee10927adbdbb63b6d4dff01ce76b77930fad259d080ac7b2d5bba6b89a3ced745b1acabfc48819b978b4564618564a2e41fc4072d
SSDEEP 192:1RMcBz4BpLkMt3Wv7VNDpAPRp2hau9QHsb+WNnI243Vejq2eeEfaj+VyIsnAUgWK:1RMmz4n7iZxUXeWwxCem2kaj2n
TLSH
T13552C62EB910A97F9CDBD21AFA667B53E3F4102261952D84EAF9893C10E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d547f5b9-5743-450f-a6b7-adfbc0d9a093.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d547f5b9-5743-450f-a6b7-adfbc0d9a093.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f70cc855-af32-4258-8831-7c18c252d746.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f70cc855-af32-4258-8831-7c18c252d746.tmp
Size 130KB
SHA256 971cf85124688f264abb38bfb8c8a5715da608942848301dc5da3dad775d01e9
MD5 d561631a5fe968f965ebefdafedcbefc
SHA1 f7258ee21afffc9c9a1b4a33ccafbd344317299f
SHA512 16e324942f88a2c786cdfbb763e377d3b59554027b32c8262c5900c8d80afdbd1fcd7c3c6f5bb854350c6ee32d9debf099921ee06c7121d627cec350a8e5bdc5
SSDEEP 3072:6+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:6+hFD+7t56OD9ZfSApprr
TLSH
T17FD31233AA95D9BBC9BC6541B157A300DE76A8ED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c7759c5-5cea-40e1-979b-6c8185dfd458.tmp

Path C:\Users\Admin\AppData\Local\Temp\1c7759c5-5cea-40e1-979b-6c8185dfd458.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1696_1374637706\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4832-11-0x0000000003DD0000-0x00000000055FE000-memory.dmp

Download

memory/4832-9-0x0000000003DD0000-0x00000000055FE000-memory.dmp

Download

memory/4832-8-0x0000000003DD0000-0x00000000055FE000-memory.dmp

Download

memory/4832-5-0x0000000003DD0000-0x00000000055FE000-memory.dmp

Download

memory/4832-1-0x0000000003DD0000-0x00000000055FE000-memory.dmp

Download

memory/4832-2-0x00000000001A0000-0x00000000001A1000-memory.dmp

Download

memory/4832-3-0x0000000000020000-0x0000000000021000-memory.dmp

Download