0337c59ed9b01591f3359d79e6f5147c9c42fbef7280a2c9ff23dcd0b22dc2dd

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gamesense.exe
Size 2.4MB
Sample261026-vs94vaft51
SHA256 0337c59ed9b01591f3359d79e6f5147c9c42fbef7280a2c9ff23dcd0b22dc2dd
MD5 a04d15a7627a47ba7569a7288f91de98
SHA1 03f9cbb384bab9c1ccbcfb6e0e4db222893847b5
SHA512 2a9d2ae802927a2dfe7b0769747101980c568f49c42a5be40eaee13148cb9d3a351f51c72eaaaabc52b19c448639974224ab01d6d01432e017fe20d739f7f800
SSDEEP 49152:HsDrVIzKnDIdFiTe8lKONEPRWQLE7O9DIhthoQxrlmrM24:HsDrVIzK4iTe8lKONEcDOq2G24
TLSH
T1E2C533DF6794C866C3DACF3C668DC83F54BA9C2DC8C1FA150BA9EC7324B17522A91065
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery upx

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
53	discord.com

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2292-0-0x0000000000D10000-0x00000000012BD000-memory.dmp	upx
behavioral2/memory/2292-1-0x0000000000D10000-0x00000000012BD000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gamesense.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
864	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{ABD97918-E92A-4D4C-90D3-545E7BBA93D0}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{8176AFE7-F556-4D27-8559-31A1DD0AC7C9}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
876	chrome.exe
876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe
Token: SeShutdownPrivilege	876	chrome.exe
Token: SeCreatePagefilePrivilege	876	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe
876	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 5660	876	chrome.exe	91
PID 876 wrote to memory of 3100	876	chrome.exe	92
PID 876 wrote to memory of 864	876	chrome.exe	93
PID 876 wrote to memory of 3100	876	chrome.exe	92
PID 876 wrote to memory of 5836	876	chrome.exe	95
PID 876 wrote to memory of 5836	876	chrome.exe	95
PID 876 wrote to memory of 5020	876	chrome.exe	96
PID 876 wrote to memory of 5020	876	chrome.exe	96
PID 876 wrote to memory of 6048	876	chrome.exe	97
PID 876 wrote to memory of 6048	876	chrome.exe	97
PID 876 wrote to memory of 2456	876	chrome.exe	98
PID 876 wrote to memory of 2456	876	chrome.exe	98
PID 876 wrote to memory of 3892	876	chrome.exe	99
PID 876 wrote to memory of 3892	876	chrome.exe	99
PID 876 wrote to memory of 2240	876	chrome.exe	100
PID 876 wrote to memory of 1872	876	chrome.exe	101
PID 876 wrote to memory of 1872	876	chrome.exe	101
PID 876 wrote to memory of 2028	876	chrome.exe	102
PID 876 wrote to memory of 2028	876	chrome.exe	102
PID 876 wrote to memory of 1520	876	chrome.exe	106
PID 876 wrote to memory of 2592	876	chrome.exe	107
PID 876 wrote to memory of 1520	876	chrome.exe	106
PID 876 wrote to memory of 2592	876	chrome.exe	107
PID 876 wrote to memory of 1064	876	chrome.exe	108
PID 876 wrote to memory of 1064	876	chrome.exe	108
PID 876 wrote to memory of 1668	876	chrome.exe	109
PID 876 wrote to memory of 1668	876	chrome.exe	109
PID 876 wrote to memory of 3940	876	chrome.exe	110
PID 876 wrote to memory of 3940	876	chrome.exe	110
PID 876 wrote to memory of 1132	876	chrome.exe	111
PID 876 wrote to memory of 1132	876	chrome.exe	111
PID 876 wrote to memory of 4692	876	chrome.exe	112
PID 876 wrote to memory of 4692	876	chrome.exe	112
PID 876 wrote to memory of 4908	876	chrome.exe	113
PID 876 wrote to memory of 4908	876	chrome.exe	113
PID 876 wrote to memory of 2680	876	chrome.exe	114
PID 876 wrote to memory of 2680	876	chrome.exe	114
PID 876 wrote to memory of 200	876	chrome.exe	115
PID 876 wrote to memory of 2580	876	chrome.exe	116
PID 876 wrote to memory of 200	876	chrome.exe	115
PID 876 wrote to memory of 2580	876	chrome.exe	116
PID 876 wrote to memory of 4732	876	chrome.exe	117
PID 876 wrote to memory of 4732	876	chrome.exe	117
PID 876 wrote to memory of 5700	876	chrome.exe	118
PID 876 wrote to memory of 5700	876	chrome.exe	118
PID 876 wrote to memory of 2020	876	chrome.exe	120
PID 876 wrote to memory of 2020	876	chrome.exe	120
PID 876 wrote to memory of 4484	876	chrome.exe	121
PID 876 wrote to memory of 4484	876	chrome.exe	121
PID 876 wrote to memory of 2296	876	chrome.exe	122
PID 876 wrote to memory of 4480	876	chrome.exe	123
PID 876 wrote to memory of 4480	876	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\Gamesense.exe
"C:\Users\Admin\AppData\Local\Temp\Gamesense.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd602cc728,0x7ffd602cc734,0x7ffd602cc740
