4f3a14553222433b6e3671bf9d947d39839c3d1d355b767d038868d7054b69a2

Analysis

user interaction
yes
max time kernel
898s
max time network
472s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe
Size 51KB
Sample261110-3fc8cacd49
SHA256 4f3a14553222433b6e3671bf9d947d39839c3d1d355b767d038868d7054b69a2
MD5 6f84eec0f4d40121655b95c42cd3e5a2
SHA1 4187fd4eea7b2c9d1507cb86823e36cec46d5019
SHA512 e88d752639618fd196a31fd7b7593188d9a9ebf3997d834a20697b0d15563f65417127ad4afcb4417b35da5cfb63f71f4e695135618564c921b051ba8329ccdf
SSDEEP 768:iEYRauNbP+EqDcUxgVYR0mfp1LU1omaOwt/q0y:irRau5+pr1LUqN
TLSH
T1DC33F80A36EEA922F2BEC7BD6C3000118733A6F55539EB8A5DDC649D2BE730419D0767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com
13	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1436	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	chrome.exe
2744	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1436	4876	DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe	85
PID 2744 wrote to memory of 440	2744	chrome.exe	98
PID 2744 wrote to memory of 3480	2744	chrome.exe	99
PID 2744 wrote to memory of 4552	2744	chrome.exe	100
PID 2744 wrote to memory of 4552	2744	chrome.exe	100
PID 2744 wrote to memory of 2756	2744	chrome.exe	101
PID 2744 wrote to memory of 2756	2744	chrome.exe	101
PID 2744 wrote to memory of 2528	2744	chrome.exe	104
PID 2744 wrote to memory of 2528	2744	chrome.exe	104
PID 2744 wrote to memory of 2628	2744	chrome.exe	103
PID 2744 wrote to memory of 2628	2744	chrome.exe	103
PID 2744 wrote to memory of 5048	2744	chrome.exe	105
PID 2744 wrote to memory of 5048	2744	chrome.exe	105
PID 2744 wrote to memory of 3384	2744	chrome.exe	106
PID 2744 wrote to memory of 3384	2744	chrome.exe	106
PID 2744 wrote to memory of 5088	2744	chrome.exe	107
PID 2744 wrote to memory of 1948	2744	chrome.exe	108
PID 2744 wrote to memory of 1948	2744	chrome.exe	108
PID 2744 wrote to memory of 4316	2744	chrome.exe	110
PID 2744 wrote to memory of 4316	2744	chrome.exe	110
PID 2744 wrote to memory of 116	2744	chrome.exe	111
PID 2744 wrote to memory of 116	2744	chrome.exe	111
PID 2744 wrote to memory of 3316	2744	chrome.exe	113
PID 2744 wrote to memory of 3316	2744	chrome.exe	113
PID 2744 wrote to memory of 980	2744	chrome.exe	112
PID 2744 wrote to memory of 980	2744	chrome.exe	112
PID 2744 wrote to memory of 2404	2744	chrome.exe	114
PID 2744 wrote to memory of 2404	2744	chrome.exe	114
PID 2744 wrote to memory of 2060	2744	chrome.exe	115
PID 2744 wrote to memory of 2060	2744	chrome.exe	115
PID 2744 wrote to memory of 1044	2744	chrome.exe	116
PID 2744 wrote to memory of 1044	2744	chrome.exe	116
PID 2744 wrote to memory of 3300	2744	chrome.exe	117
PID 2744 wrote to memory of 5088	2744	chrome.exe	118
PID 2744 wrote to memory of 2768	2744	chrome.exe	119
PID 2744 wrote to memory of 2336	2744	chrome.exe	120
PID 2744 wrote to memory of 2336	2744	chrome.exe	120
PID 2744 wrote to memory of 2204	2744	chrome.exe	121
PID 2744 wrote to memory of 2204	2744	chrome.exe	121
PID 2744 wrote to memory of 5116	2744	chrome.exe	122
PID 2744 wrote to memory of 5116	2744	chrome.exe	122
PID 2744 wrote to memory of 2352	2744	chrome.exe	123
PID 2744 wrote to memory of 2352	2744	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe
"C:\Users\Admin\AppData\Local\Temp\DarknessStealer-vmxU2ARt-BX5o-9lA9-AeIWQ148eolz-MWAXBDMA.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb0111c728,0x7ffb0111c734,0x7ffb0111c740
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,6797381917431142508,12372784667412379775,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,18141106716214741767,9620783816342977301,262144 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,5130341922050209255,12284876454110730654,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,6151738059167850462,2716853417315636108,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,12794636017161241850,17824231608676405763,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=1700,i,12262717584560444702,14687495814973146988,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,13440341149865193188,3330454879037586120,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,543879961497793369,7743095509933829071,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,15315282774950857230,15789509628648462220,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14529042179889835643,15857650670560511182,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,1298848960237062225,4835122515922024317,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,11175111037610036258,5858174611641373059,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:2
