47571902699682109a1c251b50c82f71e5ad82978a446f191fc6a4e6afded984

Analysis

user interaction
yes
max time kernel
182s
max time network
185s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Captura de tela 2026-09-12 225825.png
Size 188KB
Sample261024-29qvvsga25
SHA256 47571902699682109a1c251b50c82f71e5ad82978a446f191fc6a4e6afded984
MD5 a2eac898fa6d6ad3fa753e4583d2c41d
SHA1 3905020873ccf9c68b61554b3f295a74769da7ac
SHA512 501d46a16f7166773c915bbbf301006ac5276bf55120e793929f868eb643faa69b4093e65e36baf25720f574d14ff5e317507e768a7b38685798442d75b060c7
SSDEEP 3072:zyNNUOHo0TSX0FfPVkQQ7FxM7thiN13XrMnsSnLYaShoY0adPgT7ZsEnkM5iguLo:GU4mkFfGQQZxQ7iNN7qTFsEnkM5iR1Ty
TLSH
T19914020CC893C131CF6F64393D692D99B3F7142E51CC1E358A788B2DCEEA597624A3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4256	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4124	mspaint.exe
4124	mspaint.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4124	mspaint.exe
4124	mspaint.exe
4124	mspaint.exe
4124	mspaint.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 4960	2200	chrome.exe	93
PID 2200 wrote to memory of 3644	2200	chrome.exe	94
PID 2200 wrote to memory of 3644	2200	chrome.exe	94
PID 2200 wrote to memory of 4256	2200	chrome.exe	95
PID 2200 wrote to memory of 3248	2200	chrome.exe	97
PID 2200 wrote to memory of 3248	2200	chrome.exe	97
PID 2200 wrote to memory of 1936	2200	chrome.exe	98
PID 2200 wrote to memory of 1936	2200	chrome.exe	98
PID 2200 wrote to memory of 5924	2200	chrome.exe	99
PID 2200 wrote to memory of 5924	2200	chrome.exe	99
PID 2200 wrote to memory of 2936	2200	chrome.exe	100
PID 2200 wrote to memory of 2936	2200	chrome.exe	100
PID 2200 wrote to memory of 2864	2200	chrome.exe	101
PID 2200 wrote to memory of 2864	2200	chrome.exe	101
PID 2200 wrote to memory of 3020	2200	chrome.exe	102
PID 2200 wrote to memory of 748	2200	chrome.exe	103
PID 2200 wrote to memory of 4728	2200	chrome.exe	104
PID 2200 wrote to memory of 748	2200	chrome.exe	103
PID 2200 wrote to memory of 4728	2200	chrome.exe	104
PID 2200 wrote to memory of 1920	2200	chrome.exe	108
PID 2200 wrote to memory of 1920	2200	chrome.exe	108
PID 2200 wrote to memory of 2520	2200	chrome.exe	110
PID 2200 wrote to memory of 2520	2200	chrome.exe	110
PID 2200 wrote to memory of 5604	2200	chrome.exe	109
PID 2200 wrote to memory of 5604	2200	chrome.exe	109
PID 2200 wrote to memory of 3664	2200	chrome.exe	111
PID 2200 wrote to memory of 1676	2200	chrome.exe	112
PID 2200 wrote to memory of 3664	2200	chrome.exe	111
PID 2200 wrote to memory of 6080	2200	chrome.exe	113
PID 2200 wrote to memory of 1676	2200	chrome.exe	112
PID 2200 wrote to memory of 6080	2200	chrome.exe	113
PID 2200 wrote to memory of 1396	2200	chrome.exe	114
PID 2200 wrote to memory of 1396	2200	chrome.exe	114
PID 2200 wrote to memory of 5608	2200	chrome.exe	115
PID 2200 wrote to memory of 900	2200	chrome.exe	116
PID 2200 wrote to memory of 5608	2200	chrome.exe	115
PID 2200 wrote to memory of 900	2200	chrome.exe	116
PID 2200 wrote to memory of 4996	2200	chrome.exe	118
PID 2200 wrote to memory of 6044	2200	chrome.exe	117
PID 2200 wrote to memory of 4996	2200	chrome.exe	118
PID 2200 wrote to memory of 6044	2200	chrome.exe	117
PID 2200 wrote to memory of 3916	2200	chrome.exe	119
PID 2200 wrote to memory of 3916	2200	chrome.exe	119
PID 2200 wrote to memory of 5836	2200	chrome.exe	120
PID 2200 wrote to memory of 5836	2200	chrome.exe	120
PID 2200 wrote to memory of 4892	2200	chrome.exe	122
PID 2200 wrote to memory of 4892	2200	chrome.exe	122
PID 2200 wrote to memory of 1592	2200	chrome.exe	123
PID 2200 wrote to memory of 3776	2200	chrome.exe	124
PID 2200 wrote to memory of 1440	2200	chrome.exe	125
PID 2200 wrote to memory of 4276	2200	chrome.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Captura de tela 2026-09-12 225825.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffac17ec728,0x7ffac17ec734,0x7ffac17ec740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,15796584070473085567,15127752542435060729,262144 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,18106326832086584424,8174408290357579279,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,6568873391103677894,1623164339595474054,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,12164261679751491661,10249641672508670098,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3320,i,12947777735646783169,9770341872550789054,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4616,i,14979640644800930076,7856276108489513358,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,3981722409277714026,8648453625848457518,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,15316299554526225420,6695215561223400648,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5528,i,14196609225963811563,12068233556886208658,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5548,i,60774835462467998,13038322485155198563,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5732,i,14924413562730493375,8731932331152769257,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6040,i,1840134235316004761,8430522889562626885,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,18117179585400462952,9566778773106785011,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6292,i,8035528699219994257,2166270981504737397,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5436,i,17138278689752395062,7827614293875140339,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,3845411619339057630,17058007422233080047,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6360,i,13159309340083939084,14323147893422699934,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,6922689591450744858,6314583563799557651,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6388,i,16473694735113917039,4034065807421652373,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6404,i,10027271108026881513,15263190588907964232,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:9
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5652,i,6676807890531711569,16847757923294875805,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5660,i,5324828034017248590,13871925424902184758,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3544,i,13133858014690080905,10637935374207019021,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5556,i,8659367857450814250,13739112683175531519,2097152 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,556125127048982071,6060802787204526970,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,12714389210175310602,80851281049275209,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,5965636383312926403,8242980751291687131,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,16792059182587592560,3040706988075106134,524288 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3856,i,4675519764725695750,5991509882884007242,262144 --field-trial-handle=1796,i,16227565385292624502,6812429429335390941,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
  2⤵
  PID:3388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5404

