39c659d3a645ea0d0c27a04adb7c0b503c14bb5a9fb40cc55698f2cb033d9e47

Analysis

user interaction
yes
max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$RBNEV8F.exe
Size 5.5MB
Sample261011-cta22acy8m
SHA256 39c659d3a645ea0d0c27a04adb7c0b503c14bb5a9fb40cc55698f2cb033d9e47
MD5 d5bf7ea77fb50f59b18dbdac7bdd172a
SHA1 c3650ff22332ca58e893f36dd1b3d7035c5ef7b6
SHA512 be5b8041881b974bcb100a656b3ec5f6d254bff3bcf8a56aca9238f59e6aaaae9428daabee7174ba2b61be032829899b6114a697724877c98878d16db1cf4b72
SSDEEP 98304:nSyCXQ6W2RjeXuIMDDMqAy7XevbU+sOo1:Vc3L7fko
TLSH
T11246BE03F395C1ECC05AC0748356A233EA73F8894B35B2AB6BC45B216E66B909F1D75D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	$RBNEV8F.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	$RBNEV8F.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5904	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\shell\open\command	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\shell\open	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\",0"	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\" \"%1\""	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\ = "Memoria Studio File"	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\shell\open	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\FriendlyTypeName = "Memoria Studio File"	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\shell	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\URL Protocol	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\DefaultIcon	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\shell\open\command	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\shell\open\command	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\shell\open	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\ = "URL:Memoria Protocol"	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\",0"	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\ = "URL:Memoria Protocol"	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\DefaultIcon	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.memoriarbxm\OpenWithProgids\Memoria.StudioFile	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio\shell	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\",0"	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\shell	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Memoria.StudioFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\" \"%1\""	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.memoriarbxm\ = "Memoria.StudioFile"	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.memoriarbxm\OpenWithProgids	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Memoria\\MemoriaPlayerLauncher.exe\" \"%1\""	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-studio	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.memoriarbxm	$RBNEV8F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\URL Protocol	$RBNEV8F.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\memoria-player\DefaultIcon	$RBNEV8F.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	chrome.exe
4248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5656	$RBNEV8F.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 5216	4248	chrome.exe	90
PID 4248 wrote to memory of 5904	4248	chrome.exe	91
PID 4248 wrote to memory of 5260	4248	chrome.exe	92
PID 4248 wrote to memory of 5260	4248	chrome.exe	92
PID 4248 wrote to memory of 1052	4248	chrome.exe	94
PID 4248 wrote to memory of 1052	4248	chrome.exe	94
PID 4248 wrote to memory of 5864	4248	chrome.exe	95
PID 4248 wrote to memory of 5788	4248	chrome.exe	96
PID 4248 wrote to memory of 5864	4248	chrome.exe	95
PID 4248 wrote to memory of 5788	4248	chrome.exe	96
PID 4248 wrote to memory of 5256	4248	chrome.exe	97
PID 4248 wrote to memory of 5256	4248	chrome.exe	97
PID 4248 wrote to memory of 1240	4248	chrome.exe	98
PID 4248 wrote to memory of 1240	4248	chrome.exe	98
PID 4248 wrote to memory of 1544	4248	chrome.exe	99
PID 4248 wrote to memory of 684	4248	chrome.exe	101
PID 4248 wrote to memory of 2760	4248	chrome.exe	100
PID 4248 wrote to memory of 684	4248	chrome.exe	101
PID 4248 wrote to memory of 2760	4248	chrome.exe	100
PID 4248 wrote to memory of 5536	4248	chrome.exe	105
PID 4248 wrote to memory of 1876	4248	chrome.exe	106
PID 4248 wrote to memory of 5536	4248	chrome.exe	105
PID 4248 wrote to memory of 1876	4248	chrome.exe	106
PID 4248 wrote to memory of 4932	4248	chrome.exe	107
PID 4248 wrote to memory of 4932	4248	chrome.exe	107
PID 4248 wrote to memory of 2140	4248	chrome.exe	108
PID 4248 wrote to memory of 2140	4248	chrome.exe	108
PID 4248 wrote to memory of 5888	4248	chrome.exe	110
PID 4248 wrote to memory of 4748	4248	chrome.exe	109
PID 4248 wrote to memory of 5888	4248	chrome.exe	110
PID 4248 wrote to memory of 4748	4248	chrome.exe	109
PID 4248 wrote to memory of 5992	4248	chrome.exe	111
PID 4248 wrote to memory of 5992	4248	chrome.exe	111
