ratonrat | 9aeb2df45dc12be8a84804fc2061f9c4440b41caf61cf30bf48ac42acf45f7ec

Analysis

user interaction
yes
max time kernel
321s
max time network
323s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RatonButCooler.zip
Size 28.2MB
Sample261112-gjfa8ad191
SHA256 9aeb2df45dc12be8a84804fc2061f9c4440b41caf61cf30bf48ac42acf45f7ec
MD5 633c40304e90030a49fcc5bef70d3ca0
SHA1 d12bb9af5a2137f261a2e256a9a12c5f3fd30f74
SHA512 2f02aa8fdb588b34a61d0f5e67b35341154ff8563c9f010c6101fe0b7543da667451ff5eef3ea063587cbaac8a9708ae238a2f053313ac664cb0dad0b1ecdac5
SSDEEP 786432:OmjySz/tc82vUsSRu2796xTVFqKs2z+f+w+Uztu:bvLtc82v696xxFzt6meM
TLSH
T1555733E5D20F8512F4DBDFBB50ED4CEAB37DB581A980B1BF1E16819819E7CC86509A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery ratonrat persistence ransomware stealer

Malware Config

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2740-658-0x000001A1F6130000-0x000001A1F70B0000-memory.dmp	family_ratonrat

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	api.gofile.io
44	api.gofile.io

