bb11f38b317760a71299385b14544cae946cd4edc149050621e0e78f913acf36

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kettlebell_for_1_inch_diameter_hole.zip
Size 3.3MB
Sample261015-ynf7raea44
SHA256 bb11f38b317760a71299385b14544cae946cd4edc149050621e0e78f913acf36
MD5 932d3139020e6240cd8ee99187ee0900
SHA1 59cc97db2a1976c4152c68e58cb3cc8b167218c9
SHA512 219eaa3119cbdf867152d59f18d556a775079dc4fa7275bb1e3efaeea0b4383630562e9db7f7af8138d0c375e4c1667eac39b9233d7221b973d5b53536ea3e07
SSDEEP 98304:TgttPfdnhSMuI7bo3bZknsLdIW/mEkurwMd3Gq5:TKfdnsMDkbZkned+KBL5
TLSH
T1F6F5332B00FD56B3F6A3E5FC4E4F22627571BD69D077866A2991C90772B24B5C2C028F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
5680	chrome.exe
5680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4708	3260	chrome.exe	89
PID 3260 wrote to memory of 2860	3260	chrome.exe	90
PID 3260 wrote to memory of 1132	3260	chrome.exe	91
PID 3260 wrote to memory of 1132	3260	chrome.exe	91
PID 3260 wrote to memory of 2352	3260	chrome.exe	93
PID 3260 wrote to memory of 2352	3260	chrome.exe	93
PID 3260 wrote to memory of 4808	3260	chrome.exe	94
PID 3260 wrote to memory of 4808	3260	chrome.exe	94
PID 3260 wrote to memory of 432	3260	chrome.exe	95
PID 3260 wrote to memory of 432	3260	chrome.exe	95
PID 3260 wrote to memory of 1200	3260	chrome.exe	96
PID 3260 wrote to memory of 1200	3260	chrome.exe	96
PID 3260 wrote to memory of 5096	3260	chrome.exe	97
PID 3260 wrote to memory of 5096	3260	chrome.exe	97
PID 3260 wrote to memory of 4100	3260	chrome.exe	98
PID 3260 wrote to memory of 5592	3260	chrome.exe	99
PID 3260 wrote to memory of 4508	3260	chrome.exe	100
PID 3260 wrote to memory of 5592	3260	chrome.exe	99
PID 3260 wrote to memory of 4508	3260	chrome.exe	100
PID 3260 wrote to memory of 5348	3260	chrome.exe	104
PID 3260 wrote to memory of 5228	3260	chrome.exe	106
PID 3260 wrote to memory of 5348	3260	chrome.exe	104
PID 3260 wrote to memory of 3624	3260	chrome.exe	105
PID 3260 wrote to memory of 5228	3260	chrome.exe	106
PID 3260 wrote to memory of 3624	3260	chrome.exe	105
PID 3260 wrote to memory of 3864	3260	chrome.exe	108
PID 3260 wrote to memory of 3864	3260	chrome.exe	108
PID 3260 wrote to memory of 2100	3260	chrome.exe	107
PID 3260 wrote to memory of 2036	3260	chrome.exe	109
PID 3260 wrote to memory of 2100	3260	chrome.exe	107
PID 3260 wrote to memory of 2036	3260	chrome.exe	109
PID 3260 wrote to memory of 5944	3260	chrome.exe	110
PID 3260 wrote to memory of 5944	3260	chrome.exe	110
PID 3260 wrote to memory of 2396	3260	chrome.exe	112
PID 3260 wrote to memory of 2396	3260	chrome.exe	112
PID 3260 wrote to memory of 3508	3260	chrome.exe	111
PID 3260 wrote to memory of 3508	3260	chrome.exe	111
PID 3260 wrote to memory of 6028	3260	chrome.exe	114
PID 3260 wrote to memory of 480	3260	chrome.exe	113
PID 3260 wrote to memory of 6028	3260	chrome.exe	114
PID 3260 wrote to memory of 480	3260	chrome.exe	113
PID 3260 wrote to memory of 5004	3260	chrome.exe	115
PID 3260 wrote to memory of 5004	3260	chrome.exe	115
PID 3260 wrote to memory of 5048	3260	chrome.exe	116
PID 3260 wrote to memory of 1220	3260	chrome.exe	117
PID 3260 wrote to memory of 1220	3260	chrome.exe	117
PID 3260 wrote to memory of 5372	3260	chrome.exe	118
PID 3260 wrote to memory of 5372	3260	chrome.exe	118
