5d3e3e57baffcaff1ea7c8f363e1875958f4700ccca992fcc203b223dce70983

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AA Spiral Free.exe
Size 31.3MB
Sample261102-2db2tszw7p
SHA256 5d3e3e57baffcaff1ea7c8f363e1875958f4700ccca992fcc203b223dce70983
MD5 849b286602e960062d02f48a71bf956f
SHA1 c1ce69df9535361fde107a04d1e216f566e215d8
SHA512 df33e7b5c4cc6e1ecdc5b5a23855beaf02c219b33ca3db7c1d7246997684e688c50168675d77f560ca0aa7a4bb8cc97fc2d35ccc82c6e1543b05e02e157c5d4e
SSDEEP 196608:B+4QhBNFtz1sYEh6WRTPgw8P52xIe1b1FD1yo6e5:B+zhBrtJW60BR+ID1lZ
TLSH
T1F077F80222948061E5A1DBBD7C26D79ADA71BC16370327E730AEC84E7B539E156FF18C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{505DE1EA-B8C4-48D8-B4C6-AB3425CF8D93}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 4776	5392	chrome.exe	91
PID 5392 wrote to memory of 1864	5392	chrome.exe	92
PID 5392 wrote to memory of 2740	5392	chrome.exe	93
PID 5392 wrote to memory of 2740	5392	chrome.exe	93
PID 5392 wrote to memory of 2812	5392	chrome.exe	95
PID 5392 wrote to memory of 2812	5392	chrome.exe	95
PID 5392 wrote to memory of 456	5392	chrome.exe	96
PID 5392 wrote to memory of 5868	5392	chrome.exe	97
PID 5392 wrote to memory of 456	5392	chrome.exe	96
PID 5392 wrote to memory of 5868	5392	chrome.exe	97
PID 5392 wrote to memory of 3436	5392	chrome.exe	98
PID 5392 wrote to memory of 3436	5392	chrome.exe	98
PID 5392 wrote to memory of 1204	5392	chrome.exe	99
PID 5392 wrote to memory of 1204	5392	chrome.exe	99
PID 5392 wrote to memory of 4528	5392	chrome.exe	100
PID 5392 wrote to memory of 4528	5392	chrome.exe	100
PID 5392 wrote to memory of 2544	5392	chrome.exe	101
PID 5392 wrote to memory of 5928	5392	chrome.exe	102
PID 5392 wrote to memory of 5724	5392	chrome.exe	103
PID 5392 wrote to memory of 5928	5392	chrome.exe	102
PID 5392 wrote to memory of 5724	5392	chrome.exe	103
PID 5392 wrote to memory of 4088	5392	chrome.exe	104
PID 5392 wrote to memory of 4088	5392	chrome.exe	104
PID 5392 wrote to memory of 5324	5392	chrome.exe	106
PID 5392 wrote to memory of 5324	5392	chrome.exe	106
PID 5392 wrote to memory of 2372	5392	chrome.exe	107
PID 5392 wrote to memory of 2372	5392	chrome.exe	107
PID 5392 wrote to memory of 1384	5392	chrome.exe	108
PID 5392 wrote to memory of 1384	5392	chrome.exe	108
PID 5392 wrote to memory of 1180	5392	chrome.exe	109
PID 5392 wrote to memory of 1180	5392	chrome.exe	109
PID 5392 wrote to memory of 4300	5392	chrome.exe	110
PID 5392 wrote to memory of 4300	5392	chrome.exe	110
PID 5392 wrote to memory of 2964	5392	chrome.exe	111
PID 5392 wrote to memory of 2964	5392	chrome.exe	111
PID 5392 wrote to memory of 2996	5392	chrome.exe	114
PID 5392 wrote to memory of 2996	5392	chrome.exe	114
PID 5392 wrote to memory of 1060	5392	chrome.exe	115
PID 5392 wrote to memory of 1060	5392	chrome.exe	115
PID 5392 wrote to memory of 3396	5392	chrome.exe	116
PID 5392 wrote to memory of 3396	5392	chrome.exe	116
PID 5392 wrote to memory of 2492	5392	chrome.exe	117
PID 5392 wrote to memory of 2492	5392	chrome.exe	117
PID 5392 wrote to memory of 4144	5392	chrome.exe	118
PID 5392 wrote to memory of 4144	5392	chrome.exe	118
PID 5392 wrote to memory of 3152	5392	chrome.exe	119
PID 5392 wrote to memory of 1092	5392	chrome.exe	120
PID 5392 wrote to memory of 4416	5392	chrome.exe	121