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	wtfismyip.com
10	ipapi.co
54	ipapi.co
55	wtfismyip.com
57	wtfismyip.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
616	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{DF808619-C25B-481C-BA04-88D5F4C179C1}	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
6004	chrome.exe
6004	chrome.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe
4480	Raton.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
4480	Raton.exe
4480	Raton.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
4480	Raton.exe
4480	Raton.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 5008	5684	chrome.exe	92
PID 5684 wrote to memory of 3268	5684	chrome.exe	94
PID 5684 wrote to memory of 616	5684	chrome.exe	93
PID 5684 wrote to memory of 3268	5684	chrome.exe	94
PID 5684 wrote to memory of 3004	5684	chrome.exe	96
PID 5684 wrote to memory of 3004	5684	chrome.exe	96
PID 5684 wrote to memory of 4056	5684	chrome.exe	97
PID 5684 wrote to memory of 1252	5684	chrome.exe	98
PID 5684 wrote to memory of 4056	5684	chrome.exe	97
PID 5684 wrote to memory of 1252	5684	chrome.exe	98
PID 5684 wrote to memory of 1956	5684	chrome.exe	99
PID 5684 wrote to memory of 1956	5684	chrome.exe	99
PID 5684 wrote to memory of 4912	5684	chrome.exe	100
PID 5684 wrote to memory of 4912	5684	chrome.exe	100
PID 5684 wrote to memory of 4204	5684	chrome.exe	101
PID 5684 wrote to memory of 5324	5684	chrome.exe	102
PID 5684 wrote to memory of 5324	5684	chrome.exe	102
PID 5684 wrote to memory of 5980	5684	chrome.exe	103
PID 5684 wrote to memory of 5980	5684	chrome.exe	103
PID 5684 wrote to memory of 5012	5684	chrome.exe	107
PID 5684 wrote to memory of 4988	5684	chrome.exe	108
PID 5684 wrote to memory of 2720	5684	chrome.exe	109
PID 5684 wrote to memory of 5012	5684	chrome.exe	107
PID 5684 wrote to memory of 4988	5684	chrome.exe	108
PID 5684 wrote to memory of 2720	5684	chrome.exe	109
PID 5684 wrote to memory of 5908	5684	chrome.exe	110
PID 5684 wrote to memory of 5908	5684	chrome.exe	110
PID 5684 wrote to memory of 1876	5684	chrome.exe	111
PID 5684 wrote to memory of 1876	5684	chrome.exe	111
PID 5684 wrote to memory of 1096	5684	chrome.exe	112
PID 5684 wrote to memory of 1096	5684	chrome.exe	112
PID 5684 wrote to memory of 5224	5684	chrome.exe	113
PID 5684 wrote to memory of 5224	5684	chrome.exe	113
PID 5684 wrote to memory of 4328	5684	chrome.exe	114
PID 5684 wrote to memory of 5388	5684	chrome.exe	115
PID 5684 wrote to memory of 4328	5684	chrome.exe	114
PID 5684 wrote to memory of 5388	5684	chrome.exe	115
PID 5684 wrote to memory of 5184	5684	chrome.exe	116
PID 5684 wrote to memory of 712	5684	chrome.exe	117
PID 5684 wrote to memory of 5184	5684	chrome.exe	116
PID 5684 wrote to memory of 712	5684	chrome.exe	117
PID 5684 wrote to memory of 3656	5684	chrome.exe	118
PID 5684 wrote to memory of 3656	5684	chrome.exe	118
PID 5684 wrote to memory of 5960	5684	chrome.exe	119
PID 5684 wrote to memory of 912	5684	chrome.exe	120
PID 5684 wrote to memory of 1380	5684	chrome.exe	121
PID 5684 wrote to memory of 5448	5684	chrome.exe	122
PID 5684 wrote to memory of 5448	5684	chrome.exe	122
PID 5684 wrote to memory of 6096	5684	chrome.exe	123
PID 5684 wrote to memory of 6096	5684	chrome.exe	123
PID 5684 wrote to memory of 5888	5684	chrome.exe	124
PID 5684 wrote to memory of 6004	5684	chrome.exe	129
PID 2740 wrote to memory of 4480	2740	Raton.exe	130
PID 5684 wrote to memory of 4464	5684	chrome.exe	131
PID 5684 wrote to memory of 4464	5684	chrome.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\RatonButCooler.zip
1⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffd84d9c728,0x7ffd84d9c734,0x7ffd84d9c740
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,9018231565321306185,113464897085250732,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
  2⤵
  - System Time Discovery
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,8065891402518651928,7459545321353060856,262144 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,12713851423959859605,2364291674008401322,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:13
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,10073493189366251030,17485457044858983508,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,3037268518158541772,8161142457508361441,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,13725469577712769298,919515623651225487,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,3890241626723883279,13850106898234008382,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,844527005662755355,18317241964789643559,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,12428839181215972733,1421682405689905042,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5560,i,6641137396679478523,17667809437316439556,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,3938603698395300207,7918925100543462268,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,7471748229353214560,11884632428160819732,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,14011760395459744777,4666641005310979827,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6196,i,10391788209304552296,9586924520873945861,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6124,i,5380503723333590328,15788405638342364062,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,5756302577199920802,11949241918447757369,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5440,i,12888294332928052629,6609452406768727391,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5696,i,10779514954393665944,360814832455789464,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,11849618011627889017,6017283749346921870,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5692,i,16715540764388488013,337465176135918957,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4720,i,2231085145108827168,15522727756351742032,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:9
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5428,i,14063437740119869311,17333198135337937497,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,10367343241200916891,11374503610239433761,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,781615782709263543,3762505412370712857,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,11081598754808053294,12597970202210059676,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3608,i,5481333826289494385,17360257768277035927,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3164,i,5172871066040516214,7124504869107199518,2097152 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,15875071772963955348,12486247139822838111,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6068,i,9899967558989527152,13445504727213359179,262144 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,565249015645033804,11076821719694823279,524288 --field-trial-handle=1984,i,250747055967067477,3878085489621056025,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:4464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4116

C:\Users\Admin\Downloads\RatonButCooler\Free\Raton.exe
"C:\Users\Admin\Downloads\RatonButCooler\Free\Raton.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\Downloads\RatonButCooler\Free\Raton.exe
  "C:\Users\Admin\Downloads\RatonButCooler\Free\Raton.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x0000000000000500
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