PID 3260 wrote to memory of 1108	3260	chrome.exe	119
PID 3260 wrote to memory of 1108	3260	chrome.exe	119
PID 3260 wrote to memory of 4328	3260	chrome.exe	121
PID 3260 wrote to memory of 3640	3260	chrome.exe	122
PID 3260 wrote to memory of 2516	3260	chrome.exe	123
PID 3260 wrote to memory of 5680	3260	chrome.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Kettlebell_for_1_inch_diameter_hole.zip
1⤵
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff98907c728,0x7ff98907c734,0x7ff98907c740
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,10200581126225885103,13432741703788232996,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,9500546094827644560,9023262003249801011,262144 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,8180081104528417013,8188230360831414446,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:13
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,2657527189180131029,4519491417641629176,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,13689089581929841682,8032943824124054864,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,3999528470218759112,3703196214614956240,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,17176115932715561607,14104436971862467912,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,9714791430793642582,7529139476067422886,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,11540186437869276835,14538404072288558950,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5520,i,11463899846809186060,2849743932841871208,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5504,i,6566057626169640507,8094480044783313269,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5852,i,1419285815468210956,3880198545043685074,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,13283267256409178690,6757798992709691433,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,13470767618568619469,2300219044584838564,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6224,i,8947244536457980965,16100824346823671268,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5832,i,3761856147634590023,7774884860348200423,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,16574215156194118037,8202673923913443506,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5796,i,10333779888931888231,8287325118013931024,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5480,i,4590987631785233671,12893804225602149482,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4792,i,2307021938446343005,9831891183672769967,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6472,i,3902422278736358543,13691391971049247069,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:9
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5692,i,3720827776045103602,3824423916963922505,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6896,i,8312530392841364976,3258248279336419702,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6676,i,12979368045925326967,11087391819649777105,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6896,i,4713069963901542582,10264263294455641193,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6956,i,713940454744943943,17335294730982505469,2097152 