2678daa626686938a34f0fc2f207a18cfb597ec88ee6b6c932569fb8a29c9818

Analysis

user interaction
yes
max time kernel
899s
max time network
882s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tru3club-client-1.21.11-v3.jar
Size 122.9MB
Sample261030-tddxesev9n
SHA256 2678daa626686938a34f0fc2f207a18cfb597ec88ee6b6c932569fb8a29c9818
MD5 6aacbd9e892848e43e3226ce9feb503e
SHA1 3c75fff6aeb97eef8b2978f7e1b3ad5101d472e5
SHA512 f179dc3bfc1bfeaba4f107a7d927994c23d658d756177ccf7b072217d563034384b7be4c1c08380feb990f11da6a17da60544a2a5aa9839e68f443c52155f22e
SSDEEP 3145728:hINKKk6T40AEX0qYQNIcahA2qnRMIxNHUvnlG5OfUn:hINDk44AXiQ+K2qRrxRUvnS+M
TLSH
T1E458338BBEAA26C0B97BC55D5A60CBC0BD945D04C3F2C2B4667D231265C0ECFBA394D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2024	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
540	chrome.exe
540	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 972	4896	chrome.exe	92
PID 4896 wrote to memory of 4972	4896	chrome.exe	94
PID 4896 wrote to memory of 2024	4896	chrome.exe	95
PID 4896 wrote to memory of 4972	4896	chrome.exe	94
PID 4896 wrote to memory of 2656	4896	chrome.exe	96
PID 4896 wrote to memory of 2656	4896	chrome.exe	96
PID 4896 wrote to memory of 2740	4896	chrome.exe	99
PID 4896 wrote to memory of 2860	4896	chrome.exe	100
PID 4896 wrote to memory of 2740	4896	chrome.exe	99
PID 4896 wrote to memory of 2860	4896	chrome.exe	100
PID 4896 wrote to memory of 4100	4896	chrome.exe	101
PID 4896 wrote to memory of 4100	4896	chrome.exe	101
PID 4896 wrote to memory of 4128	4896	chrome.exe	102
PID 4896 wrote to memory of 4128	4896	chrome.exe	102
PID 4896 wrote to memory of 2276	4896	chrome.exe	103
PID 4896 wrote to memory of 2276	4896	chrome.exe	103
PID 4896 wrote to memory of 3664	4896	chrome.exe	104
PID 4896 wrote to memory of 4092	4896	chrome.exe	105
PID 4896 wrote to memory of 4092	4896	chrome.exe	105
PID 4896 wrote to memory of 736	4896	chrome.exe	107
PID 4896 wrote to memory of 736	4896	chrome.exe	107
PID 4896 wrote to memory of 4792	4896	chrome.exe	108
PID 4896 wrote to memory of 4792	4896	chrome.exe	108
PID 4896 wrote to memory of 4444	4896	chrome.exe	109
PID 4896 wrote to memory of 4444	4896	chrome.exe	109
PID 4896 wrote to memory of 3612	4896	chrome.exe	110
PID 4896 wrote to memory of 3612	4896	chrome.exe	110
PID 4896 wrote to memory of 3560	4896	chrome.exe	113
PID 4896 wrote to memory of 4352	4896	chrome.exe	114
PID 4896 wrote to memory of 3664	4896	chrome.exe	115
PID 4896 wrote to memory of 540	4896	chrome.exe	116
PID 4896 wrote to memory of 3664	4896	chrome.exe	117
PID 4896 wrote to memory of 3664	4896	chrome.exe	117