091671d3-9207-4e2e-8a24-ddfe0b9824cb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\091671d3-9207-4e2e-8a24-ddfe0b9824cb.tmp
Size 151KB
SHA256 4bc26eb2165173b63a29b34e6af76e171a631023add0ffd07f47d2d2900e7899
MD5 906c9383ee0eedf59bc75820480b7ac3
SHA1 a5b8771a3cb0dbcb2b14805df5e1105915197a7e
SHA512 f061e709001ffd4b111bfc8465c57b80762481e93631659e043c489c137767d8f1deaac18060a7766f500b60297d0c4f0396e6c244a4ef098744b33981b88973
SSDEEP 3072:9oOYLmK5dXox7kialzQfS03uU+J+85KbZgpEfpA/vj38HDlgFNGiHH2JTC:OmK5CkhlzQL+U+Jv5KqpESr38qFNGiHB
TLSH
T10AE312B1E98DBBDF46BE395F5A7A362A0D5AC0CF8444AC1CE4E54A79011E85F1B41C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67cc473c-2de9-4f7f-8c61-3fe1af8da092.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\67cc473c-2de9-4f7f-8c61-3fe1af8da092.tmp
Size 151KB
SHA256 df32f0b3bee095a00830aa96ee08349ba086fa869765a1769321304358456707
MD5 3d18ce89ab126c77d151db79920ee5cf
SHA1 10c9aa76eceeba3ecb3ef6e626002126281f749e
SHA512 de1bd8208a85096f1d3d240efe6144823803966c1c07dbd1adade70cb02ca171c88d0cd16bb6edcd6e762714d7f01ab7d42510cbd01d1541ac1d1d3e9cbe2a08
SSDEEP 3072:hoOYLmK5dXox7kialzQfS03uU+J+85KbZgpEfpA/vj38HDlgFNGiHH2JTC:amK5CkhlzQL+U+Jv5KqpESr38qFNGiHB
TLSH
T15AE312B1ED8DBBDF46BE395F5A7A362A0D5AC0CF8444AC1CE4E54A79021E85F1B41C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c1fa0c1-516c-4149-b711-23fa2637a007.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6c1fa0c1-516c-4149-b711-23fa2637a007.tmp
Size 150KB
SHA256 c1bb796e6219c6aee857bb8394da8aa6dd83fb0c4190971e55f5e993e91c1a34
MD5 6409d9cfd9b5cb147586d31df463bc71
SHA1 41dcf8d112fcb1cd326e18737f72f4fbbbe1614d
SHA512 4b2b5dd6cf69bc1d208605e11ed8197bcdfc4a27792c3f8e26422e582974a3acea7dcb602d50cc3d4e6b1d6f8092edc395af42131b80b9beb05d0a9fc11300ec
SSDEEP 3072:xoOYLmK5dXox7kialzQfS03uU+J+85KbZgpEfpA/vj38HDlgFNGiHH2JTC:qmK5CkhlzQL+U+Jv5KqpESr38qFNGiHB
TLSH
T163E313F0DA8DBBDF46BE756F5A7B352F0A1A80DA40549C19E1E54A7C021E85F1B40D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