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5716,i,13947748737013784970,13409514961038166659,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4616,i,13400465077774925254,11107355925589777080,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3660,i,12484722165094379474,10676676825323591592,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3284,i,7734884006425234609,4478456183788533460,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,400733845561452721,14353719667444233010,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,2085707210607778659,10806590268085850774,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,14437747387675322343,8526421773171758886,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5808,i,9160701743390228128,4663415580056867559,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,13725941240247079032,1091673351670937204,524288 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4664,i,9695551561904624567,8740135388157042343,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6364,i,10959672969031414703,12423714840060132128,2097152 --field-trial-handle=2260,i,11741628135437553832,4200743791210920958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35c53e11-7c41-415f-8c9b-76bbaedb6fb7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\35c53e11-7c41-415f-8c9b-76bbaedb6fb7.tmp
Size 130KB
SHA256 51b2f6ef44791a7c285bb8e840c24767200b6d78472af3e6a04dff2b08066aa1
MD5 6b9a4dac278fe4fccb6adab093c5007b
SHA1 389188337c9ce7cac396f26b4788ca36211e3495
SHA512 8f676ea8f3129b0d1c0ac18fbf3855ffcda1f529bcfb7712d392521090b6025447a8fac60906fdded6d78462bb82facf9e270358ebb069ad9b64b834d6b8a61b
SSDEEP 3072:dY5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dY5+hFD+7t56OD9ZfSApprr
TLSH
T135D31232AA91D8BBC9FC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41adf04d-a732-4a35-aa28-e8d6ebd1c891.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\41adf04d-a732-4a35-aa28-e8d6ebd1c891.tmp
Size 275KB
SHA256 efa8145aafcb107ac103aad0eaaa41cca5d5705955ecdd697086f82b0461816b
MD5 bd8e091ca708771c477a3ec6b9263e77
SHA1 83fcccc379aa42e9c4234538fab6b220dff5f307
SHA512 07af2aa87a7a3b9a9e5a29a2f0fcad6942300dfe80086fb099fe7cc0dc0d2b3f720871b9688afea0d7a0985528f38f12b5af9f50a553def7d4dec20999a7ddde
SSDEEP 6144:C+8bubozhM5UIfI10bN4gGXVRB/d8n7M+lR+hFD+7t56OD9ZfSApprs:C+8dmU+I6bigGXTpan7ZyFSXD9ZfS4u
TLSH
T12D5423B3E480BDBB9BFC2540B2236308BD5658D945CAFD8D44972BC2E196A4E0673D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5596db9b-92b1-4d2f-9e9f-f954263fd3b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5596db9b-92b1-4d2f-9e9f-f954263fd3b8.tmp
Size 275KB
SHA256 75dd8148fc0d6749b41b4c9845bce1f316a4d06df2827cfce145fe3904a86484
MD5 98219e3611a5d24c4db574ba5a3137c1
SHA1 e27aff18504cecd42843e6496f5eef16f7c81a57
SHA512 9df5105dd69ffda8938d644bdb3efa5f9d077ffb28678781cfd2fcaaf82407923140e4db35ad2389b49ff3a867a898c1d1b4203b3478ca3a68c44b168cbb0fbd
SSDEEP 6144:Cc8bubozhM5UIfI10bN4gGXVRB/d8n7M+lR+hFD+7t56OD9ZfSApprs:Cc8dmU+I6bigGXTpan7ZyFSXD9ZfS4u
TLSH
T17F542373E480BDBB9BFC2540B2236308BD5658D945CAFDCD44972BC2E196A4E0673D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69787f38-e346-406b-8db6-8797d0ab4094.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\69787f38-e346-406b-8db6-8797d0ab4094.tmp
Size 275KB
SHA256 799456c621f84209f53346388386c91026430e0fbc11e71243c8f476bd4f7951
MD5 fdbb113dfca8835faab5fd5735c23cb9
SHA1 c35ff7924fcf64d48358fef4f43c0a34f17391a4
SHA512 7a762cecd82d1bc370f1b9a01617bd85029d06d09f6a776823f68197c9d78874637b94517ec039ef855d197dfc8a08a5a502a3ec5d8717145ea5e43e9598de7a
SSDEEP 6144:CoPbubozhM5UIfI10bN4gGXVRB/d8n7M+lR+hFD+7t56OD9ZfSApprs:CoTdmU+I6bigGXTpan7ZyFSXD9ZfS4u
TLSH
T1845423B3E480BDBB9BFC2540B2236308BD5658D945CAFDCD44972BC2E196A4E0673D39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
MD5 6ac2bdb5618eb33217283a8c2a2bbea7
SHA1 929bbd0ea4faacadcd10729d56f75f85718fe818
SHA512 210db67eaa7e247fa4c61bc2e2b4275f8573062e567be16ef70acddac71222e128e021da8a6e8867a5b5f1507c9fa736ffd85aef609528eb4c496e58ccdf5830
MD5 SHA1 SHA512