PID 5392 wrote to memory of 3152	5392	chrome.exe	119
PID 5392 wrote to memory of 1092	5392	chrome.exe	120
PID 5392 wrote to memory of 4348	5392	chrome.exe	122
PID 5392 wrote to memory of 4348	5392	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\AA Spiral Free.exe
"C:\Users\Admin\AppData\Local\Temp\AA Spiral Free.exe"
1⤵
PID:1456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff862ec728,0x7fff862ec734,0x7fff862ec740
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,8452754302562008443,4390078136995392684,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,5425189997639059976,6738203127941745411,262144 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,18126012370963622000,12870526807182711317,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,17115148478598841211,614092992833435905,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,6367240348494715382,14201230473428595926,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4756,i,8979503573815331699,4083780851276061807,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,12998640651098082910,16867358726908054531,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4956,i,11782900543183066482,6038258489690396141,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,9935675325898538191,9503821788205007118,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5632,i,7719857899812334963,16229170886343586137,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5692,i,18429371445002285569,17093722993780533005,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5952,i,12890335646856801457,172061623626357284,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6076,i,7911485314005252809,11347997158413353109,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6280,i,9392843329189758850,15192474701225954449,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6416,i,5627900374722265129,6711794774740964189,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6544,i,6247602624334903849,10431534188741622880,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6412,i,5278937481834198723,14434459891547350832,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6752,i,2037813286148257461,1450571826792074591,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,11706465393991896060,8366458040802475847,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,6084761394464775668,9925651386674225862,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6320,i,5334962685292839819,9972414710507812991,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:9
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5688,i,11673103699143247988,4166044529502355290,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6592,i,16890268047398757590,14329690016814209068,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6584,i,10369498200680209721,10075655511300058222,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,171167582849026439,16986695482685504081,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:12