895ab04e-dac6-4712-a677-58c95bb8a098.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\895ab04e-dac6-4712-a677-58c95bb8a098.tmp
Size 150KB
SHA256 a5cc3e03f73b782acca25449a2f1f61e69a495184346b745c224b8fdcd8b4d9a
MD5 30dcea81eb555db36bb94075b54c4b94
SHA1 1ef1188d68879219572438bc417aba38b620ed93
SHA512 bd008bff1104316d30a51fb469fb84dd8ae2d83b861a60a944b81688fcf0031a3a90457aca52aee49eea5bc4bd6107d7b0b6527109f9b58af886d8bca7431ce2
SSDEEP 3072:4oOYLmK5dXox7kialzQfS03uU+J+85KbZgpEfpA/vj38HDlgFNGiHH2JTC:BmK5CkhlzQL+U+Jv5KqpESr38qFNGiHB
TLSH
T101E313F0DA8DBBDF46BE752F5A7B352F0A1A80DA40549C19E1E64A7C021E85F1B40D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c650441-9ec4-4c34-89e1-f2f66e49ce8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3c650441-9ec4-4c34-89e1-f2f66e49ce8f.tmp
Size 11KB
SHA256 21821a87f71ae6f53a643d314a01e9e278947a707fd2999be6ba1dce1442ce67
MD5 180006529a3e368f60c00653ff06939b
SHA1 edcacca5aea993c1fe00399526b195a8a028f462
SHA512 5f8d941ff7d0f4a4dfbdce412c7bd54545c56672c818eb26b3fdf0752f0eb3977b88174eb118563b50cace42fbf15f1b511b940e04f9a1c1e599d0a70f57e768
SSDEEP 192:BRqviZ6v7IAPRp2WXrXsb+WNnqxUXE2fV923e4aOBjPviyIsnAUge:BRqviZWVX1XwIX2t92pa+P6e
TLSH
T1EA42A52DEA11793B6CDBC219E9667B4BE3F6102676811E80EAFC883C24D79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e658fc6-a7ae-4502-aa8b-ca0af0a8f809.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e658fc6-a7ae-4502-aa8b-ca0af0a8f809.tmp
Size 13KB
SHA256 4417abf67bc2cbe418ed5c50b9939257b409c6f344acc6402cc7557949073895
MD5 b1e0fb55c2c2703a783076e469340d06
SHA1 3c5b6149fc2fdde064f531088c66cad6ca8ea211
SHA512 dcfe6b32cf8e8d442c7fb051eb7764494f1991ba7b4b1d21205e2920ed988ce81603b1e47aa8ca93191dd33aecd17e01e2cb0640398026a74bb075146a738a60
SSDEEP 384:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnXODMH+ErU3avHGPr4UfKPjh/h9:geMr7KxkXqKf/pUZNCgVLH2Hfgs/XOot
TLSH
T113520927688D963F4FD8D98CDC22BF4FACF501566668092496FB9C1803957CF124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7740239c-9432-48eb-bf4c-42c09e77a2ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7740239c-9432-48eb-bf4c-42c09e77a2ba.tmp
Size 12KB
SHA256 b28eea0ab7b8ffb089e2ffd4272b0cc515bf1e91972cb22f338bbbe4662e5d73
MD5 8fc51374f6a0c24e98120053f39154bf
SHA1 9a555335e5e58669da2c060e8e1f2029dd143e23
SHA512 0e68651f168223b6269392547b75a11ee5bf4f156fe7afe856a88597f745affed526767d8da9d99b4be0a7bff63639b6b6024d9e9d839ded8700eab513b88c1e
SSDEEP 192:BRqxiZWEv7IMPRpv1W4l8rXsb+WNu5qx32taHUe5V923e4aO6jPviyIsnAUgE:BRqxiZVlXsXwxMlen92pa5P6E
TLSH
T1A952A629AA11693B5CEBC219F965BB5BE3F5102276901E84FAFC882C24E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fdbf7c9-445f-4277-86cf-1cf0ec94fa56.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9fdbf7c9-445f-4277-86cf-1cf0ec94fa56.tmp
Size 12KB
SHA256 68e2ecaf6da8adbe3d8ff5d87fa4d14d0421d40a0a8aa0f1dd9fa5393a15b60e
MD5 fbbbec261e11567af792208f5db9ac67
SHA1 40055cea83bb69085c57d4d56b25d4a194ad134b
SHA512 905b2ff5bcdda57ba50f05d0712355296dc471285d2be994757e6c165af3ee8d1998f1ed7ef4e72db14396df46d7b53994cafcf96dbf8c9eed341d03eb937f75
SSDEEP 192:BRqxiNWEv7IMPRpv1W4l8rXsb+WNu5qx32taHUe5V923e4aO6jPviyIsnAUgE:BRqxiNVlXsXwxMlen92pa5P6E
TLSH
T1FA52B629AA11693B6CEBC219F965BB5BE3F5102276901E84EAFC882C24D79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 60KB
SHA256 513786148d5b313a004f530e7610bcd56c032a5e4a2e89f2a99558c9d2d07cbc
MD5 d6a098ab4add5cf575ca233fe9d59706
SHA1 03d2c8889ee42b14e6b74a2233ca7dd6e12fd004
SHA512 40efdef738e7beb5d995f7489452abfcc49c82c73cb4bb067c5cf12bc9ba08bbb1789db03682ec44a572443e1f5a07f4e24ba0d6cc6809e8b61944dd51f40870
SSDEEP 1536:Raod+pfwZjXJHM7zzGZzac+Up2BxaA18ggpxNeZ:P+pYhXS7zHrUG8zpLU
TLSH
T17953F1D2927A258412117DF1DB3FA9F203CB1F536F27A28776C05D28265CDD83B29B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 96KB
SHA256 430586a6f360ee97cc624ef4872625366094e6a3a6219e0adf29ee4d2264a949
MD5 786e3c488d534b5c421d4f258b080923
SHA1 3860c7f99f5160453b35b6c73a7cd71892d92126
SHA512 9b3ef4fa77d02b02f84ceae182644296ce3ca2b56109be775095f7cb87247a75d58d05e6c01b3f103993443b4a3828f3372a653d1ff6ce94b03f8c5c3a581266
SSDEEP 1536:HTa4GlHtCJCyaqDqmoVQ6ObTR02se39PGiKVbzdP9qQ/e7Hqh:tGNNyaqJoVYUK9WFjqqe7Kh
TLSH
T193A31268D99C7B45F6F932FCE1141456276E987BCE0953B7EC008AB3DC63391A1A8E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 1d5287698229646fd8d89d871b3856e9f320bff1f54d12d242f2d9d1f3f1837f
MD5 1040a3c6b3e33e450b0dc0175ed99395
SHA1 f7099ea3180c3e9bcb328a5295f678fe566e0ee1
SHA512 83aeedc1821008a582d094f771ca2aec7e21a9b5774c9947d6a82767a221da41c16a6d4951335879a20a83ac7eaa48b9eaef3119004705d8f89527fc4b6b5e84
TLSH
T131211BA1B98C2821D75042B859CDF2787EF1C2E0473FAFA740F638F9D602B971E110A0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