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\tru3club-client-1.21.11-v3.jar
1⤵
PID:3056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbb2c9c728,0x7ffbb2c9c734,0x7ffbb2c9c740
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,17382732077727873546,4906437463671509040,262144 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,10816583226499300069,15414502684032788544,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,5033729943114466144,15935911861041996790,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,15109583071492565376,1119442344355028513,2097152 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3444,i,14770647019112803784,5286428760788111046,2097152 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,2595710004725134701,16376634551247595324,2097152 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,9171085176230713806,5663524471992940334,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4876,i,5040959576630991454,14666235524891239713,2097152 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,5046118721757845029,4761916178181012816,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,12534721530886387530,15816412454261447709,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,1501230180070585988,12669453306231549011,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,8847729913848000078,14721922964770539254,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6028,i,3113473884573888935,8406037757396211056,2097152 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6016,i,3041121256743111341,2510524936232065245,2097152 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6112 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,4072003096904439811,14388156079973025508,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,13057620112702342960,14511972283522834618,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,8957962700749883597,4649197136560495228,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5456,i,2204282792979472422,17687625287382705795,262144 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4216,i,16128963432925472558,17285857289081374781,524288 --field-trial-handle=2028,i,14815176453665310499,4188888039711553198,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ee43746-9c87-44dc-ba01-09886767ce07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3ee43746-9c87-44dc-ba01-09886767ce07.tmp
Size 270KB
SHA256 5ca40183f40e9cff85c573bcb7e18e346f3a0099215da754aac2638d554da90d
MD5 407690523ed6e2c279f17ee2ca05f4ad
SHA1 03a8b9b3ef5b11ce3de88b216552d03bfc2f3cbb
SHA512 47041788464c85276265b734570c969d3af859c8ad5487b7eb62eae226d240bb809ed178cbb0bfd845b143ab048eab2d264b6a7e0c8b12c9fd5b90eb6058965f
SSDEEP 6144:zEgcZIjFANXQIY3KF6RKxPZXrhtgYFpt5c+hFD+7t56OD9ZfSApprC:lLAZQIY+75rXgssyFSXD9ZfS4U
TLSH
T1D4441222E959A8AF8BFC9150E01F5704CE7098ED82BE574580C9CF8FA1AFD8D4632532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4618e53e-12c6-4405-86e1-73aec937952d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4618e53e-12c6-4405-86e1-73aec937952d.tmp
Size 130KB
SHA256 5f1275a43e6ff9acf103201883ff021c072724bb290b6b82585bce43121c0388
MD5 78bace10f49086d1a38c9b546318d156
SHA1 4785a9982d1e0b184cff5ee74a4cff3ddd5c3f19
SHA512 47db022e83c7cb64fa97a9a2dbf14d2b4e13dfd2f4f7374f231130a617f018f7573c75216584a44f19451b3f1bfb901d19c019846c1f3e103fca0962e2213bbe
SSDEEP 3072:R+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:R+hFD+7t56OD9ZfSApprr
TLSH
T1D7D31232AA95D9BBC9BC6541B157A300DE76ACED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b46c9f3-7392-40ff-93dd-b4828c5bc965.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b46c9f3-7392-40ff-93dd-b4828c5bc965.tmp
Size 13KB
SHA256 c63d5b3a3be13952d2ecb68b47bf826c15b249e918f43c91377cacdb39fb6c8f
MD5 0b8af0ff13f31bf178c0c0e4bc6146f1
SHA1 79d5348a5380af61aa2fe440b02bcb08fc901813
SHA512 2e0ca5d8e8ca64e266bc2367a7407520d38fbec03aa7deb3683ca5e14303807a4f19f31dd6ecb155818627b60c720fec5e2df4c60e7451a6b6559ab1416168d8
SSDEEP 192:cRaHiMfOjMPa4Rg20v7VNDpHPRpf89QHsb+WNnON0yPea2iW9+jVyIsnAUgraJ:cRaHXna4DwZxBX0Wwk0w2iWcFe
TLSH
T13E52C62DBE10A93B9CEBD229F9567B53D3F6102220D12E84E6FD893C15E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2089aa-79b2-4015-bc11-3b2c80eb2737.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a2089aa-79b2-4015-bc11-3b2c80eb2737.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