Submit Download

613b45a4-479c-4808-878b-a8e7c742c499.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\613b45a4-479c-4808-878b-a8e7c742c499.tmp
Size 12KB
SHA256 45357700fd7f5ad7ebd92f6f0cf543fc3710e457e14f979b40c1f9934426955e
MD5 26d4b92302acee5d6428b3c3ce8b16db
SHA1 11b9837ddc31970421759e6d5469d2ff342a4454
SHA512 4a68976f6b71d2cbc4373a5e1027531326dcb6c46e77f656dd0780193e6cdcbc55728c60be2faca291a47c69c33befee02c93bd0c859afabb1781785c176ea6b
SSDEEP 192:NRjcBzyD05uv71vAPRp2ak49IHsb+WNnCR4Uoe2k1H62x5esNVyIsnAUge:NRjmzywK56Xd2wctt2kU2xbe
TLSH
T13C42942EA910753B9CEBD22AF921BB5BD7F9103221952E80E6FD883C14EB5CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

760ec497-b955-4d19-8260-0723a5aa843f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\760ec497-b955-4d19-8260-0723a5aa843f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

776894fb-3539-4b96-b80d-09ae6806ea48.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\776894fb-3539-4b96-b80d-09ae6806ea48.tmp
Size 13KB
SHA256 e74b8d306413c726a3051bb3bc3504c50d4c1cd1f3b2de6d637c83670007dfbf
MD5 2dd72cc57d88ad09f3854c577cd804d6
SHA1 4b9c52e882652185db8d8e9f0289b6e709cf597b
SHA512 bb2900254855e73470bc291ce0df78dee92fafe4ebfb1d355587ff14dd2eaa1f649ab7077a08a7adf02a9c8187170d534f6bdd3c76aae234a9487f10b120076c
SSDEEP 192:6RjcBzyD05uv71vAPRp2vwokufO9IHsb+WNpWlZjIaczBUoeNVy2pH62x5esgVyN:6RjmzywK56XD2wpWPj0itu2Q2xkE
TLSH
T1EC52B72AE920397B9CEBD22AF921B71BD7F5102261852E84E6FC893C14EB5CC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9a003b-eae7-4330-9a7f-77927709e7be.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b9a003b-eae7-4330-9a7f-77927709e7be.tmp
Size 13KB
SHA256 cac635c552f140a47477707be2eebc2be0bfe31c87648a26502d0605c18cf9e6
MD5 8da6cc2cd7d97d939dab0a2215626195
SHA1 c3f76b9a6a34501c70b830cf91c80cfc443b8272
SHA512 252b2ae3307b8d7d5c3edbbb7bfdab5389ddab0f1d95b02791ba4ea0dfd74adf968382b563bf1dfdf1e9c557deb7ca17843f57e41866e7d0fa9d270e465ba8de
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3YFHGZVt7ShEjEH:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEz
TLSH
T14D520A67A84C9A3F0FD8CA4DCC12AF4FADF501576668492457FB9C18039A7CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 78KB
SHA256 e35e5dcd69d2cef0eb8d0c70954e33c271d7455704fd05c2a2e1d12fa42584c3
MD5 3eb646c53642ded8315b91770e2f1d7a
SHA1 3dd89b63de3c47f5841b02f0fbb8ea9f50169583
SHA512 962cc14a1f6fd7481e506985b17b0f6373ca0c94d0fedec0e461b17b84dd9cd900db8688351deae61e1fe033f8a6d74999d70ac432c303ec1399e86e8ee3f4fb