312f8764-4abe-4466-b7b0-e126f5bc6c82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\312f8764-4abe-4466-b7b0-e126f5bc6c82.tmp
Size 4KB
SHA256 02204e18fa73efdc62c5bab6c76be3faf96516a2bfc87af2caba8405c032dc5a
MD5 f1d0192f0ce432cc5c71acb5d158ced8
SHA1 21415308ee43d5b0399c75af95fee97d8f9c6333
SHA512 ceb2f9176f970d2250aff493ecc8beb61909be9fe95de89483150d4ac8ca75ab248c5e0214656a657ffb460efaa255bba34cc402eed621d6d10499f203bb6c6d
SSDEEP 48:YALlqZq4hPQJdJCsZRsd4svfsBosTKKsQQ8zsvQtJzsTQmQcsYHSP+ybzs4wzs0y:D6NxQ9GvQDKyQRQ+QmQ8HSP+ypxy8F
TLSH
T198918DF3C3E8857D882256F49B216E2FCE691925432C3D768DD4AE4B63F2972D20074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2fea830-2b65-47c9-8799-a1736aa88762.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b2fea830-2b65-47c9-8799-a1736aa88762.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 375face296a41b7d56bfc54061a68fd7f12d57f4774bd9b891c474dca97d3f97
MD5 2c34d98d36b1b9d218f25a27d7f239f7
SHA1 014c151e6c23f351d02838e4a5af2c6feac52911
SHA512 a06499bd9e9c06d28c8f9ab74d599348fa7121567e055c2f37fe1f1a5a7b2f3ee7dcb8e0055e4530de28d17571cab87715636a267560cf388bc93e290dbb37ef
TLSH
T18AA0025083C44921DD0193B060AA0A61A791D8345F5E43037C910844CF5F2C58203144
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 c18c6836c8df08dc2ebe41dc9c9182e1eb81e916a0cb7e4475926eec3c25400b
MD5 1e47a4fa585bfe543c253112e2d6c77c
SHA1 0a58e0e81a6f1ae6805ef941b87832173c1d3a9b
SHA512 768260c078ee46aa0657ad9a031e2478ac702eb1f0888903a1f4407c5e7b663925f31124c98c2d084b95b3290335dcf86385d3d3f107a76c508128c401742e85
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\128.png
Size 1KB
SHA256 a57ffe3b3cd0a1bafe37e36daa89d2f9afb9446423cba25df883ab0f9aa8293a
MD5 9295ccfcfaab83ea13efa316c38b3a93
SHA1 17685f106ff0100d023aa04523b224b41d97150a
SHA512 632817c62a660870d45d0012c942526fc70652ea56b2e1246a5b19ada4a8c9731be2c3de0764889a3e70580e5da8419eb80659e0aaa31ba5491e76adf652f320
TLSH
T1E241C8E18519C1BCC22496B59954928F173A441A7F514F9D6CA524AA30A0E239ACCF9D
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\192.png
Size 1KB
SHA256 f25ab19c435c2cb43e7d86b9bf58f46ec8af6228bc4511d4c5cb9d23e1cc4c04
MD5 0d530f9a7987017eb38f626e93a0f482
SHA1 9d71c8ed3fa5a183988c5409fa2c27369d1c25b9
SHA512 a7c4c250acafc1fa7ec5f972c9165bb3b1ba8ea30f28a5a0c0d313005656dd8f35b2ffc518f13bc08bd263bfb6c08a57e86c5f01fffdae6b1490ab6c8e57c3b9
TLSH
T19B2195438636D5F3DDC7C32BD110519CCC1E871F1D522795ACF0AAA211F9E48667E6C1
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\256.png
Size 4KB
SHA256 dee5357bd2992efefb04ed8bbb64dbf7becd768d75dff17dcb2b335c4fd2a903
MD5 b0fd3fdd04e2a0768a1278a5f85bc70e
SHA1 9fa05567b006c633b5da7d55229cdf0d8649989d
SHA512 7e29a0e2539057198cf9ed3cff1518def95fdf3a43abffc36095536817f78ebd6196880070583fe07528d9d2086312df6b83d8f9ef128c7377fdf00ee9bad4d8
SSDEEP 96:YSMrDxFxPilv8S5q770AP5lTj7777BPI87777720B48BEj:Er9720Uq770w5l37777tI8777772pj
TLSH
T1F091D8DF09360B63C55897B5AED15CE98B105EAE4BB5638A4024833EDFFD33623191E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5684_389326049\Icons\96.png
Size 1KB
SHA256 f2b25026f9dde3d50479d07494efff95f79c2bfa6c7eff6867051a951d38f9e0
MD5 b8080cb107baa272639829bb131c18c0
SHA1 4126cef1b64088813838b1b626685e0eac4a3bdf
SHA512 090b5d55ef62b163728e7d1e494ef2eaf41a26eb6d95cf2357eae2d99c4661137fd5a5c1fa55fd648e5aaac43e591a2ec0123aad256f5bbe94e398b3520e6f65
TLSH
T129310C6E56F8CB20D0BA95D5C65756B1495032F83B3CA4F10309284FC96C385155D9D3
MD5 SHA1 SHA512 TLSH