967ae960-8df4-4089-a1c2-f2e1af2cc5de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\967ae960-8df4-4089-a1c2-f2e1af2cc5de.tmp
Size 12KB
SHA256 027d018902fad2136af02c11ee6a4858d71f94a3abf75eda2f6b85283d7584b2
MD5 194f75cb0dd6e66f0714637f7e8d84a1
SHA1 d1e510e008ac3329273049e20ffe8aae14a785d4
SHA512 34fb81e7c6d5c80e9e005d02335d2dec46f5d309d8f7ef4b2d27b03ffd92b367699941fd81aae737bb01337174176dd8c02b756c417a743d486fcebca6719b27
SSDEEP 192:cRaH+MfOjMPa4Rg2Hv7VNDpAPRp289QHsb+WNnON05Pea2iW9qjVyIsnAUgtaJ:cRaH7na4DPZxUXDWwk052iWkF8
TLSH
T17142A42DBE10A53B5CEBD22AF9667753D3F6102260D52E84E6FD893C15E79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1332e0c1-4814-452b-886a-1a1e9ef7faa0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1332e0c1-4814-452b-886a-1a1e9ef7faa0.tmp
Size 3KB
SHA256 5c76d9a83f093ebdf58c25981c83348dd6eca4430b2dd30116a14f486b5676be
MD5 8059a72edb91c04cb1951f96412540c0
SHA1 d59c2c9341bbc9e9cb36d781be407c241cf4fc6e
SHA512 cdbfb4e8d545c6c806f4ec128b5c18aa2ed703362f81fd7286e1a1126f3fd7a3e6f1eed3dd50045a4b0fd040e7cca2093ce5c830aa67795436741d87ce97d43d
TLSH
T1CA519EF3D7D48A6D851156F4EB257E1FCE291A24131C3C66C8D8AE4B53F2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

1e6cb4fa-216b-4dc6-920f-32077f7f226c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1e6cb4fa-216b-4dc6-920f-32077f7f226c.tmp
Size 3KB
SHA256 9ff5590453219828695f5eddd4450f1792a86534a4d94153e5c4f3aed0001d8c
MD5 506f272a8c5531543d97a5069195209b
SHA1 e34fa22570ba0a59764c268d64e1459dbaa28847
SHA512 b4d17656e88ad17e351c4e29b7a9f6c931d5029f873408541137bfb2176f1b0af53cd1b820417779af340910a4d2a2434222e769e63a2ff94b76ee75d9ed574c
TLSH
T13F719EF3C7D8866DC51156F4EB257E1FCE291E28032C3C6688D8AE4B93F2472D21168E
MD5 SHA1 SHA512 TLSH

Submit Download

98e01b09-1570-4e26-9659-08f2796dd287.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\98e01b09-1570-4e26-9659-08f2796dd287.tmp
Size 523B
SHA256 5d0532263ee62b6da118fad2dddfef7197599e786a8628b081e43af72f2190af
MD5 75cc2e0a105d913650e8dafddfd5f114
SHA1 0ad66be56fe9b9b75802f41802117daa19321bb2
SHA512 b204620bdfb13b5af67a6bba91b011f0973b4f63a5ab3dfc0deb6608b60282b98d813bba0956edad37b5b9084eae63f7d101086c796bfa3a37ba6f6ff1fafbf7
TLSH
T193F05097AABBB477107E84675D05B4063875643603415CE4CEDB832EA0D54E30F06453
MD5 SHA1 SHA512 TLSH

Submit Download

ab872c54-1d08-4fab-a13b-5ee96e325dcb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ab872c54-1d08-4fab-a13b-5ee96e325dcb.tmp
Size 3KB
SHA256 c43c66912ff4fabacd4ac171588c939c978f46036958e95d41bdb7ddd170bd11
MD5 4ce5a8535c2eec466c2033e563ce91b1
SHA1 ff73a538e3c072ca45c8c0cf300fe5ad3584374b
SHA512 045b555502a62fab7dc1e3e35948e03f772ad694a88dc8bd51cc5d0cb9582745aec69e4d99dcb7ca0ea1fcda1a85c98221b0655f844ff12a1c2804bffcf9c039
TLSH
T11551AEF7D3E4867DC50156F4EB25AE1FCE291A24032C3C6288D4AE1B93F2572D25178E
MD5 SHA1 SHA512 TLSH

Submit Download

bd50d194-a91e-4791-ad23-8ec2dbbdef14.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bd50d194-a91e-4791-ad23-8ec2dbbdef14.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c78e6e16-2c15-4732-9d44-89bb574173c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c78e6e16-2c15-4732-9d44-89bb574173c8.tmp
Size 2KB
SHA256 6a32f08010c9d8d46bb9467b6d27bf47fbc26d5f8d3818cbfffb50fee8e4f483
MD5 ab8ccafa19905fbe0e758e7b613d7495
SHA1 9b63fd7fe9373b4d46412ac2379f9c2e1e0c63ac
SHA512 aa5ed5a1b713e26ca546acc039edac2107952922589de952b5eea8634de27fbf30ab683c13f6d0aaeeca0412efa7682f386171d5937fc5474b60d988cb8b0dc0
TLSH
T1E251ADF793E4867DC61156F4EB15AE1FCE390A24032C3C6288D4AE1B93F2872D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