SSDEEP 1536:+Q3yhf6qdIjJvoibt1mk2W7sPyDuhjwMZ0wwNHpqhEaVf8:+Q3BqdYV1mkYPyDWjb0w0HAhEh
TLSH
T10F7312F451E0F9BD51FAEE67CF95C38606DE865EE1CE2908EE1190730F0ADD850A115A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 55KB
SHA256 2fa7a986bba55448bb3bea38e9f868f154448fd16a087681e18c99783916c100
MD5 433265aa6156bb57ef954ad980abd8a5
SHA1 34653b26800360daa0e8b6c9ebd13d55615e8702
SHA512 cc9bd42ab014cde73028ffaaa1d7ac0f8c4076fddf862527f041edf3a3d0506d41ce2c352c831f6b3b8ff150ac2f79c712970285002488c6e6082b9978953af0
SSDEEP 1536:5dt8haS8TCanjdBmLNRHgP+xDogCdZNBN3Kjp3ASj:3t85Ri655gWxtUPKjlA0
TLSH
T1CC43026C22FB4A76C4D467344B92AE44E7A279E09202CCB974FE35D85361D86370FA3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 48KB
SHA256 fc884f9a6a1ac0c316b64ea5941b8f86fb8e2927d6e799d3b284481d25edf167
MD5 d4db5dd6c46af559c002f1bda98f2fa0
SHA1 889fd305560908983519c41e91f90e57a5c3d4ad
SHA512 e8629a71ebe93ede7e8fdd327e74cf589d04e5914fc2bcaf9cc89b425b2e0b515dcfff6e9bfc1f9d20bbe5b1d485333ddfbda1e96748afdf9d22c321b522c5d4
SSDEEP 768:YuW8tiZkxXtt5nXXMLEn5jv18mUZpXZQBbw5SvZbvk+km9YO2hcmhXkAscHrtd:7tiZk15jX8mUrVsW+IO2hcm4cLtd
TLSH
T1EE23F1B4E85E01E1D326BA380E585B31D23FC909320577CBC93E72E6BABC4955D66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 55KB
SHA256 d7658408d8f06bf716e513255aa0b08c42c6486f06e6087114d733059f6f0fc5
MD5 c8b52ce68625654fa7b63a0c9f7dab34
SHA1 1a53e9c4f07c88abdb24ce8ff1a441f08522efd6
SHA512 eea730295120ebb1ee26fbd4a44e77e035d39245b6e257e198e997c112a11396c0c304aef68576bbbc43eedb926c5721ede62ef8a1205b368def805af793bd2f
SSDEEP 1536:0x05wOW/wh1kTuED658H4BX72M+Hw7eKR:0xKwFIh1ShwXiM+HqR
TLSH
T1B4430246137408C2EDE53F70E37D261397790BCE4C3E8B2B86D9357092B522A76BB824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 47KB
SHA256 150505ce74e632a9b58e1e5d3f1141f18a64a2a3b4f54d4e977c295421fb4b93
MD5 9650c55207efc5b65d61069ffd14e2af
SHA1 b3528adc736d4893175ec460d9d512fded8be594
SHA512 52d7a03f713dd0a706af321b90d285d54ef9768079ba3debfb877f070e8914600f64d36997c5dd338cd4d937485c919550286f1076cae938f4108dfc8cd6b446
SSDEEP 768:Z1g5Zoun/5KOyg5BL5ByYtMNqEYMQ6JUMeyacNKJQNsibM0xH5/SlgRM02T7pM:Z1OD5ICL5By/8MjBeVclgeODHpM
TLSH
T1CD23F2DD16C2EA22ED2CC7356011B5F1A968E8654353B3CB17F56AD3BD418268F1B821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 70KB
SHA256 7e7530bc505da7a93e0d1e9ce02660366a27e26295b035253f7737b4f1680038
MD5 c78b61ffedfc20fa20b429139d8e5076