PID 4248 wrote to memory of 1560	4248	chrome.exe	112
PID 4248 wrote to memory of 1560	4248	chrome.exe	112
PID 4248 wrote to memory of 1660	4248	chrome.exe	113
PID 4248 wrote to memory of 1660	4248	chrome.exe	113
PID 4248 wrote to memory of 4568	4248	chrome.exe	114
PID 4248 wrote to memory of 3276	4248	chrome.exe	115
PID 4248 wrote to memory of 4568	4248	chrome.exe	114
PID 4248 wrote to memory of 3276	4248	chrome.exe	115
PID 4248 wrote to memory of 5548	4248	chrome.exe	116
PID 4248 wrote to memory of 5548	4248	chrome.exe	116
PID 4248 wrote to memory of 3592	4248	chrome.exe	117
PID 4248 wrote to memory of 3592	4248	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\$RBNEV8F.exe
"C:\Users\Admin\AppData\Local\Temp\$RBNEV8F.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x9c,0x134,0x7ffcd545c728,0x7ffcd545c734,0x7ffcd545c740
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,3094264623131122987,7776536730442535288,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,17434893150747763248,13294319722598956098,262144 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,1565943320863151477,16127973470351979198,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,7407259275033086800,13297649781068780752,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,4326732173082085855,1270492850326872343,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,13871729412365627477,4273309975561489027,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,1083913896879532304,16235408829970835667,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,20339275351940265,315719557471997958,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,18418038341950205491,9607077867279103849,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5508,i,5646246793780542562,10152644560573687540,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,2930222020424045730,15829413783352420340,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5824,i,8060663359405882275,17755836057405438617,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5588,i,5934011360690083602,3385190568778962673,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6316,i,16304313404032865863,14961311025410823304,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5580,i,13457936399911777867,8865656024927484791,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6304,i,11657921664832365464,8247608699751161238,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,633450096912294798,1086681566359569443,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6488,i,16010732929481555671,11386117875698296097,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,15885926700224844364,2852430725903738026,524288 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5644,i,12926081865166241593,3346672676373116873,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5724,i,16997230187133961171,16624837231064620196,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:9
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5964,i,13853761486829881727,12965627919349767510,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5656,i,6052720083228972092,7625908363923301432,2097152 --field-trial-handle=2056,i,2857908382142039396,14970472975272375898,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23f1c0ed-9a9e-40ca-a9a2-98a069894509.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\23f1c0ed-9a9e-40ca-a9a2-98a069894509.tmp
Size 4KB
SHA256 d6dcf96c50212ae91c68d5d14fe32b9e19abe0ba1b11f146b952c0fda7256c8a
MD5 aec7c065a5091794650c971d1e0b3904
SHA1 221ee4328ba9cfec81c14af166fcb61574dfaad8
SHA512 39c2ba5daa636be5b32704bb889564d20ef89cb7cb8bfcd523f18651364a71080f2fc0802c0f93e335e2899e09c177a93663a7e5a0aace9ff738ec9a02679753
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5oAp0cDiB6vGyvtBWG0c73bOv4a:CC0oWqNVVxi+9oP8DUDn0KiDeW9c73bQ
TLSH
T14CA11931A879997789F6D485B1463E538FB970AFA921DFD4E8EE191C10B34EC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35136452-e45c-4efc-8ff6-cfd125ed455b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\35136452-e45c-4efc-8ff6-cfd125ed455b.tmp
Size 142KB
SHA256 e26fbe601cdd29cfb6bc21db82d40027e87cdcf2256db1d5eb7ae9baf28c2e12
MD5 99cff0f03670aaea5aa83ec42f1bd9bc
SHA1 ff6a63aa5fc829bef2ae7ea1a8c66747fa461b55
SHA512 846b7d67a223f9e81b5cdcb943fdb139b860551fa2e29fc827e716db168b08a4ce45e5b829fe345dcd00cebebf35cebe9a32fda3d0753cbf7b3f48c4e09223bd
SSDEEP 1536:oNrhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfWKc:aCOfTORr3x7wQFtDDmyYFoTcze
TLSH
T15DE31271AE3C8B2BE7B7C39EE34F361705F1101772514B9C82EAA9CC53A548E5292C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
MD5 0a5be5c7ba33a6c408691d82d7affa3e
SHA1 dd80476f918154cb44942aa2c9ec051f46116136
SHA512 a8a03053cc90b92445b36b42d8981d02fe131d68edfa6911d6a648f7e0a1f636527df56b572083d39d96fc22e9ad9ddce1f824c8f584aa04165b938020cd20fb
MD5 SHA1 SHA512