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,9075318823290663862,14209089511786343928,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6296,i,13577345663236966123,4453591098917107048,2097152 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6808,i,8195056246364256661,4747945622737452428,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,9191985312666902525,15654870010381355347,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,13356181949944667760,2825011755879844589,524288 --field-trial-handle=2096,i,1642205047775268596,7388645759599551951,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

471832c0-ed94-4a65-8c00-59f31b5be25a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\471832c0-ed94-4a65-8c00-59f31b5be25a.tmp
Size 4KB
SHA256 6291edfb7e1c901e84864cd01783439f2abf73b7d803e9847ae7b7ea240e2bbc
MD5 54276dba3727063a9a2cf64c8c52fbca
SHA1 3476dd69f0f11a574793b2992820fba975ce106d
SHA512 3a3bf4902a88092951c6379a8d627b17068411e444ca1237b6666e8dcd6c702d94652763bfb675bb480aa70ebc58f84df5d6bdacf8f57632664dfab1b14a3944
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5ihDUB6FGyvoD3Emwt+Tbv4v4a:fC0ESKkdDUDaYBp4mwt+Tbvi
TLSH
T143A1F831E8689C7B59FAE888B4436A47CFB4317BD562AE94EDDD0F0814E70EC1341567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79f01d12-a02d-448f-a86d-18a97fafac8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\79f01d12-a02d-448f-a86d-18a97fafac8e.tmp
Size 143KB
SHA256 97d51589ed43c94dc4d43ad2cc3dad223d41bf8e448fc927146813728711007e
MD5 f8e0d302d3f4ea0748cf73ee01c7d6ee
SHA1 c8462efa66175f3ed4b3d1b96ff4b79db06e8425
SHA512 6103a8a994858da3a9ce6a841ed16a564a669fecb80edc47a9da722cb280e8eb8c9146351dd88257d3372abf2b07e25f11133b0317f6929dd62680710a35bb6b
SSDEEP 3072:7MvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNTD:YvHWe40m3otUf+8Wp53EX9pxsNTD
TLSH
T113E312688DC96C77AEEC51AB380BBE075F7C4646A255CA502EF53A0F3506CEF0663170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08a92c60-1c67-48f7-9491-4009e98ee286.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\08a92c60-1c67-48f7-9491-4009e98ee286.tmp
Size 13KB
SHA256 657fbd5adb09c35f36e216d10bbe1696e0f0404fd8a780fb1edcc94e8e6c3cf0
MD5 719b11acdf57769b4d0398274814422a
SHA1 5a0e5cd9281af5c9ff1bdba8f71c468599fbf17c
SHA512 0698e56b161af8d841bea19320cad2318e0301eb1bb5a29aff4df98861a452cdd565fbb5f22fa063b2ed096c5b201c5688b23abc6df5718ff4fe1b4b2ff661dd
SSDEEP 192:tRHcBzxDEhOLv77APRp2egU0qW9xHsb+WNHiIf4+923JarkhkwWacyVyIsnAUge:tRHmzxgIzyXWDwh/2cgh2acye
TLSH
T1ED52B52AED603A7FACD7D229FA257B5AD6F5202561D42EC4EAFC8D2C10D79CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22bc8c08-a820-4216-a567-e4d1be72ad62.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22bc8c08-a820-4216-a567-e4d1be72ad62.tmp
Size 11KB
SHA256 9859907ce9a36f3961f2b1f79844de9a75ccd9aedc94e30a08e974d9f8b76e91
MD5 546ded7745e9825f40c8164d1acf7440
SHA1 17369bafb4a2b9784c36c3cda919e3889ae0a3de
SHA512 6b8469d502274ff0007856b9e82a9fb9ab43b8aa456206735bb8616bf600c28dfc32401296240aa95658e3b4e0433411cf069983612602c923111709368e0af4
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9W7v+ANoPv:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFQ
TLSH
T19832E917A88D6E3F0FD8D50DCC167F4B6DB5025276680D2893FBAD0803A97CA114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38544bc9-46a4-49fd-9552-a69bc128a49b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\38544bc9-46a4-49fd-9552-a69bc128a49b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

3afbd152-8cf5-45af-a057-6229ef4c8fb0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3afbd152-8cf5-45af-a057-6229ef4c8fb0.tmp