SHA1 ed61e21857f8e7be2446e99e69bd1169572654b7
SHA512 f421515b3e424bc90479e059d9d3a76ae192e79233d5b06d8d13d724ce1c19e1b22bcfc392ffcfe9865f1fa4a55f435b9cb86719261391a7cd75c6f040e081d5
SSDEEP 1536:8BgL/Qu3zV7rF0jVJynxzwq7uC/vyJG79ti:8BRu3BWcwwXEG77i
TLSH
T10463025B854AD232E3724C775AB80DCF525192286CC7652DFD36BB2907E0A69F4CCE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 399KB
SHA256 70ac30ff5b5d0fd9d1284617dc3172fa4d7d857ffe330bfd49c7dc6a38e80eae
MD5 2d0d92a47140a5c59a4e3db9bb61eb09
SHA1 33618fa0f6644092ca7d9f0187d131a3af3390a4
SHA512 9b40777cc42b0d827219173e11104cd898660082c0119701055a39f34676ec46e18be84d993c0f559a920cb0170463e8acbd46c90b07dcb83586871bd42b751b
SSDEEP 12288:wS8ZfRgAnWUFSn/x5i2J1phF9+rVFyv5bOjehq/bNAZUzqrEzkc:JqAJ5iup2FA5bOa45Bzzkc
TLSH
T1089423AABB9156D4E68A0534B186570EFAF8A1C9B705B7931FD0712A418E7CD0B0CFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 461KB
SHA256 8d0128a982a2c8978d0598add5d1bf6e4c8b087fca0be4d71207f511f2a21b62
MD5 d2233a0315bd3cc97ca02f15ccf430c0
SHA1 232cff5f9827acb7897e41a5a7fd512ed2279833
SHA512 650f8fbf5eeabcc7c66e5d78b3b5f70537605c4521832caf0be40bb0b3804a8b3b33e8d1be931caec2c412ffff97e9d634f2151748e8f0f52430920fee827d51
SSDEEP 6144:SpwOooCHwB1ypmNh6h9rA+qZqE+zRfTu2XUXc4jyqmNQJLgXf7a/CYER1dLEiIRy:wZNi0Gj/fTwXvyqmhgMlEiULgV
TLSH
T1CCA42301271DF14CE7897532F4CC1647086ADCABA00A2389CAA9B45637B6914DFBEF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Size 364KB
SHA256 41074426c562d14dfe1fc0b2d877a8545954b93e62106f12e8654944f1eeb298
MD5 16bb345f7e0ba8a96f9746b625cb4d42
SHA1 56ce7e8b3f0139d2f869beee482df9200d5e6b0c
SHA512 a220e5791fb78cdc857f43f0467e598da9c46869b93a4ab1da82bb275f772b61927e4fa190e993e5ce5714f93fdb07eb0bfa82d3bcf021525b3c65b110ac1b39
SSDEEP 6144:3zIpX4MxqCmsyidZ9baSU3lHx5mQcOiL0TJF5zzyCiCHu3ONB7dQzWoEesfc2uB3:3UpX4ZsyidZ9WRpxAQliUzFJu3ONB7eT
TLSH
T1F58423411B0E1480E9255472F06283D2E0B5F54A5CEF1DCFE79A48BA1BE71FE84E627E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c
Size 49KB
SHA256 32276b92c025b4bca01261aea74f70be21ad73efd66063b8de4497b211bb47bc
MD5 c27afea97d5c24a7451be1581be8e212
SHA1 7bbeae8699203a20539f0abe0fa4e4ebb0d9bae6
SHA512 aa332f80ef107e69c25c807845379d8f9e7cc2c9a5664b564fae9ab00c55cea054d94b1886d24f3ded57866a26fa52634b369956dca79d2a121212796b0cacea
SSDEEP 768:eDI///SkMt+6HSLJPCh1Cfkv6jpRuNQ8JCslFdWM9Bw6JD6XDqN7cKwveOTG5:sAM9IJPCh1CfkiknpPP807cKwv9q5
TLSH
T1B233F25C7DD72593C46DAABE88B548EB14B202F06F4F3E8602A7E87EC470C9FC549808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