Submit Download

22eed9ed-c4c6-42f0-b8e7-17df87b88bf6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22eed9ed-c4c6-42f0-b8e7-17df87b88bf6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 103KB
SHA256 605ef5b5d1192afdd20b5d6446a79647c02b45e64a499a700171aaac708d8a8d
MD5 a05d31c51e3822522459d5d655f943e9
SHA1 6a555b603e18a39c621aebe3b2006fe7ab20d67a
SHA512 669eac43bff374d504efb8ac4e21a460c8896a87d396842ec607a717e1286e66e12d721f142dc796a0d3b48a18948a610cd4fcdbbdc5a10d3b613130995fff24
SSDEEP 3072:Vb3DDi/qylYTW7/WIHkPVuSvvVRTZ1PF+e3g:V7DLylYTsELvNRlyeQ
TLSH
T148A3024389A690638543ED7E446267907B39C9D095C28BBDED3CC28E133F1BD0C8B66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 69e05972c463458585598cdba7b0abe75624146d66e7b70dad55f4b8742cba4f
MD5 200c4a44d6adcc08e8b1d40124579e25
SHA1 dbb45c95e20b6c87da26becd766fba24136d0070
SHA512 d56ea674510a4137119fd465b070680eddb27cf5e8987cd09130abf362fb0aec2e0df297a4852a594fcecbc3286deca63de088ceaf21b7efc526ed4a52c96e90
TLSH
T10AB012FC42D00E0CEF002E33C55094412062090F1452077B70E0715C846B3D10750050
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

06c9cada-4600-4c13-96f5-b816648eac04.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\06c9cada-4600-4c13-96f5-b816648eac04.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

54b15083-06b9-4b88-9c9d-baeba40c3372.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\54b15083-06b9-4b88-9c9d-baeba40c3372.tmp
Size 4KB
SHA256 e3711bd40380c39b59cb891c5b751fce6963627ebe1608ebc9f9f427c9edc5a9
MD5 70037798b04b182ff9d05c9bebd83a1a
SHA1 2e5d50f1efd195a002e8c2c98f89032f887d5faa
SHA512 b76539cec860b117f600e31c74d528ff8439c62dea992fa996165a3d3410da46c375aca043b40bece0c342601cadca501eeb799cf0612a98fcfc9cb307dab657
SSDEEP 48:YALlqSqdqjhuVSoVuVUszfoKsH4snRsAfstosKKs+HOBasxwzsPLdsG8bsmpsnmL:D/eOM9A1cnLo60Huzph8XEU1
TLSH
T1DEA1CDB3C3E8D62DCD1156F5AB24AA1BCE290A5852283C26C8D59F4F93E6472D34178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4056876-a8ae-4ef8-9741-f492ad4743e5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d4056876-a8ae-4ef8-9741-f492ad4743e5.tmp
Size 858B
SHA256 ae24761ca6f476260699b1f5d5a18128c19034ecce5f560b63edad5951faf5a2
MD5 f7316aca3d10baf093975097f4d5425e
SHA1 59357577a134b007184c3b556d9851dfe266b0fb
SHA512 cca562010237968f12c7cbd414b0f15c1b04cfbd4a74350a7893ef9affc3f1a4f97b89d675779584eb83a8fb7e656f94468adcc82f45b645801ba73c62626452
TLSH
T1B211CCABA23E747710AE86270C30B8052ABE703102415CF5EE87835CA0944F31F16893
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9f002e61720f3e9206574ec6cb62a4b6195767422526c0a35746dc7a8768b234
MD5 902c63fc6d0182f24e642d0c13757130
SHA1 892a2d33b3a7dbb7dda10941b9869fd9871a1208
SHA512 79cbc70db4228b62e9d2edc116262a2d67ee481b524e00ca18b3eebf83cc85022aa5199dcfa009521b0f4e5abbc02c869c03cd214cb089a799677ef3623ac97c
SSDEEP 192:gRBoh4v7RAPRp2GXsb+WNnXoe0QTkJ3bQkw1aT+iyIsnAUge:gRBohkAXlXwXH0QQJrQVare
TLSH
T1D232C62DED24B63B9CDBC229FA623757D6F5103134902E84E6FD892C15E79CC6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 55630366581db2ca14e86551c8a895e07bbef4e2cdf145a16b5f59b82426a1a8
MD5 13a9c2d31fddb751fc668bc7e6139a86
SHA1 581c9364713d004fa90cc8dc05e0e2bd300e5ac0
SHA512 72281e1b2e384aaf251addafacf5c9a919c8f6bc893c545f36a22f3b24f16c559287e959b1ddf214319f7f2b71c40ed8ec34f737bb6f739efc6378ce9023dc2a
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 5d21e0674d63010fbb3f4ff3509b26361d2aae08ebf2f7f27c86b80f50285af4
MD5 25bfb59adb53df1fbac694f2178ae9c4
SHA1 bc97249d2dd26c649c808d5c5cb08ddcbc7fcfbd
SHA512 2d3492b8f018e7b30f7fba95b51ee682daa9f9bc0bf69f2210ec420375f074d74380858703373f67e98f09c20dff0ce2d8e3cd32297ca14b9fb9d0688489a4dc
TLSH
T105A0027149C41C24CDA149776463464522454C1C6490875345B125A8C85B5CA419A511
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