C:\Users\Admin\Downloads\LAVOICE-H2-Windows\LAVOICE\LAVOICE.exe
"C:\Users\Admin\Downloads\LAVOICE-H2-Windows\LAVOICE\LAVOICE.exe"
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5dca4759-497b-4a35-a5c1-aee6b1a229f0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5dca4759-497b-4a35-a5c1-aee6b1a229f0.tmp
Size 4KB
SHA256 6006bce4bab7f295f5b320925f0d31363a1445ddc2eae4e153f22cfd776dd029
MD5 66ba533ed8626a3f2528dd5d736935ed
SHA1 97d0a193353ef1962d654ef1ccb22520305d652d
SHA512 50e651ec0815cf470ebf8b9e02c6dcb7ff0a6643cb001b92acd3f96b1056d3e230a600ba0756731a5467db4c068636a7e5eaf8b956ea699f8f8fcafd46828136
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5fp0cDHB6vGyvtBWG0c13bOv4a:CC0oWqNVVxi+9oP8DUDR0KhDeW9c13bQ
TLSH
T126A11931A869997789F6D485B1462E53CFB870ABA921DFD4E8EE1D1C20F30EC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84ad9295-c13f-4de5-b3d7-e3ae79465416.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\84ad9295-c13f-4de5-b3d7-e3ae79465416.tmp
Size 144KB
SHA256 e233c88221b9c47ab4c347e1dc96729df51be26e6ed15379e9e3388ba6ad47e5
MD5 be7d5f07ff380694aca6ca791bdaf4d4
SHA1 75a11468345df761ea0a689703dae5cb5bac12bf
SHA512 4354d9d7551b47b5fba36f26c66e4e0fc46a78c7f68c5d6e9c6f68871da26d3c9c2522b959e2f8872c1848d6e9db4f34e463883557371dda835b0e5f8eede06c
SSDEEP 3072:8VHCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mzz:8VHCsUfw5u7eC94LUX4rY7Q/Cz
TLSH
T1DBE312F19F2F284A2FF48A1E7116370A0FBDE6A3ED0C5489C09E3917319E396854B256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a23ff8d-1ea0-472d-b1a1-5a1472ddb60f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2a23ff8d-1ea0-472d-b1a1-5a1472ddb60f.tmp
Size 13KB
SHA256 d116314580d6d408e8b36baf37af17d2b23e40d36847993e8e91e83965ba8ebc
MD5 982960ca301ff5007f9eac572dc43845
SHA1 80700c10c3196d952b49511f63ba319cfa13f58b
SHA512 ff862ea4c48dc056b54fedae96b81d96d95fee9ba5f57423aa4266298900613ce4f4b5b6dfd467cf7d6028567440286c0cfadf562e4af10a4cf674ebc366efec
SSDEEP 384:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFXODYX+ErU3aXHG8x6vkkwlF+/:ugYb7KxkXqKf/pUZNCgVLH2HfgsRBOE4
TLSH
T1DF52F86B644C9A3F0FD8DA4DDC167F4FACB502566668096887FB9C1803E57CA110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59303b96-dd8f-4fd2-adbb-2aef99ef0e15.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59303b96-dd8f-4fd2-adbb-2aef99ef0e15.tmp