Submit Download

cd4e43fd-5d99-41ab-9cde-8b28cb303b90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cd4e43fd-5d99-41ab-9cde-8b28cb303b90.tmp
Size 12KB
SHA256 cd7d0f23da52830120610fd0d304bcaba8c3f096c9a38d90279d142bf860d74c
MD5 f5f354bc42de59c422c309e5eb42b5b2
SHA1 66afa88977760f3b872325c9347db46dcf1fe6c1
SHA512 1c7cbf75b29451b762ac40316b7c635f2717485916ab51cdf3a789b9c5a87a0b71faddb52454e0dbec9754fc2e655d7ea096592d8885b25e3ee5b0aa02df979d
SSDEEP 192:BRqviZrv7IMPRpv1W4l8rXsb+WNu5qx32taHUe5V923e4aO6jPviyIsnAUgE:BRqviZTlXsXwxMlen92pa5P6E
TLSH
T14F52B629AA11693B5CEBC219F965BB5BE3F5102276D01E84FAFC883C24D79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deb9e62c-0a6a-47ff-9ddf-10f46b564496.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\deb9e62c-0a6a-47ff-9ddf-10f46b564496.tmp
Size 12KB
SHA256 773d42cbb0a436aef4ea38c0a17d1a2287a75c700389798b70a64f68cca2213a
MD5 eeb214290cf454c16e6da8f6281d2987
SHA1 3d73804fb6dac190ddef3c060936cc23e823b2c3
SHA512 8aa1d8cf5a592e3a0f0140bcca7904deeedf7772cc9fe4ca3ec6f10d3982474b086e3d0d4ad7e4b8e59ff7ae065c95a383658864f95024059fbdf23781322eb6
SSDEEP 192:BRqviZlv7IAPRp2W4l8rXsb+WNu5qxUHUePV923e4aOsjPviyIsnAUgE:BRqviZVVX3Xwx/e992pa1P6E
TLSH
T11242952DAA11693B5CEBC219E965BB5BE3F6102676C11E80EAFC882C20D79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e76457ef-d01a-45c0-b538-939cdd5ae186.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e76457ef-d01a-45c0-b538-939cdd5ae186.tmp
Size 11KB
SHA256 a604cf2982612d2b1c5059472a5f9007708b50bbff61ea15e2e48c23c5fba829
MD5 736834ddf566974aa08091a2be284a43
SHA1 d15c2bbb2d6b487b4115b8b6832829888cd36dfa
SHA512 45683208e28a9117cc7ed5f5814e89e877282c08ef32f7ee87c492cb5c97de69ed99ea821118f2aabb7ac66d54c697e07313562363de3de0e20ef1aad90e9846
SSDEEP 192:BRqvihvv7IAPRp2WmXsb+WNnqx0kV923e4aOBjPviyIsnAUge:BRqvihnVXYXwI0a92pa+P6e
TLSH
T10E32942DAE11793B5CDBC219E9667B4BE7F6102676912E80EAFC883C24D79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec51dcaa-dec6-47de-b6c3-3c22b5725e15.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ec51dcaa-dec6-47de-b6c3-3c22b5725e15.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2fa52a53680e547aeceb83db8a1476086592bb7170951f8528645357308cf9a7
MD5 04fed7e49627941fe71df0ef3dce732d
SHA1 5aac04062db9d5da8fb99cc28e94315162ff55b4
SHA512 9f7bb4d7296e544ad0a851d3de5f74feac708a12ed8493545d239754f58c7eb45c9fd46f7bcd929748e066046c6fd768f9a67e0374c974a1e390a2df98e2aca3
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5abDhB6RGyvLsTF6ebQMUpv4a:uC0CvgFrp65DUDaXJVTF6eb3UF
TLSH
T1C5A1F931E0A9587B15F6D48AB8812A43CF7461BBF951AF44D9EE5E1C24F74BC1383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DONOTSHARE.json