d2251dc1-3ef2-4ad3-aad7-5e753f2620c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d2251dc1-3ef2-4ad3-aad7-5e753f2620c9.tmp
Size 2KB
SHA256 d77932803a76e6773e2917c74d8deeed973c7a0d97e5d4cf38db3308d12eac41
MD5 01b0417dd672eb4a8dc04a702a106be4
SHA1 2382845676d4e3c6a518d181279d0b29e6be1c52
SHA512 77b6f7a6b34944ce05c80ef55d1aa21561981d3522b5c18dc0af9d72dac961cb74ab7d5f429f1b8eb435eccb6876b4e5b27546101616132d35226f258470cbd3
TLSH
T13C519CF3D7D48A6D851556F4EB25BE1FCE291A24131C3C6688D8AE4B53F2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 32d27a21a7d0625af5ca27a6be934536ec2b6d33045f2df7d7259ed21f07e0a0
MD5 40cdf598da05b14d851f28b8628f51f8
SHA1 a05948b531c5d2a3c68d2a2ac65f66748cf331bd
SHA512 5f627ca2bbe9c2862e6363ba17af45787c48b5bf51cc0f54e3b7afbb46ae716bbf1c34b175b45f7a6730f618fbfaea18db19c7ab6d5575897c10cb2dce8e5d99
TLSH
T10BB0122484455382C04202F01271688831549F11AA09530151F00E19CC35261D05B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 69062dc9d42a5dd47ccc5617cbe059b35c35fcc6bbcadac35dee21e8f8501d81
MD5 5c31fbc322119c30aa31b33e3cbbcd2f
SHA1 4171bc0ce6da291700fd418f2df2c26467ef61a6
SHA512 acd8760e40bd59bab3e253263bfc4f44e2bfd4a04a053dacb909fbe64a309d2f9212dfedc921c49b3edc9d6b4cd851e6216374c5ec467983f854c1182c5a8b7e
TLSH
T106B02220C802E202C0C223B22080E8EC3020EF32CE032222C3E02F3EEC383300020820
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 9db540906bd116a4dbc895fe6f2b5bc39d3dcb9b98b252c60f3500b4c8e8838e
MD5 fa4682da78efac2c83973f782fd1fe76
SHA1 3d8b69759b0694e76a1827ca5c92564d46d6a863
SHA512 d84d80d13ed00cc468644d38243802635117ef6fb5a4ef7eb3592b084090ea63e8ba933df11cf5a74ef7e7ebbea75c8f909bb50f5c0993fc867485c016723517
TLSH
T15AB012B04C48001BEF0082F01451057173740C101D52934B609F5BB4D8261DC5402204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 00ef4fac03166f626af86b997e4dbf7281f753b8f7d6834fa36c66720e0ea760
MD5 35fbc97125d4a97aeec2876cad968e1c
SHA1 ae81686e43981c7bdbc3152e07e7d3e90f4a3d05
SHA512 5711deaf5140c462127e2f5b449236374d7befd52a3bf44d88383347277e21f82d73e6ef6a9039b10edfc5576eb733584d1b9ac320f936963df476d086b5f99d
TLSH
T1EBA002D942490111EA008274BCA9824637718C1C2566476784DA98B9AC593C48945600
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a977aecf-4ba3-4cbc-acc4-3f5e9e354359.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a977aecf-4ba3-4cbc-acc4-3f5e9e354359.tmp
Size 414B
SHA256 d95a94212432df434afe94b26c6442ed067ec173fc4a209545604401132b5933
MD5 fd4debe8b0bb0d1cb1cc5ffb42d5868c
SHA1 b791a7581369de2061824ef5984f88e224932a08
SHA512 43bc1ecc76edc8dfc8854895fa92ccb114e0035f0cda9870cffb400d1712ddc398a087e7344647e636e16781f0907dd3d4cbe05c7576752f148720f641675717
TLSH
T186E02BD5D8A2EC3709FC475D65348785E75413577A91594B3B3C810C4FB066A01C685C
MD5 SHA1 SHA512 TLSH