Size 11KB
SHA256 9bda3aa7e90cde0b137a232166bd6d93946d8efb1e7ce0c9b5b1392a7d9476e2
MD5 d60b2d21adc1b10a56cd2632e9015bae
SHA1 605622abb2788b3c6a7202117b84f82abf3549a5
SHA512 cd10f89c58996161e9e6aa623b92aa68d7723548daf20112278f4e69f4397877ca3e9d1f2a6cfc38d091e7a2a94c637c054de9c31b832e4224b9089462b8ee47
SSDEEP 192:fmdRyiWl7cN0wv7VAPRp2GXsb+WNn/T0mHwGzIkw/YiyIsnAUge:fARjWl7cN0skXlXwL0YwoIhe
TLSH
T11C32A52DED10793B9CDBD219FA227B57D6F5103174902E80E6FD882C15EB9DC622740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e6081c1-907e-4e02-a1fe-1d89a1f938c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e6081c1-907e-4e02-a1fe-1d89a1f938c6.tmp
Size 12KB
SHA256 bd89baff3c5c4f77954dbb41d34c70ae8acd4d4828e03d3a45528b38eaecc82f
MD5 d06d6c810970453ff9c192d6703c2969
SHA1 e681bd84fcebbe2e2437b32b0304af9a71b63c76
SHA512 c1bbe80027a918ef5c0290441cc751fa797f44e3f79c3c3e14001df7790a49b2de5dd4f3c5199b1f0179e4b7a16412727831ff17633f3639dfd2c45b4617c177
SSDEEP 192:fmdRyycBzWl7c8wv7V3PRpzXwrl2Xsb+WNoJ/T47n2BHwGzIkw/8iyIsnAUgE:fARfmzWl7c8s1X3XwsE2NwoIlE
TLSH
T13242C66EED10797B9CDAD219FA227B57E2F5203274902EC4E6FD882C15E79CC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de331f8-1c12-4e54-bd06-863b3ac7b318.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9de331f8-1c12-4e54-bd06-863b3ac7b318.tmp
Size 12KB
SHA256 b57f29f28e16da4cb73613f128647ab016d0f6fa7e1c014913a7499654223b2b
MD5 3e39e1968f9f3479918edc7c4d8d4e9a
SHA1 c6341cf9416dbc508b031cef187695b467336dc7
SHA512 1b3219572d1cdcdb3b08052d976b43882958b8767ea2ad37ada17274417e64f4231f290567d848a7110ca94878d4648877dc54755a9c31ac11bf1c65b396825b
SSDEEP 192:fmdRyycBzWl7cxwv7VAPRp2Xwrl2Xsb+WNoJ/T47n2qHwGzIkw/YiyIsnAUge:fARfmzWl7cxskX0XwsE2swoIhe
TLSH
T19D42C66DED20793B9CDBD219FA227B5BE2F5202274801EC0E6FD882C15E79DC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 768B
SHA256 dabf084d6aa693a5baacdef592f4fa16c17d148c009b2d07345c821de1b5d29b
MD5 ef51a5a403e48b2bfba0751944d17f8b
SHA1 194d3518c4ecc2ed7a18dc9b006d2138d5f9d20f
SHA512 b8266ed5219bb4889bf9af0e2fc72fda483886cd1e6838f42b29908ce7348daa4cb50f0847039c2dd15f1672a94923009dee6270cd26030e836523f3e440588e
TLSH
T1DB018BC2F1C30C8CFFA2467418FD0C52564D469747422BEE93518EB3D8C2B7B5E01489
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