Path C:\Users\Admin\AppData\Local\Reborn\DONOTSHARE.json
Size 80B
SHA256 090995d89f71b20b4f5404aaa83437fe2e8ecdc415f5089d171d60f2db0a413f
MD5 21f89ac2460fd9cee868eaf853117a3d
SHA1 be7c03215654407f9b1e92fb33e12e4f2694b005
SHA512 dcb4e8822e2d3c55d3bbc63a5a4cd50534685538f1418e5ab225ea7b5497f21611ff615b737d27987f4f86d2c17914c2d8aa8416f295434dfffdeb6de2af3300
TLSH
T177A0013A18428A06223881C1C83001163999CE9B15BA1C86B6F27989D2A19922C45F26
MD5 SHA1 SHA512 TLSH

Submit Download

SSLRaton.pfx

Path C:\Users\Admin\AppData\Local\Reborn\SSLRaton.pfx
Size 2KB
SHA256 47d43336a4a2f58c61e5c656d30b062551a4402814dae3a751e0591594fc2a9a
MD5 37e117ab1be6c0dcf4c5c2ca042f9685
SHA1 6c1998730ae6a60eb459f5e66c5e5198462cbd23
SHA512 e2fb6d7bf7aff86fcf339f8e45565fe3bc18552730f6d95671743398ba28e0443d9c856bfb9de056afecf3ffa738756b8b837505a092ef2a582dc5cfae179a0f
TLSH
T1E8410A1B057E980E3459DAFE29940E0E3C489B90AE32D19FF721E6CA497FC55A9C8211
MD5 SHA1 SHA512 TLSH

Submit Download

device.id

Path C:\Users\Admin\AppData\Local\Reborn\device.id
Size 32B
SHA256 5234acd25a0654fac10c9d2572142bd43963356128726ed3841e1862ae1be7df
MD5 f6a67c24c0fbcc9a914c372f9f7e8cf1
SHA1 de895ae28dd00133c77e411d9be68439537107d8
SHA512 6ab4a7d6612750eb9ca27d8b9d55339cadd575834b8f3306ae324a90c513115c1c113be6c94a1b3d171dd0a50a521294ea6f8ec327aa7291927b2bb27f0a3644
MD5 SHA1 SHA512