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,1819014756430326782,407930219303915626,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,14948681755525488252,11584299163864570902,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,4424464576348252498,12463518288599756440,524288 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5952,i,10108995919427148302,9034795942664219131,262144 --field-trial-handle=1792,i,1311582768781373518,6601303214942891276,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29a0ed5c-efb0-47c8-a9ef-9853036974e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\29a0ed5c-efb0-47c8-a9ef-9853036974e3.tmp
Size 142KB
SHA256 046c46ae04ba689a41512f22ffb61e56e1ed5d6fe4e11d6450c8fcbece5c22eb
MD5 4ba5693440edf05d079f32e914e4b611
SHA1 1a54f4999c551dfdea55f2f20b7c5c0d94a6ca71
SHA512 864a16fe85b870d74c5f664c56c71efa128ce154ebb9f0f0445b5824ee11b1f3f24eb0639cfa1ac47270a26b1e24326a7fc38c0fe9e79a85ee56ed542a708fb4
SSDEEP 3072:l0810YQBYVrtdTCCXQabNtJcp9/Nnqquw1j1U0o:J1sY9HCCXF78/9qK1j1U0o
TLSH
T190E312B2D930FDD79DD0DD06A0501E770CCC85CA8FA5DD0D6ACA5D99068F3FC86126AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ac60563-592a-4c9f-b4d8-066f44072df1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3ac60563-592a-4c9f-b4d8-066f44072df1.tmp
Size 141KB
SHA256 54385e3e1622f4429cef910f036f86d4ec47e325f8338cbc84bcdcf6883c27bf
MD5 0dbac8f206fac6f3f5df251e957f0924
SHA1 c73b61651a11a945842a02311a8c26ac36b4add4
SHA512 2a77060a9f74540b75e450df878b3981ec93594670b1abb68f8361b603da7ebdc67dde5bccd174f88a942efe9f012754a23ce344b7c43f3638f74798a56e0c28
SSDEEP 3072:w0810YQBYVrtdTCCXQabNtJcp9/Nnqquw1j1U0o:Y1sY9HCCXF78/9qK1j1U0o
TLSH
T12CE312A2D630FE979DD0E907B0901E3705DC45C88AF5CD496BCE5DA906CF3FC86126AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09798dbe-6e3b-4472-af0b-4b4281d0f20a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\09798dbe-6e3b-4472-af0b-4b4281d0f20a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

77c447ba-3c8c-493d-980b-99d89215eae9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\77c447ba-3c8c-493d-980b-99d89215eae9.tmp
Size 11KB
SHA256 f9acd3b4c4b642f72289c943521187d71e7332d664811def0f173c0fc5f64542
MD5 0e645df743e48abaab6a0a6d0f5f38dc
SHA1 91006ff46cd483a59baf5fbf455e82f4bdf76eb7
SHA512 065d31d14d03001d5517db3bb3b6e35180bf4f3a6a440ea07a7298bac80d96d37017066114241c9accda7831b76ba298cc7e3ccd40c3cc8746f80a2daa3c488b
SSDEEP 192:sRBmkArcv7sAPRp2P9bHsb+WNn1i0He2vyUVakweszCoVyIsnAUge:sRBmkmIJX4Bwg0H1vhaRCMe
TLSH
T1B842A429EE10753BACDAC32AF9657787D6F9102271D41F84E6FC896C24EB5CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dfabde0-4974-4403-8253-e6fc89cccff4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8dfabde0-4974-4403-8253-e6fc89cccff4.tmp
Size 12KB
SHA256 81209749a600e6d3647adfa0a08ec1c5ad57ab939901b7032bd4a484eb775fd9
MD5 494cf659038027bae76164738ba6307e
SHA1 cdb29d8509d1d7edd18feeb91608ddff2fc80def
SHA512 3390a5b34ecc1d3f0557f6a1e6c76627fac345b2c6cd767b58d547cef56866b77ba23619d5a79c241ce379b8c002997b4e22803bb74112b3a89a04eb68cf7794
SSDEEP 192:sRBmqAr4v7sBPRpqDQJ9bHsb+WNn1iMvE2Ve2vyUVakwes/CoVyIsnAUgE:sRBmqmkaXnBwgX2V1vha9CME
TLSH
T1E242A529EE107A3BACDAC229F965BB57E6F9102271901F85F6FC892C21E75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 527739c35527e3f2696066ab404bb401e2e166472ee53eed459c70f8f18db3ec