11f2860c-31a6-4e58-a4d6-883f045efa58.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\11f2860c-31a6-4e58-a4d6-883f045efa58.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

3abd5491-9d19-4515-a7e8-223fa3955e7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3abd5491-9d19-4515-a7e8-223fa3955e7e.tmp
Size 7KB
SHA256 3c0658a681fc3abf1e92941ece1130aa24beef3bc7b887510cea06c91a840490
MD5 9c18d6754fe88e66197f7312c8db0f91
SHA1 c92b9f8c5ce25bdad6dccbcae408e29baf132bfc
SHA512 961812d62effb93c4a95928eb46f68a18b894c4ad1c1bd65eee4d9b1162d0ab0580097155f07af1d3c3fd0ca5f2d176d88652ed52fc6a15b23760f7c8ebfc045
SSDEEP 192:DuzSGo7UFjuJjQj3juaEN5kO/WhjRNPl6Vjm1jXj+jhzjhijh9vjSjbjejB9:Duzro7UFjWjQj3juaEN5kO/WhjRNd0jy
TLSH
T1BBF1AEF7C7E8852DC91256F4AB117F3FCE290A59432C3C1689D8AF5B93E1871E25068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4b25f66-f615-4ca7-b340-672bb987a90f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b4b25f66-f615-4ca7-b340-672bb987a90f.tmp
Size 7KB
SHA256 b79840299b20524ea10aa8a3c8064b946ccb48e545c496ad9e576aefd8422204
MD5 009daadaa158706172bb485f8cd816cc
SHA1 d90a518f720d5d0c6b949fa7eec6b4a4785b00b6
SHA512 a0bc1fcee9f33307a7bdf4c4f5990ebfdc4946e3f1ce15e45a8cac1bfabaa4072409d93ff896563a5504c5d93c67109dc06d1aa4704685a27f0b900a26c8a75e
SSDEEP 192:DuzSGo7UFjuJjQj3jm/aEN5kO/WhjRNPl6Vjm1jXj+jhzjhijhKjSjbjejB1DW:Duzro7UFjWjQj3jm/aEN5kO/WhjRNd0w
TLSH
T1A4F1BFF7C7E8852DC91256F4AB157F3FCE290A59432C3C1688D8AF5B93E1871E25068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 b6b27623d0bb5d00eeeff15b066507b95d6ebd8ce3b6932a02dd58a09a940546
MD5 e558ad875d10384514b44f2d1d34ceb4
SHA1 4b3c3f00bf9df9b0589a35b65e01077873a6a663
SHA512 e586c4b9474280a8f34c870cc30c7d8bede3e743129abbb0dd56cec122810f36f3d042ba940c490521984cbce7dca7b5e9cf6427226ba374502851468a2dc331
TLSH
T1B3B002DC59841903E5E5EB7166E258D633331E26EF478D1346E510F8C9127474331700
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 eb5532da36a533ae9056da49c9cbe37c641550755962c19dba435e7058f3c639
MD5 a16a6e437647205ce4b9b965cba78e4d
SHA1 7fa3dac573feccc6953349ba53eed705d1454191
SHA512 2e353a9ddfc4e6a5b395acd66e57f6fc12e5cd59614ec0713d5722a57e38c920b002c209001c6e09d48ef1b926fa2f9e42d05ecc4580759ccafcc8889a369d0e
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 a5983fc4df07774430e75f42a962a39ae70be94db4fc65487bb52b4a0c5e9c66
MD5 b23a240ea2323a3c34e3e43787146e06
SHA1 72b0334dcc7efd7f9b724c1cfed2a4b3bd9ac9c3
SHA512 62f8fba5386c11f9eb9fe29af96d4eb0f62a7429c5b9f36ce6a9c03da774025debe44e403f637d8e5b0dcdbaa85e67f509f1d6cc4e93f29c17e44000f3770f4b
TLSH
T192A002A0D1C644A5CD0087707069164536668C1869969B0757F504F4A99F1D0A126114
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