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,8411405177725156764,9546967650638348283,262144 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1432,i,1318901550156673510,12823222646137662955,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,11109920362741662394,10285885876078352013,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14312745868157175412,13993169338755654387,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,15390237319898974761,3280444643474744755,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,14273549207310351499,9323059863097515459,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,13549265788907200705,10727574227248422729,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,6561808965923829396,2916247274008120808,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,15361553541261964151,10946120890073407984,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,7281900154078910001,2549994111730973542,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5848,i,14788805831507388088,17693270241389411950,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,8859908037790728484,4826975020033293444,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5996,i,7904641730339918351,8854589383706509934,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5840,i,847941737489305439,11139566650977970580,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5812,i,15010569706576601497,15152028881884350127,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,6971511367495441840,5545668338281362178,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5724,i,6290838327955865813,10386787106421374904,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,2661673126702436476,1932567432166992058,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6008,i,17249218562771377343,1302467415647377170,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3352,i,10127268790220247085,17652616846887070869,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4564,i,17444662817290036942,7260585113938134036,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:9
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5504,i,11434276974565038256,9879337238550425258,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5548,i,11848828268728323304,1132050754583400548,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5816,i,11025831036182312791,657061161435294825,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6664,i,6602372677305848485,5756018218950747482,2097152 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,14863713152316489723,3415943322721472564,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,6821497677213056320,16039778890066619026,524288 --field-trial-handle=1808,i,17136972960458814739,10052539930770353319,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:12
  2⤵
  PID:4480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5b88aa05-cdf1-4290-a81a-6caab53e9dca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5b88aa05-cdf1-4290-a81a-6caab53e9dca.tmp
Size 143KB
SHA256 22ee7091cf32f859f13b37ae81e1cc8faf0f14e748a9ca0896b92609cad98162
MD5 050889d74c5defaa79d7d3a873525acb
SHA1 4c42ff10c739a1b66e431d7a2ae07c089b828420
SHA512 4947e2b3c0c0466064f29cfcdccb13f80d4716e8e60a2352d702cdfc8568d21811a85cad6e4218a66b3f6d347fffa70977cbb99e1c6fafe48d84be6298a8391a
SSDEEP 3072:eer2SKPI6yt9wZa4Pvt56SCJ6hE6kSC12cOOYTxkhyu3yi1OoBe1JWs:eerxt6OwZa6t0SCkhE628cOOukhriW2n
TLSH
T123E31301868639B14CBF9326731E094FB07D425F0164ADF6D3ADD6EE6BB622B0345DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73b76a6a-af68-4af3-8159-293b12d4b3b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\73b76a6a-af68-4af3-8159-293b12d4b3b2.tmp
Size 143KB
SHA256 45e43a5e548e9b16a2e3895e6ed21fc6ae378c418a265ec5d7389a6bb4069236
MD5 3e5eaeff040f606af8e9f38664663931
SHA1 dfe67de4ef20ff0b35b6619c78a6c26a773e45f5
SHA512 594d3c85ac8804ecd55b864fe26c0ef1aec368dfab783ae1f99879d907f704154b1fd9668fea51bb77f7faa7e7fc1f60e82e3c52f873345a9f6177ea4daee0bf
SSDEEP 3072:eex2SKPI6yt9wZa4Pvt56SCJ6hE6kSC12cOOYTxkhyu3yi1OoBe1JWs:eexxt6OwZa6t0SCkhE628cOOukhriW2n
TLSH
T1D7E31301468639B14CBF9326731E090FB07D425F01649DF6D3ADD5EE6BB622B0345DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84ae77e4d131e93379683481e2602a0250f7ccaba40692ed2949a816431c9da9
MD5 ebcc9a297e5c474090962ed19a5e48a9
SHA1 2e86ffcad4ddd1266a3658610fed4361bfa6153f
SHA512 1346cabd9fe762b02f75bbf7904d7abe5469c2a7cef859aa89ea76204ae27b1759fd0a4435de57059ad8d709fdc549c5703fbcd74fded771fbb19adb99bde62a
MD5 SHA1 SHA512