Size 52KB
SHA256 04215dce713e4cafd41c2d02df5a22d49ca5bbdcc730b2c0665fbaf922a1f5b5
MD5 36f73a10c6426caa40adab2c2c7a8a3e
SHA1 58a52ad1c46148e9e8794cc26d4748b58ff1305f
SHA512 6de9a4184650b09bbaccd125516b2b2b68eb36fb589efec0a54c58a0970a89c8ca3f5b553b5a703bac6ce790924720b1f7705823bbdcddfec46d1e41833697ec
SSDEEP 1536:/h0KDlvrPChxJDQCKIGdWB6csUdcKft8O:/hTv7An0CKIGoB6cpqKaO
TLSH
T1AE33D060594F326EEF5FA403A803DF37F9A22331317BD4116CBD9ADB6D511B28592B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d
Size 351KB
SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
MD5 177db3ca83855050190c58b9c71d3cd9
SHA1 21fb057e463f4237191d645a21a2a3400672d15b
SHA512 f2629f151db750cc78bad4416de2df6c6940a95b5dd1039b515d17cac48e5ca9ffb4bbc86a4e7d83ed3f62b520a294ce409028a5673fe28e69f4b8d48b4860f2
SSDEEP 6144:oaGsIQecJMjhhC8i6HmsMpFPUn8eIPUrXvT1IBgsiYkkQMI3hkKxdlxQQRFJD:TGsIQJJUhhCbgSs8eqCXfdYRpMh5xdlh
TLSH
T1E47422A98FF18BF50A635D4C6CBFC1250CB6C7E9818837582934B5004F99986FEDEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 368a909bffa00d7672dfa38ae8ba2f59a84a2b9f609e59c2518198663a9305e1
MD5 a046b6e08db10dc806aba6b562b0dc4e
SHA1 38b5e9a4136fe4cf6552879ac9f38d057deceb26
SHA512 85482f692a3eeb9263e1ac35ff5c7210261396e753359b0c02b0dc7b8ddf625765522fbaf24bcd5cab5c60fe82221d7676a35edb23a7ac12e2a466b7d98cc193
TLSH
T1BE312DC5244C5846CB4CCC7918E0304CF9FD512638B7AFA7A18484B95D7E3B99786F75
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 d2ca0ab81fd1f58126cb9ed0cbe02dd747373c6ebc313b86c0fa8ff0f5db18fb
MD5 8b52c9a257e7df1bee6de712260db061
SHA1 5bdab19a7060e7523b236e7570634e54168ff866
SHA512 55d22c6e5eb27af9dac74d83574264151ddea8b6da2485ad7b5d1cbaa0e63fcb4f6fed13ed897ec769d354517d2b409c42dcdcaade2ce4dc95b238249ad7b2fd
TLSH
T1BC513F842CDD0C1ACF0CCCB615D83A4CF2FD813634B66F93A0425479487B3F9A69AE68
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04fb21e1-6080-4fcd-8eb2-625bd7794d8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\04fb21e1-6080-4fcd-8eb2-625bd7794d8f.tmp
Size 1KB
SHA256 84277738ab52eb47783522cc7e4d245eccc550a7d9fb72bd428ab7fe9369b580
MD5 7c3b7488686b6cbfa1ded982cc6ed47c
SHA1 c66f1a70f4c157e3a1c15b4b71dafed8d2aaf366
SHA512 48fef43590037606e58e9044281bd84fd9efc8cfff49e9163df848b4089ae27926aa67ae978076de794b95073edafdc8272fd2839c42b31e72e3b52d071764d1
TLSH
T11631ABA7A6BEF87B513A08B70E4C7C0554BEB434414264E8DA57A36CF0C2CF7270A152
MD5 SHA1 SHA512 TLSH