c0393b79-24ae-49ed-bec0-57a8f9183da0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c0393b79-24ae-49ed-bec0-57a8f9183da0.tmp
Size 12KB
SHA256 17315519d6d8f917fd9a4231b6f2b3c6c54e803e6bf37398b507c6f8f29e0617
MD5 1af44c9167a014f8883a950e10d51002
SHA1 d421a804dedfebe17e18abf33437978396f5a5b4
SHA512 b53b5a9b89d8059ee742c278757551a3409b4a4816400689c403cbcbb6c419f40252cae12322eebc446282d3023e2f33803229fcc719dfb38a1c2cdcc5d01f0e
SSDEEP 192:fmdRyycBzWl7cGwv7V3PRpzXwrl2Xsb+WNoJ/T47n2BHwGzIkw/8iyIsnAUgE:fARfmzWl7cGs1X3XwsE2NwoIlE
TLSH
T1F042C66EE910797B9CDAD219FA227B57E2F5203274902EC4E6FD882C15E79CC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1352d13-345a-4aee-997d-1d61bea11e75.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1352d13-345a-4aee-997d-1d61bea11e75.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c3e84a6c-cf71-4763-8413-a7f8e69821d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c3e84a6c-cf71-4763-8413-a7f8e69821d3.tmp
Size 12KB
SHA256 0e0d001740b24f259d41f2f62967b7b84e8e59315f3f24c9fa4fc35960ea4f7e
MD5 b7b8d32f0fd4bbe64c2caeccd69a5449
SHA1 f0cd7a77809456cfcca99eb68d857f5c19e68c8c
SHA512 2d3489f036e7fc9fb2f8e391c430ea65822d56490ba9290b193c2d16d9ec895a6e2739ea64aef3e0ff213b284a5d1b7a77e4b546bc2ad34b49093fe715b1a1f2
SSDEEP 192:fmdRyycBzWl7cDwv7VAPRp2Xwrl2Xsb+WNoJ/T47n2xHwGzIkw/YiyIsnAUgE:fARfmzWl7cDskX0XwsE29woIhE
TLSH
T18442B56EED10797B9CDAD219FA227B5BE2F5202274801EC0E6FD882C15E79DC621B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba689934-037a-4b28-8aa4-6ce076dd9bdc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ba689934-037a-4b28-8aa4-6ce076dd9bdc.tmp
Size 143KB
SHA256 c49e94ffe2874d3d3dbe3eb23d70f76a950c830545c5367d12e6663c7e8fe727
MD5 850aba72ed43ea597fe4fc93fa8ae219
SHA1 1833be172a82e644d1829d9dbc8e7e1a8427a343
SHA512 606bd0fe98364645e76c444474efc092cefa2bbdff337d69da33279152ca13899e46325fc49fc4da891feaa42697d44f99ca0b22068d87637a73237f208515c9
SSDEEP 3072:AHCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mzz:AHCsUfw5u7eC94LUX4rY7Q/Cz
TLSH
T1D1E312F19B3F285A3FF88A1B7526370F0F7DD5A2AC0805D9C0DA291731AD7D6825B216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfb7ff20-099f-4312-982b-83b1beede30f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cfb7ff20-099f-4312-982b-83b1beede30f.tmp
Size 229KB
SHA256 689f0dea749d93184c0607fb39f85b95c785dde22356cf0db2d0f097236c562d
MD5 abfd50e2400b1f7298039239a6b723a3
SHA1 3cf29c0bf87b1ed1fbcba91356050fac19d8ec83
SHA512 d89417ee0b8da1908678485d852b55eda28ba663be683de36c09b331404223f4e9520bde7acfdaffab027eca12df362d522ccb9ce77344d85798aa9c4cd47c2b
SSDEEP 6144:dYqU4n1o4rny+8HCsUfw5u7eC94LUX4rY7Q/Cz:3y4Ls2w5Ee5Hraz
TLSH
T1A73422F64F2F25691D68861E701B330A0F7DD653FD8CA9C8D0D86D43209F2E68A5B626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d214cb11-80ba-4d30-87b1-f2b9901a094c.tmp