Submit Download

03bc9afa-f740-49e6-9fab-d889cd4e3f4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\03bc9afa-f740-49e6-9fab-d889cd4e3f4f.tmp
Size 12KB
SHA256 9ab30adc5975f3ca708eca723770e3790d98d02680dbdfb1ce5d7020948205a2
MD5 531a3b4c7d2abc06dc0b34d46c222ee2
SHA1 e96639245ace8d8cb8266b25e3fbe609ec2b97de
SHA512 311d1a9fdc96d746ea28483c71a5326231b3ebc6cc91e63644c89171e340f13052523f13ca81fa8f02e0acc1e4a267ddd48d45e135e244ce5e05b82a7a762f6c
SSDEEP 192:5RLcBz1nygHv7ZAPRp2uSQL9THsb+WNrPLn74mC2OT2RqTFVyIsnAUge:5RLmz1ygPQXb9wbXU2I2Ie
TLSH
T1DE42912EA920793B9CDBC219F961BB57D2F5103225D53E84A7FC882C15E79DD212B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31905907-395d-4be1-b976-bc5e9fb9d964.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31905907-395d-4be1-b976-bc5e9fb9d964.tmp
Size 414B
SHA256 8270bb45ad99f58d92ff35256d7799dffcfbc20a8e0e1158e94e4475988d94e4
MD5 8b13750a04b9d12bfaa4f065d189e7aa
SHA1 5fe31e0dd306216837fc7a99320ab326cf68faac
SHA512 cfd5b38385ab9ab36addef6526a932bdf99f7937a8ae9407c2280c1fdaa6c375500dca95d9e738e30c578c5976a93c165dfa7da1e4db6c8ad54f10ef50d6cd30
TLSH
T193E02B99CD20DC2B09FC0F1850644247F6150B172B905A0B3A3D910D4FB562B459681C
MD5 SHA1 SHA512 TLSH

Submit Download

58c99679-8811-4468-aeae-9dab08dfe117.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\58c99679-8811-4468-aeae-9dab08dfe117.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 d2e03f4ab17dd993e6edd0bce9eab10ded50fe5857e25cb1745a5b0e7fc60729
MD5 8f81222dae2a290a09b62d9bafe5be36
SHA1 897afcf3894d1e6d206e025225764909f1216ca5
SHA512 0dbccdf6628faf753bcf9cb15855854d4c717d79dcd7e758b666dd1ebb7472b47b2bbf9f536740827181569c6e0040470bac1260a87874c5abc43791bbfdeb2b
SSDEEP 192:UHqk3G8OR0NZptAfGTbMWSlIujEoZyDyt6d+0N0arif443uUPpW2I+jn5+Az9y9j:UKk3G8OiNZ3AfGTbMWSlIujEoZyDyt6H
TLSH
T199E1E67088826603DB887DF340D40A66F3BE024CE8531EB6A3A5D7F768CAFB155C6439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