MD5 2628d2cb0b960e34a00aa4f80e0b8c0b
SHA1 8bee2648fa33daebc04ac446f710c593ad10e760
SHA512 0a317898f7b6f3f60769ca8a58ed6838df6d49f4db2f4a8fe38c6e6641d42db411671f04365f7e5734a7d7773c1ee985e608140dfb3aec17998ede9c1772d74f
TLSH
T18DD0128B38C282A1FF81063B278C1D042A2E02EA77212363E1C4B050DC57EF3A07B052
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

49e5a7c7-5974-4f41-88c5-da9f524dd004.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\49e5a7c7-5974-4f41-88c5-da9f524dd004.tmp
Size 3KB
SHA256 5e65d7e19e72d73a42aaccdc177187f6a6e05b86f87512d527448e9df6fda859
MD5 c7090b4e87dd4fd7bc3daa4a51663f48
SHA1 7a546ec5e51ae84e052498e074eea9604e2d122e
SHA512 a5942687cf03226f26c14236ef9427c17714f9345eb64e1c8ac779bceeca8b050310aa4f75ef4439e58f1799053d6977c340e0f63911c4bc107301de2bf4d244
TLSH
T121515AF7C3E4CA6ECD5156F49B157E1FCE2D0A24121C3C2688D4AE5B57E2872D24079E
MD5 SHA1 SHA512 TLSH

Submit Download

af402920-51cf-430b-a41e-b5e53b1fcfc6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\af402920-51cf-430b-a41e-b5e53b1fcfc6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e25f719d-19dd-4d25-bf79-2674aab9e4f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e25f719d-19dd-4d25-bf79-2674aab9e4f4.tmp
Size 3KB
SHA256 f9be171817405c9f5fb3b25ec639fdf4bc0b829142d518db6388431cd25359d2
MD5 7a45b13c6468d614f31d979cae194e46
SHA1 fd5dfa443b364c7f9185ae98d489a19443f8f719
SHA512 beea54df33dd8773e49efd998b30bf0212386087c56991b57ee325d4bb89f882a12de6bba114978784e4e152a511f667f97825d5d1a9a9434f23e46eae121883
TLSH
T170616DF7C3D4CA6DCD5156F49B157E1FCE290924121C3C1698D4AF5B57E2872D240A8E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 26ec8998c0a49cc8977132a8db20b9bbe0bcbacbbc82964ec79b59505ac94f07
MD5 314ed495ca20e35a158953de203114e7
SHA1 674ead3e7a4ee3e16c3b4e9365ec93d07bafa91d
SHA512 094c752aacd4ca031aa655fecd9028b89c32f1fedf625c1bea0074de818d1ef3c2c18b3bfaf7e834a1b088f20f5d794624b96dd50566dbbf9e8a8972beec313c
TLSH
T13EA00260C1C1441AED0197F27561D586269299943755831774972448FC9F1D04535902
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e8edab35d7ea579dabc87770570cd1a02922854a60cdf7bc2e0dcb491c80aa73
MD5 85e676d0dbcea2550dc1e0dc40767368
SHA1 193edf815fd87cbdeb917f2b9d254954b0e15cd3
SHA512 922734f8adc7a307c5e9c78cf98a4e516e6c15723f17f3ff7f5682e1c3a0ab7975c188ee205fbe7c415a42bf635ab0889d33b330e403cd5139122140a7dbabcd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a263dae3-b7a9-45d6-9f73-5fd53cf02019.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a263dae3-b7a9-45d6-9f73-5fd53cf02019.tmp
Size 12KB
SHA256 0fd6dde85639a6d27a9449d9e2df25d7f19a8ae113551792f6933fccc5a39a69
MD5 933cee4f079b27aa5c2f3c8d48bc3190
SHA1 3e068ed90e5424a82f91c5c0f02d9a80b9f7c2dc
SHA512 ec7195b23a68ab6094f1f22092dcb48147ac71c28892d2f7e2b775c16bb6c5357fbc6c4a8278bcd7067dc95abc7417d51d7669ceba15a16297968c13a9ebcb06
SSDEEP 192:sRBmqArcv7sAPRp2DQJ9bHsb+WNn1iMvE2Ze2vyUVakweszCoVyIsnAUge:sRBmqmIJX7BwgX2Z1vhaRCMe
TLSH
T1E5429429EE10763BACDAC22AF966775BE6F9102271941F84E6FC892C20E75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac927f78-60dc-47ab-b8e6-b8122889e66d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac927f78-60dc-47ab-b8e6-b8122889e66d.tmp
Size 12KB
SHA256 3f464044fd83ffe285fa2c839dc9a202322d273c29fcd079d74c04fdba39a4df