Submit Download

65185516-ee37-4d10-9962-62932177fd5f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\65185516-ee37-4d10-9962-62932177fd5f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7308926e-bdd8-4cf7-aa62-ffe87ac4e336.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7308926e-bdd8-4cf7-aa62-ffe87ac4e336.tmp
Size 17KB
SHA256 820c4bbea4486c671bf0b8f802e0b699c611c4712fb0fd0c61b1a718c4391761
MD5 e83acc8538b6b393ba10ab10c43c8837
SHA1 5527953bdef63edb212fa6a75b017579e333a9ac
SHA512 a579308d020d68208189b522f520f521a2290b0767d6f8c8434a0787f3ba212d37353fee59a15ed4af8b8b58776fa58c44fd229dcdca9086b74535755b24b2bb
SSDEEP 384:DoJfY9rfJx4ZvcJFCwaGuohYlcuJMmSIuUq8k5cq/NXaXSfo1kGaWQ9GVAx3NSsF:PcRWqeonPIP2qsol3
TLSH
T1E682ABB7C3D8862DC91126F4AB246E1BCE2D1D14832D3D5BC9D9AF0BA7E2471D28074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 702c412f7264b6480a5f6b8f2561a64bf9389c327398033ed89f64ad8f8ec1c8
MD5 6b03f9a94808751629846462c390a891
SHA1 a61e126ceeca25ad9a9308ff856d31064cfced3d
SHA512 e4e2382a72c41103719c2ede12d878a0afd10eaed151b1b922ac880b0d887502d226dd8b02a31ff68bf6caf95a44957bc7d4b11b5635522fec457a03f46e88cc
TLSH
T1A3B012A949411D01D0200B3152C7008062214D00730B43260092043144282554107A10
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 c8e12a7ed80a6d5fda9baaf0da4f8ffcdc1ce176ec6c1ef88e4a2f6ed7b68a31
MD5 32304a1e656a9002e7d2732fcdfc026e
SHA1 2bc95915a7528890951972205e2fa3d5a6caf05d
SHA512 f1b6bce55853779d55a272de98db41a06145210177891f5965e521fbfc739f6c4c69cc665201ba528d8cdb55dcb9311428483cc96c60138d816eee41029662c9
TLSH
T14AA0029452D84512DD458F7170A11D4626518D391D99830354915484CCBB1E08543280
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

d350597c-1afa-4f43-80dd-62bdc9ce7c79.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\d350597c-1afa-4f43-80dd-62bdc9ce7c79.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c5e14232-3555-49f7-81f9-29646b361eef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c5e14232-3555-49f7-81f9-29646b361eef.tmp
Size 414B
SHA256 64090ba8852c65ac6687c42019f99d798d7b553246fcfb1b513af73d447b0ce5
MD5 6abc5d80830d05898c160bc3970d52db
SHA1 025670fb4d8af9e587bbe6d0f8d3c759f91a6eda
SHA512 54667b1f48b9ed535bc78b7a6ad799ada38df4ee0fe2c7a4ea4011343d0d03318b8a8fe937f9345a2f34844d1a6c0dc53b47307ec690401c698f5a490995934d
TLSH
T107E02BAACD35EC7728FC0B285050474AFA8013572691990F373DD10DCFF527A458791C
MD5 SHA1 SHA512 TLSH

Submit Download

f5367979-43b3-418d-9282-ba6ba1566b3b.tmp

Path C:\Users\Admin\AppData\Local\Temp\f5367979-43b3-418d-9282-ba6ba1566b3b.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_290238223\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4876-0-0x0000000000A80000-0x0000000000A94000-memory.dmp

Download

memory/4876-1-0x000000001B760000-0x000000001B770000-memory.dmp

Download

memory/4876-5-0x0000000002E50000-0x0000000002E5A000-memory.dmp

Download

memory/4876-6-0x000000001B6B0000-0x000000001B6C2000-memory.dmp

Download