Size 12KB
SHA256 62944d9c7be4ccb63dc224f6fb4279d9440354fff6755df821a00931fad1f6e4
MD5 419f1f3e2ee1f32af85fb642da6b38aa
SHA1 15573bd23f3fb729ea73b49ed0c5b7e8b0746d5f
SHA512 94055845a9d3774d6b5675954fdac84a78e2152e17c6e30ee6b5a57492d0c1dd0e404c52109b4bc37f93bbcec8d1af7e34afd677fc4d59d716dead11a3b53294
SSDEEP 192:tRbxDE1Lv7xAPRp2xAb9xHsb+WNnIf4+923JarkhkwWacyVyIsnAUge:tRbxg1zYXJDww/2cgh2acye
TLSH
T10B42A62AED64797F9CDBD229FA257B57D6F5202121D42E84EAFC8D2C20D79CC2127017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86182cb9-ef46-49c2-a9fd-9e7587abad3e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\86182cb9-ef46-49c2-a9fd-9e7587abad3e.tmp
Size 13KB
SHA256 3691af08069e00d23a6be8a2d9eba49c4ebb9f42da3c7e1be0e96be52b313996
MD5 73bdbd7d1e4cc41f7b7a9c3061db21d0
SHA1 df218c4078b2d16a881e9173496f7fd8ccb5409a
SHA512 619c62dd319fab3598966590ca2de12734687eb1b9ef9403c414355f643311b07e8030ca9ae4cd3fcbb3d559a795942f4d52e9e7545356743c92485e81a0bf48
SSDEEP 192:tRHcBzxDEhOTv77APRp2egU0qW9xHsb+WNHiIf4+9ULw2LJarkhkwWahyVyIsnAC:tRHmzxgIryXWDwh/32ggh2ahye
TLSH
T1AA52952AAD603A7BACD7D229FA25BB5AD7F5202561D42EC4EEFC8D2C10D79CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 347KB
SHA256 55a802124f008d2b631ff8977054930aad825cb251d3b036549216bb526f8489
MD5 0281f1670b831263670bd79eca878588
SHA1 55d9c22e17db5ebc7de11ed7b1d9d3fc6f8bedd7
SHA512 693515b304e0c487c7fa1b9c4e66b205c12423bbd09dcda9dace08f55bb774c32d0d13e731901414773e66a1dec0167a4be93bd80eba5c03669f8bec83217f35
SSDEEP 6144:lydQII9pOs9yUxtm8wdzKNt6tpTqH9qQSemZEQySrLOgSaKOywu5:cI92Uxad+XHlSemwOOg3u5
TLSH
T1477423E4793A842280F8D4E72E3927933050623578FF8BA156D8631ED2AD30D5796F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 228KB
SHA256 3c680f13ea32f26cde522d39947c09730fc60f7739e7271c160fcec7014e0116
MD5 cc67aad86c4be7004448b65b5bf463eb
SHA1 ae4726c71b9824f0d9f0c474482fbf96cd15ae76
SHA512 00e6dd927502fe6257e5def1a766cc7230b6a0ba5212df5be7ce505584cf4743c19567aa656b32c96983ee48806ba13da256865f306ecd3071c15028fbe072a7
SSDEEP 3072:7VWdSPaDzWbV6iyUH1Dqt5O5VhVBpg1YHBVBmAPar/VBKg1T3XfvxBdY:voXgtzu7g
TLSH
T11534192C71D672C6D12DC33709014D5BD375AAC95A9870ABBCA27E0C26F7F883B51B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 0cd8590ecad3f7be7e57f37ab1764347b4db6f8426e485a3da748cb3fb24f022
MD5 ebadc3b59fdc775be887b0a2336ea1ee
SHA1 52d843890dba4bb6d87bb8e9f515cf2a9cebaca3
SHA512 7db2d31147e3ab86e22ea1e665559539d030cd424d3606558d05e0eb22805f7c9321db848644935fb1f7dc5bd3b087eeed72353eb8d4a8c16d84e7472303440d
TLSH
T16EE026699CE9C2AF526880BB2570770EEEE6550DF7CEED4A0F81E450B1DA40C90EC671
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

1d0e43c5-9481-4b39-b609-417843030f19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1d0e43c5-9481-4b39-b609-417843030f19.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\dc918403-2b94-40e9-a78a-c34448aa6d88\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 e9cd78b4552dd30b437c0d544f8d24331930eb841e16c8701116e5df07dc4ce9
MD5 9074db73f298ef3d5bf22eb5112947b0
SHA1 f5a9b0c6a86b06220e0ffa1f9b645689ba0cf1a0
SHA512 eccfe4e4d94d6acffdfc73cf468619c2ebe50d29172c6918c59d5faedfcdf7d29dcfb8e39328d894bc339dec07a7ab81803e52fe866e0dd0e721bbf2fdb436ac
TLSH
T15FC09BF7552646960B30DBC6103C676DD51F9D498CC4CCF4540570427479F17C405525