MD5 ebaf7b24658cd9ca5028be142c875379
SHA1 7df3c55d586ed3f3bcbc0d3f42d49a6a7c236e52
SHA512 f7aaf4fe4438cc41a85340755e1bb93e0840b1eea7286907a38c39ed3da486d33e070f70ccf6e2840cf44090a2ca91e04e1f30bf0b2d59350c7f6d5a9d50e0bd
SSDEEP 192:sRBmqnr4v7sBPRpqDQJ9bHsb+WNn1iMvE2Ve2vyUVakwes/CoVyIsnAUgE:sRBmqrkaXnBwgX2V1vha9CME
TLSH
T12F42B529EE107A3BACDAD22AF9657B57E6F9102271901F85F6FC892C20E75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6df3cc0-afed-4c71-a35c-7fa139bba245.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c6df3cc0-afed-4c71-a35c-7fa139bba245.tmp
Size 13KB
SHA256 d31bd94121b89fc18ecd32fc3d965dafb34828850b888d96046f841b1a205221
MD5 7d7af2fbef3a31bc29ea46fba6cdc70f
SHA1 6f3c5ff47de1e76f4d98acc304984e90d10f17ae
SHA512 18b20c9e10e1acc4eb9366952b23f54acd4ed88852eb2f3f0cb28a7ccf29adaabccedde032eda01eadf624102e2e12db7f871c4055a1507b98cdd876d809e7a8
SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU3lTHGJ7sXSpbdpiFa1:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOte
TLSH
T1E6521C27A84C993F4FD8DA4CCC266F8FADF5025662680D6492FB9C1903D57CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d17538f5-52b3-4e26-876d-dae771745c9e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d17538f5-52b3-4e26-876d-dae771745c9e.tmp
Size 4KB
SHA256 6d1ad723c1ff9334c96d00e8b83c421f75eae2f642b3e7c1f014882db8a7f960
MD5 af7500f303c93a5a9298ce7d36b7b485
SHA1 c8b05d1e8b3493fdd0b025c1b17e221a9233ce7a
SHA512 e865887f31adbe866db6717bb0b47c8522363c630a9dbf10909a0c3b632b40e004cf2ea9db98e0c188723d5e5692d10b0c5e4b4357b733ea7ff7d15089013107
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5R8DnB6vGyvQH4jYo0bblDv4a:qC0xJPz8/CkqDUDsBfr4jYo0bb1
TLSH
T14BA12B31B8699DB794B6D585B2432A03CF64B197F621AFC0B9DD1E1C14F70F81752A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4553e79-472d-4a75-afdd-09dd887b2b8a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e4553e79-472d-4a75-afdd-09dd887b2b8a.tmp
Size 141KB
SHA256 28a6d6312a587bb95d7119e876984c5d7e1d9b1dd50b3a053fd7ef560c73dd21
MD5 736d1268d3b897b2e621152ab095f250
SHA1 096077b8e97b8f22a8049c20c1bf5a7c3021c841
SHA512 2d202f4884c379936a6cc42f650425d10ab787baf7696ec7d17e6d5e56aab412b6178dbbcb9c9855115f9a036e2aa587342a73ee777def375ad8fd09592479b3
SSDEEP 3072:g0810YQBYVrtdTCCXQabNtJcp9/Nnqquw1j1U0o:I1sY9HCCXF78/9qK1j1U0o
TLSH
T1FBE312A2D630FE979DD0E907B0901E3705DC45C88AF5CD496BCE5DA906CF3FC86126AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef0e63ae-9aa9-428d-a425-9a7128329163.tmp

Path C:\Users\Admin\AppData\Local\Temp\ef0e63ae-9aa9-428d-a425-9a7128329163.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3260_597522341\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Telegram_Money.pdf.crdownload

Path C:\Users\Admin\Downloads\Telegram_Money.pdf.crdownload
Size 71KB
SHA256 d66dd89281821f81049206cfe268a29f60100f2d3a6af2164dcfb6ab8fabb594
MD5 877fec13e50c771a99d94d2ef8a3c3ba
SHA1 d141281ce12d158bd1fd8930a8cde314436dfec0
SHA512 810e60b5abc1479a6d1fa6f51d65a71ba32623239563bd88f5fe51b3f6e9e159175e990a52f6d438fc9c79231da7a6ce2f9b42bb81de6e40e599130b70cc4a1b
SSDEEP 1536:5KN63TGS9BnpO+tZ3ACIdPJHhW5E6RPJ+5DQmTAHDfZb:JTH9BUCIdPphW5NPJ+Oo8Dhb
TLSH
T143639E30F99E9C9CFD99C60EC63A785E0A19B05FBBDC3889016D0E61F1026956B932D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download