f5be0c7d-389a-44aa-9aaa-98215f56bb2c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\f5be0c7d-389a-44aa-9aaa-98215f56bb2c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a8026333-1d76-4925-a861-094ed4fbe472.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a8026333-1d76-4925-a861-094ed4fbe472.tmp
Size 13KB
SHA256 55ec0ac9d436bfa78e05e1a826291bb449d49e35d357dffc0d8d8138384617cf
MD5 fd96c33bacda9dbbf72cc5ebffb938aa
SHA1 462dc2fbd3fba05dcb0fd46f25a2a1e742d908f8
SHA512 7f5d5042dccd4a0b608830d5f7175b6a5f48786c32696050b1475ee04040351efb6683b78145dfe52061be354217ecb8a8f2a1e16217dc2f413976ebe4d52d36
SSDEEP 384:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFXODYX+ErU3U5HG8xpkkwlF+N:ugYb7KxkXqKf/pUZNCgVLH2HfgsRBOED
TLSH
T1F852F86B644C9A3F0FD8DA4DDC177F4FADB501466668096887FB9C1803A57CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1a41bf4-e7a2-4a6a-8604-e938563304af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b1a41bf4-e7a2-4a6a-8604-e938563304af.tmp
Size 142KB
SHA256 de2024f1bb3d6f3bd2915f6ac18c38a67857cb311335925d4037d226ccd318da
MD5 7bde17cc20eddd43b07a8b3847902d1d
SHA1 d9127a11d9de8ce8ef365bfe7545bca96a14cbe8
SHA512 4b106a2679d44eecec15154f5a11982bf0dd1a5208bac042a77d4ac147f5cb5527e0effc9bea8839d615d38c012385780e39e2a5a9e75c202a984f61bc7990fe
SSDEEP 1536:o8rhQ3e+eiZEfNswA1i7aFoeLhzvrTzlfLbxWHimKYcXD5o6DRtDDmtXEjpYfWKc:hCOfTORr3x7wQFtDDmyYFoTcze
TLSH
T180E312719E3C8B2BE7B7C39EE34F361705F1101772514B8C82EAA9DC53A548E5292C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8deb5677-4bd4-4c9b-a2b5-062256045602.tmp

Path C:\Users\Admin\AppData\Local\Temp\8deb5677-4bd4-4c9b-a2b5-062256045602.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4248_2143801494\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5656-0-0x00007FF65FE60000-0x00007FF6603EB000-memory.dmp

Download