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 6fd0df79a9c13f4b6cd8a656630a82d1edbc536b1228b1ecb826fc02d456ed0a
MD5 722c2acbbf23ac9e889d9c23ce390d0a
SHA1 83a50f43d0a14d83c257485b565779f4d5671b67
SHA512 61d226cfc504c60bcbe71668d298eb92497639468f788ab76df65c90e8b30b9cab5d55dd0ae216fd158ffc259cfb15f7e572aa08c82df75f1fe7986e6f44557b
TLSH
T1EBD022FA8232A6662B34DBD4203C526DC02BDD0A8C94CCEC9804B143B8BCB07C083628
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 3127b770ef46cdd3c146419660fe9d1da9bd2bb063abcaaeeb20814e53647558
MD5 ce27b26ea54d5672b754221e04f0f045
SHA1 e58115f1ccc3ad948274194763cccfa8399d384a
SHA512 3bd43a2779ece629452a722f4397a9f10f3d64cf7ed5f3d3055c43b01640bf600bcc0dfc50402a98740c2f2d915bfede82d827c4cb48a274e9f866f324af173a
TLSH
T1F0C09BFB551686960A34DBD5103C673DD50F91498CC4CCF4540450426479F178403525
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 283B
SHA256 60af87ef7aa416d0fbe6e9066e4915c20781df6e3ef65babfbcf756ad4cd6fa1
MD5 550bfebd92a583313685563e09f1bc8f
SHA1 3f4e3654dd174f4e395bfbb6dcb03d87f604b1f6
SHA512 10c09f916596d299f7a4b06c8471ae9fba913f87a146d33f1985115851f683ec58461a00a3e7120b03f4a6f5e75f8ed5369839e556a9aaeee3d9dc336b4add53
TLSH
T1FBD02B7DBE63418DCE339BD2283966BFD5ADA8080944DCE02909310B96B9B0A9005E2A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 c8f4eb21510a1f78f0e4cc9d142f11fe312e951d6e6b592bee6b3e8450cba244
MD5 474c49a067b833aec4f19618240115c0
SHA1 948f98e307acc37f1b1e6118e22310d36b27a568
SHA512 2b61b3bcf868d1d12eb8d3997018d2abeb25e352f82de083a2705e33d171e6ae322c50c3e08222d1a572f9ab6304fb7b93e5348c3a6c79cb7762031a0f91b52f
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 480fffc68ccb1287da2669a267530d06395104038d661b08e7bdf3a317cfaa7a
MD5 39ec3da376c7184d9dcecd3dbbc8fd1c
SHA1 ebc82e5aecceac932e075c174da632d8cbe3b321
SHA512 7bec0a806decd1b4624510ca6aaba944598475cff7327141a562e58e24f5c6df593f47d8e0805a3ebd2628fcb331c3065de570711c12834388aaf4b62138ff23
TLSH
T1DCA0021551D40591CE004270E071457132574D5D1559434367A2867DAA9B3C68111540
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5392_571982892\Shortcuts Menu Icons\Monochrome\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5392_571982892\Shortcuts Menu Icons\Monochrome\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5392_571982892\Shortcuts Menu Icons\Monochrome\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edc27e1f-498c-4d2c-a276-0f6dd619e2d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\edc27e1f-498c-4d2c-a276-0f6dd619e2d6.tmp
Size 143KB
SHA256 eec7257a3feb6275d4c50ca50f6fbb99165d5a6c4b950a5b9cd43e3ef95fd6ca
MD5 96823169cc1440e083b513c9768feb37
SHA1 fc34af625ff2beb37756ad0e7ce45d0b4fe892ba
SHA512 a7c32bd17c4a4f2ebd8669eca71be22311e4ce5d116d8d30c9d3ff50a783a969bdf480d2f8c2e4ef7f7accd388393877364092eed354551495d64d575c5973f1
SSDEEP 3072:gMvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNTD:jvHWe40m3otUf+8Wp53EX9pxsNTD
TLSH
T1D9E312688DC96C77AEEC91AB380BBE075F7C4646A255CA502EF53A0F3516CEF0663170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ddfdee5-ad9f-4113-9b52-82382dff80f9.tmp

Path C:\Users\Admin\AppData\Local\Temp\2ddfdee5-ad9f-4113-9b52-82382dff80f9.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5392_1894048938\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download