Submit Download

userData.json

Path C:\Users\Admin\AppData\Local\Reborn\userData.json
Size 95B
SHA256 7dd6a7e929cee05a1f277665b04e9d808868d5b8b709bccf00679d1c1b604a0d
MD5 60cb01944950bcf20a50348b3e441435
SHA1 088cc455221b7fe9db98d0c7ea17d90d68f154af
SHA512 1ede9638f6776b82589ef6fed243d5ef9c29aafca2853743642b58bad5c5c4ce4037181dea12e8f7939863fd3e663a61edb3fd06a5db37a7e0bac2fdd85d5b18
TLSH
T1C1B01227180E01B391BED0C67C08088D30258E1F81311C076033D2D016004142181703
MD5 SHA1 SHA512 TLSH

Submit Download

605b6f9e-23fb-4919-8068-58cad597c055.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_906510810\605b6f9e-23fb-4919-8068-58cad597c055.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_906510810\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

d000e294-a345-4717-880e-bf5b08414558.tmp

Path C:\Users\Admin\Downloads\d000e294-a345-4717-880e-bf5b08414558.tmp
Size 512B
SHA256 17a1effb6f99b6379770d2e4233b1c9996d5e1128d468634c34c7c139936362c
MD5 dfb32a08baaa709c1ff21ba1cef5285d
SHA1 79bd7fbb86618c7725648acb33ea1fb3ea03bd2c
SHA512 ea988444b76f06895e05266e51cd19fdc9258c4e8443179c6586bb4c04444b1e506717c6293dd0480cfad1c0493fdaf1be9b2f7883ef61a47ebc69b89299331b
TLSH
T107F05464C84A3016E044D938B0259CE73458D751AC4B415D8F7717AD697332C0A82677
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2740-664-0x000001A1FA980000-0x000001A1FA99E000-memory.dmp

Download

memory/2740-680-0x000001A1FB5A0000-0x000001A1FB5BA000-memory.dmp

Download

memory/2740-675-0x000001A1FB520000-0x000001A1FB528000-memory.dmp

Download

memory/2740-676-0x000001A1FB530000-0x000001A1FB53A000-memory.dmp

Download

memory/2740-677-0x000001A1FB540000-0x000001A1FB54A000-memory.dmp

Download

memory/2740-678-0x000001A1FB550000-0x000001A1FB55A000-memory.dmp

Download

memory/2740-679-0x000001A1FB580000-0x000001A1FB592000-memory.dmp

Download

memory/2740-662-0x000001A1FAA00000-0x000001A1FAA76000-memory.dmp

Download

memory/2740-684-0x000001A1FB6A0000-0x000001A1FB6BE000-memory.dmp

Download

memory/2740-658-0x000001A1F6130000-0x000001A1F70B0000-memory.dmp

Download

memory/2740-666-0x000001A1FAA80000-0x000001A1FAAA6000-memory.dmp

Download

memory/2740-659-0x000001A1F9710000-0x000001A1F97C2000-memory.dmp

Download

memory/2740-660-0x000001A1F8D30000-0x000001A1F8D52000-memory.dmp

Download

memory/2740-667-0x000001A1FA9A0000-0x000001A1FA9A8000-memory.dmp

Download

memory/2740-665-0x000001A1FAAD0000-0x000001A1FAB1C000-memory.dmp

Download

memory/4480-692-0x0000026D2DA50000-0x0000026D2DAB2000-memory.dmp

Download

memory/4480-691-0x0000026D2B910000-0x0000026D2B962000-memory.dmp

Download

memory/4480-720-0x0000026D46B40000-0x0000026D46B54000-memory.dmp

Download

memory/4480-721-0x0000026D47E30000-0x0000026D47E64000-memory.dmp

Download

memory/4480-722-0x0000026D46A90000-0x0000026D46A98000-memory.dmp

Download

memory/4480-690-0x0000026D2B880000-0x0000026D2B8AC000-memory.dmp

Download

memory/4480-727-0x0000026D46540000-0x0000026D4657A000-memory.dmp

Download

memory/4480-728-0x0000026D46500000-0x0000026D46527000-memory.dmp

Download

memory/4480-736-0x0000026D46600000-0x0000026D46632000-memory.dmp

Download

memory/4480-688-0x0000026D11510000-0x0000026D1152E000-memory.dmp

Download