Path C:\Users\Admin\AppData\Local\Temp\d214cb11-80ba-4d30-87b1-f2b9901a094c.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2200_449004326\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

0cc05b568bae975ea4e42984b0a45fd7259b8b9d.d3d12.cache

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\LAVOICE\shader_cache\SceneForwardClusteredShaderRD\113a20f7d89cf02f0953bccc0dc86e2e04bd93a8004a5e34c1ca5362e01314e0\0cc05b568bae975ea4e42984b0a45fd7259b8b9d.d3d12.cache
Size 206KB
SHA256 81b66b4627e67d45931d16ef13958943f3fe3892517232c78ee86c35b720c149
MD5 11e8665a4f27cd6b1c93208e2836c59b
SHA1 d0365e6145290de2416f715ebe30eb2d82940a3f
SHA512 77d672fbe65039ba62be8dae0ab1c96f3bbe10787b0f55bae37ae0f51514774c0b2b2daf519c78299b43bb74a926d8d7b6c05676dff7915ff49a2b7f4bccc7f5
SSDEEP 3072:Pceb8ioiPYezrTjdAq1y3LKb6d6+vm6zRySXvd58u4pSwzmMLe9tCmRGn8:P+iwmqq1ybKms+vTzRySPWSOmR7
TLSH
T128248A51BBC2DE56C80043378DD6C3E43678FD9A9F47A30736A4B32EADB63C69912158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

137891017d8cd29cef192f3f7a249d32945f3b12.d3d12.cache

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\LAVOICE\shader_cache\SceneForwardClusteredShaderRD\113a20f7d89cf02f0953bccc0dc86e2e04bd93a8004a5e34c1ca5362e01314e0\137891017d8cd29cef192f3f7a249d32945f3b12.d3d12.cache
Size 105KB
SHA256 7a20b9b51f9447882c111c07592c79a6ebc8a0dfb79971d6c4323553eb0f6cca
MD5 4e8f355d3bab207102195a2f8266088e
SHA1 6465bbf70fb303c85758bfa51a486e859d222914
SHA512 e0178b70d4927cee01a777a31834bfea1358481acf2cd35369d5625fc0ce0425866ecf1dd890f102211481b11324225f1b65b8d21eddb118378e01d141cc2a2c
SSDEEP 1536:s4F1TemV5ytR7VlexJJrN3msXZqPDV/tsxolVWZJJ/7W7taSx:s4ramVmR7Vle3JosXWDVGxolVWZXWh
TLSH
T101B3C042BBC2DE57D914023A4CE6C7D83375FD569F83A31734AAB32E6CBA3C69921444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b080219e2e5e8e3e00bf4084293ef84bc9f538a.d3d12.cache

Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\LAVOICE\shader_cache\SceneForwardClusteredShaderRD\113a20f7d89cf02f0953bccc0dc86e2e04bd93a8004a5e34c1ca5362e01314e0\8b080219e2e5e8e3e00bf4084293ef84bc9f538a.d3d12.cache
Size 202KB
SHA256 c8c83cc93db1be904fb30a883f62f952da803789f2ce36981af7d596d10eda4f
MD5 4b4decd571b8f7b537548591729d00ee
SHA1 93b78f041739613d3f316626d09d727048f7927d
SHA512 60edfe89d328d985bc28fe66ce27e035d66db0f520e5e7f79cfc08e3fc5dcc74cebc0040f31978da39d9ea3a061c9bd94d819fa30043afcf3a7faba3e8d03252
SSDEEP 3072:KY3qcGn+eDho/ZDqHQHMIx6l/IDIjqdzSXTkUlLKJ8sn/3sdb:1FGhRwH5x6hetdqkqKL3st
TLSH
T1CA148B027BC2DE2BC81407765CD6C3E83235FC96AF47935772AAB76D6CBA3C41A90644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5600-746-0x0000029DBCF90000-0x0000029DBCF91000-memory.dmp

Download

memory/5600-744-0x0000029DBCF90000-0x0000029DBCF91000-memory.dmp

Download