Submit Download

bac0e912-5baa-4d2a-b33b-981ca4aca6af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bac0e912-5baa-4d2a-b33b-981ca4aca6af.tmp
Size 12KB
SHA256 5d8299bb5190fbf6ed7e7ce087378ea79d2a9328aca7caddfd7d97d9b7d5e651
MD5 10666b929d9982c100d7d9c5277a3858
SHA1 1272a5db5160696bfd4b7b9af93b8d7b442d9510
SHA512 d5dec1ab91839a4c0c89dc2e9c09485edeb9080119dadf19758b0ca56da1518d332b1582274d102c62c4701ed2f2f10544f3a10dad26258d56aa30eae47f48e2
SSDEEP 192:cRaH+MfOjMPa4Rg20v7VNDpAPRp289QHsb+WNnON0jPea2iW9qjVyIsnAUgraJ:cRaH7na4DwZxUXDWwk0v2iW4Fe
TLSH
T17642B52DBE10A53B9CEBD229F9667B53D3F6102260C12E84E6FD893C15E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd88bd7f-0d23-4757-b622-c792eb55fb70.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd88bd7f-0d23-4757-b622-c792eb55fb70.tmp
Size 17KB
SHA256 ab7f1991188f7de9b3e6d10d35ab7caa6a71d1a92f14713065fe249dda61c6d5
MD5 23f9a03572129d0ba292d96ed34311b8
SHA1 1ed48f59417178fafeecfc04d793d8a09fd57fca
SHA512 4fab67e2703fb08f12a9ee78b64361d4143c8d4330bc4517063bedfb179a76e9d223e230ec0abc3fcfde4db483fb69e8be866c57314b45d674103d00bd23b63d
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3UOHG3tbKwI:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pd
TLSH
T163720A677C4C9A370FD4CA8DDC167B4FEDB5025A65EA886442FB582903D4ACF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d37efc18-6f0d-4141-bd37-7992b0f41ee1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d37efc18-6f0d-4141-bd37-7992b0f41ee1.tmp
Size 271KB
SHA256 0f934225bce9a29fd97e12ea86166594c2da660c8734ea87dfb90db5179d58e5
MD5 16d4aaeb8eeda7700f38f3cd6cb24a39
SHA1 7ef746f84016662831ea791b34e150e8e247c0be
SHA512 a41a779db05ddcf21ed96d32a125fff42241f00250ea8ff28267d4f19b77d2ab6af7c16f959e2b3617159d7d15ec5200903fe6aa518bf610981c6e5f58c63aab
SSDEEP 6144:EmEgcZIjFANXQIY3KF6RKxPZXrhtgYFpt5c+hFD+7t56OD9ZfSApprC:bLAZQIY+75rXgssyFSXD9ZfS4U
TLSH
T175441232E959A8AF8BFD9550E01F5704CE70D4EE83BE57094089CF8FA1AFD994632931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb2e9131-ac7b-4b21-8638-021613fb36a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb2e9131-ac7b-4b21-8638-021613fb36a6.tmp
Size 271KB
SHA256 5fac1836626c2949b7e9952d48991957d3bc4e0810c749fb35ac68265adc93b7
MD5 5d058cb56424f04fdb07c6232aa39953
SHA1 daa9fd83d4500622113493d5fd139c9d6c54e901
SHA512 0ddf68be3d27f0edf53e0f4492681ee5d66f62e823a1f13632816068f3d313756aeea3e6835b0a4f26c121176de4096eeab97ba0f72ba23effd1d68f0f4b77b3
SSDEEP 6144:QmEgcZIjFANXQIY3KF6RKxPZXrhtgYFpt5c+hFD+7t56OD9ZfSApprC:/LAZQIY+75rXgssyFSXD9ZfS4U
TLSH
T190441232E959A8AF8BFD9540E01F5704CE70D4EE83BE570940888F8FA1AFD9D4632931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac2dfaef-5ab6-45ec-8e03-00de6813dae5.tmp

Path C:\Users\Admin\AppData\Local\Temp\ac2dfaef-5ab6-45ec-8e03-00de6813dae5.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4896_106034888\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3056-2-0x000001AAAC310000-0x000001AAAC580000-memory.dmp

Download

memory/3056-12-0x000001AAAC310000-0x000001AAAC580000-memory.dmp

Download

memory/3056-11-0x000001AAAA9B0000-0x000001AAAA9B1000-memory.dmp

Download