06941ce1-df52-43f4-865b-30ac1cb95328.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\06941ce1-df52-43f4-865b-30ac1cb95328.tmp
Size 8KB
SHA256 d8c92672daabe8f2e44ae420385c0b80280d94c81006f012c96ea406705922b0
MD5 e3fd5c766381e49de345d887918f0d58
SHA1 b4a5c9878db0b9af9442fa77bbb0e5ae56a8a73f
SHA512 4872df1a50bfadef3833d9dc6da25e8627a4772bfbc325733813a8f4c77c71ccab1958aad3ebd2431a10bcc222752216c7528e8dae017391aaa5258c4bd8bebc
SSDEEP 192:DUH67HbRXno9ILYzvhBNv92xlNPVaPKfPovXPOv+uwtUvTx5fXGrJ:DUH67HbRXno9ILYzvhBNv92xlNtaSfwH
TLSH
T165026CF3C3E8862DC81656F49B156E2FCE391928431C3D2789D9AE4F93E2871E35164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65f54035-1542-4928-8264-dac5c3dba629.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\65f54035-1542-4928-8264-dac5c3dba629.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d2e902e6-5caa-4bc7-a078-057bdddf1bf8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d2e902e6-5caa-4bc7-a078-057bdddf1bf8.tmp
Size 1KB
SHA256 f2d4f2f178de662b3500457560df157a77e4123ab5bb82a101ac5b1c88cd678d
MD5 0aa416ecc1eabd49fcac46f2e4d7f70a
SHA1 f099231a6548f63d276b821ef79dd3f40192f378
SHA512 5f3a24cd9011d42339ef920022c8942c31a4856d8825ba24b8ac542c17001813225bc2c3660ebf1ea04189d4f0aa82a2a22763927f0404583d063155c244139c
TLSH
T1D7218AA3D2BEB87B103D44BB1E447C093DBEB432015224E4CAAB836DB0D41F75706826
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\56319cd1-0c1b-4065-b1dc-2619573f1f05\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 38ffb2b79ae33f3d3ebd1545dc7587d7428ba201dd173f1c21de9864ee4239c5
MD5 dc1b9d19afdf41d946337a042dc4b08f
SHA1 06da3e9cabd196014c70f016022baa20210d136f
SHA512 b923546ab7b8a663bf331d1669894eb8e64df24216f91ed328b4681059ca812b108b525be07b1ac0f9b5b7fdfdb7e1706c9da8de363ca62bc309302bb3f6635d
TLSH
T12EC02B7BF1140440C71807511737444C4B022CCC5CC6C48EA003312C3034F237202FF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 44dc88c002132c9ccd6b998506ef6c1c9ea214656fd19d9733b31c0577b2c7dc
MD5 37d347f65950b15e1155c5c5536ea37f
SHA1 d3628d77a5ac1bbb4c568b654aec3c788da49bc2
SHA512 07c42f1da796497501fc5fa5ab27e07f5304cfd052f915ff29de830de42cbcf9cd30a8eadb3b6c57e22980d2271dfbe68b67b7a684d81a5dabb9228ead9372fa
TLSH
T1B8D0233BF02455A1D6FF5FA22F6210694B113CC56495C88DD003313E5C94757A613F67
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 66ddc61df6ef6d5ffc33640ec2f055d26e1ee358de1fad806475023671a5965c
MD5 cf7c0506de9b8fe3f1f848cf0a1fe818
SHA1 5c03a150a80b9b8b1f415b6d9b26c5ad09f3679a
SHA512 ccee329a07545fd4e76092c0db84ac0cf62511ae338bd7b5e1a90a21800287da6909894deea2b0b1ca9e0282e4b2837f31c0a747cc703d0c06ba215d6db798cc
TLSH
T1CFD0A72BF06505A1D7BB6FA22A6210954A212C856885888DD007313E28B47479717E66
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 611f4d648efb6e9023202a0b65ca92f2b6abea60b9097bfdd2980c6b744a00c3
MD5 0f322a7f84c97df0a7feb3c1c8e7f862
SHA1 ace13cf152ede713f33de529f342dcfedd667930
SHA512 cfa97d16d96e096d00d49cec4d112315e83aa351b74ff371402831c66616644823ef4b03074bbf530ad059f59c7242cfb8efc4faf37821d41c73ce90fb8b6df0
TLSH
T1BCA002B516526340D8504DB0975701C41301BA2C52121B0A459240E5C87148241152D8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 269242c5ce65da096fb420231e3d392062bfeb734c98babfd94f27a844887513
MD5 94a33546afb88028854895a3b7709838
SHA1 817a89990a4cca38182ce69276773e196bd93a4c
SHA512 f968ee1c42ae71db1e00e0394aeea9a5c4d4a48ccf6523859bcf54a2cf3f3dbe6495b976d3e67ff4caad5948e95c5a9bfe98c06ac0a72da7aba65265d6c5f127
TLSH
T124A002A042D00495CF5452B0A02155895742887414A6430754A30579E99FAC85206660
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6f23dbbc78be0dade2030577ff83a0b28999cf91af0463a8c679aad0d6a2783c
MD5 2182f5be250bb8cabdf448e523e5dd30
SHA1 1653c5d560b01fd669205bf483d529747886eb4e
SHA512 05b5c7d17ffd29296f42cffdc3115c042d86b54c3c074d395314fcfe1efcf36c32fe31f50de88dc8687295606175e50b6f804bed56e61c3effdf7a032bfb94a2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a93a994-bd5a-4d37-b986-9be8b9f8c043.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\5a93a994-bd5a-4d37-b986-9be8b9f8c043.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

ac6ec0f5-213d-4771-9b11-ffdce90ad18d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac6ec0f5-213d-4771-9b11-ffdce90ad18d.tmp
Size 13KB
SHA256 5f2853f52f7a1f7f73523c495fa57d0846211cce4de89442e41f8e738e7bd4b7
MD5 af69fc08674a1f6c635201d3839df2d0
SHA1 4a2b330ccabf20e0f5164213a6e4def2f68cb826
SHA512 7a6ccdea6d58b864fe590804d2ac343d133ec726ff89586a99d3f533992fcefb010242f59a52cfdffb3ca5c6da7093c7accad7b7f7e0c35a631c6bb1c3406eca
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU3obHG47vr5:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7c
TLSH
T1C6520A27688C9A3F0FD8DA4CDC167F8FADB5015666B8496492FB5C0803E97CB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0358507-0dc0-4b0c-859d-cbc40552b82f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d0358507-0dc0-4b0c-859d-cbc40552b82f.tmp
Size 13KB
SHA256 ab41caeeb0320e475e5b710996d27ce3e1afbe75260d9bc484bdc6947aa63c4e
MD5 58db8d6ae807bde56546d11b115996ee
SHA1 440c9cf8b76f34d685e23ef2d5d3b3ce66f873f4
SHA512 10c6f90091b2898daaccc339e0ade75f1425b4a9965d87685817d1b22588bcd67e95eaf2a90a66cdc08f99d6ab1253e652ae9a5afc9a4807fcab18f77a227338
SSDEEP 192:5RLcBz1nygHv7iAPRp2ubMQL9THsb+WNrnZIVPLn74mC2TT2RqTuPyIsnAUge:5RLmz1ygP/XV9wT6pXU2n23e
TLSH
T18552B32EA920797B9CEBC229F961BB57D2F5203224D53E84E7FC882C15E79DD2127407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff959b4a-86dd-48b2-b043-fe0a818cf20f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ff959b4a-86dd-48b2-b043-fe0a818cf20f.tmp
Size 4KB
SHA256 b319171e0a574e33a90542ea139344e203ef2b280d84c5d90858c1c3c6d1c5aa
MD5 0e5c8cd956edf5ef2f673cde624f5b85
SHA1 99d03f2c285ffc6398966f3c38c912498e86273e
SHA512 cf1451c55535cbef14251ed20cb10a924dbee2e03ef9a27c16f61da6bf84e11d9e53c1b20799667bafe53f6babe9cde2eb6eb2c3ba444e4ce0539526e4e25859
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok53HD8B6jGyvutFDLCmbYLsv4a:pC0z7q134vtDUDzQf7FDLCmbY6
TLSH
T1F2A10A70E87D997B85B6C485F5426A43CEB062BFA901BF84D8DD1B1C11EB5EC1312A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f760ea9-9954-4e71-94b4-3594675ca7c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\2f760ea9-9954-4e71-94b4-3594675ca7c3.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir876_1452225231\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2292-0-0x0000000000D10000-0x00000000012BD000-memory.dmp

Download

memory/2292-1-0x0000000000D10000-0x00000000012BD000-memory.dmp

Download

memory/5204-16-0x0000025E9D890000-0x0000025E9DF10000-memory.dmp

Download