8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47

Analysis

max time kernel
299s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample261114-celj8aby3t
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4520 created 4772	4520	explorer.exe	81

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 4520	1752	Setup.exe	89

Loads dropped DLL 1 IoCs

pid	Process
4520	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2564	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1752	Setup.exe
1752	Setup.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe
4520	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4672	4520	explorer.exe	90
PID 4672 wrote to memory of 2736	4672	chrome.exe	91
PID 4672 wrote to memory of 2364	4672	chrome.exe	92
PID 4672 wrote to memory of 2564	4672	chrome.exe	94
PID 4672 wrote to memory of 2364	4672	chrome.exe	92
PID 4672 wrote to memory of 1208	4672	chrome.exe	95
PID 4672 wrote to memory of 1208	4672	chrome.exe	95
PID 4672 wrote to memory of 2540	4672	chrome.exe	96
PID 4672 wrote to memory of 2540	4672	chrome.exe	96
PID 4672 wrote to memory of 1220	4672	chrome.exe	97
PID 4672 wrote to memory of 1220	4672	chrome.exe	97
PID 4672 wrote to memory of 1244	4672	chrome.exe	98
PID 4672 wrote to memory of 1244	4672	chrome.exe	98
PID 4672 wrote to memory of 4204	4672	chrome.exe	99
PID 4672 wrote to memory of 3012	4672	chrome.exe	100
PID 4672 wrote to memory of 3012	4672	chrome.exe	100
PID 4672 wrote to memory of 2408	4672	chrome.exe	101
PID 4672 wrote to memory of 2408	4672	chrome.exe	101
PID 4672 wrote to memory of 5568	4672	chrome.exe	105
PID 4672 wrote to memory of 5508	4672	chrome.exe	106
PID 4672 wrote to memory of 5568	4672	chrome.exe	105
PID 4672 wrote to memory of 5592	4672	chrome.exe	107
PID 4672 wrote to memory of 5508	4672	chrome.exe	106
PID 4672 wrote to memory of 5592	4672	chrome.exe	107
PID 4672 wrote to memory of 5156	4672	chrome.exe	109
PID 4672 wrote to memory of 5056	4672	chrome.exe	108
PID 4672 wrote to memory of 5156	4672	chrome.exe	109
PID 4672 wrote to memory of 5056	4672	chrome.exe	108
PID 4672 wrote to memory of 5424	4672	chrome.exe	110
PID 4672 wrote to memory of 5424	4672	chrome.exe	110
PID 4672 wrote to memory of 5700	4672	chrome.exe	111
PID 4672 wrote to memory of 5700	4672	chrome.exe	111
PID 4672 wrote to memory of 2392	4672	chrome.exe	112
PID 4672 wrote to memory of 2392	4672	chrome.exe	112
PID 4672 wrote to memory of 4656	4672	chrome.exe	113
PID 4672 wrote to memory of 4656	4672	chrome.exe	113
PID 4672 wrote to memory of 5860	4672	chrome.exe	114
PID 4672 wrote to memory of 5860	4672	chrome.exe	114
PID 4672 wrote to memory of 4792	4672	chrome.exe	115
PID 4672 wrote to memory of 4792	4672	chrome.exe	115
PID 4672 wrote to memory of 2608	4672	chrome.exe	117
PID 4672 wrote to memory of 4684	4672	chrome.exe	118
PID 4672 wrote to memory of 3620	4672	chrome.exe	119
PID 4672 wrote to memory of 2692	4672	chrome.exe	121
PID 4672 wrote to memory of 3864	4672	chrome.exe	122
PID 4672 wrote to memory of 3864	4672	chrome.exe	122

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4772
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdb757c728,0x7ffdb757c734,0x7ffdb757c740
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,11895392126315024789,9630419912859781218,262144 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,15550616499040429354,9647516738879393435,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,10059782702373450689,8465070871151595361,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
    3⤵
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,11541277691268673518,17561994969859447264,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,8788363852695871231,17812171965779814385,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3844,i,8410128555883869530,13380825751785367719,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:1244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,16040481771157295263,10207108751464239569,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:4204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5152,i,3808657453014932661,10531913480190867323,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5164,i,10853626247104732271,12085336403382758276,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5124,i,11311716128395665731,10856305081978768747,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,14796771598112475228,12723347719622757026,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5440,i,1853848733850054362,7603039414618410029,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5156,i,17994242633155542842,16954985754964125364,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5212,i,10330415285243747365,4318365711034806062,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5884,i,10298983100706463630,10388936583078435281,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5720,i,17879821701020005085,17278201645177244915,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3144,i,13303559384227654661,11821485492762498080,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:14
    3⤵
    PID:2392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,1548389518501494429,4386348123235028066,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6056,i,16955375935757257886,17793100463532916708,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:9
    3⤵
    PID:5860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5168,i,13316669810440238781,15537581421702636389,2097152 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,7839059674326721608,9541101345851658286,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,1051979033466472729,9205593202843834773,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,6018194558849301177,216367127023023891,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
    3⤵
    PID:3620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5628,i,16895053174466406643,18151057280755838815,262144 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:10
    3⤵
    PID:2692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,12048224772181951374,923273725470208155,524288 --field-trial-handle=2068,i,6934989225070411371,476617248752956989,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:3864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

45d0aed3-1d1a-4926-a7d9-8d0c576e0d75.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\45d0aed3-1d1a-4926-a7d9-8d0c576e0d75.tmp
Size 150KB
SHA256 ca540d6372d6917accb4629593aa3324f444dddce4c93adaa8ecf57179cd719d
MD5 1d22e1434de88a3e484e1ad8c09bb0d7
SHA1 222876bd1a45b746943a3391fbc17da38a7de5cf
SHA512 2e6d919d2cebbdf21208f76709995280089899c2313810038bbc03d10cb401281d1ec7dfdb35c225b7682c69e6c5fc9e7a81e951664a8771c367072bf0a4ff09
SSDEEP 3072:QEse0KO9e1eQMAKVgfqxrq4eCktSgECO2h4rDEzF4C:QEse0X9rDVgfqxXePtKCO2h4rrC
TLSH
T1E1E3126684332998DC625B0FA40E262FDA32713F451E9A51CFFDD24F805E7DE4736982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d6416f0-0f5a-4778-b64a-3ddffa98e743.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5d6416f0-0f5a-4778-b64a-3ddffa98e743.tmp
Size 4KB
SHA256 91b492aed21a92263905ca2170cabd959bb3831d38f100062371fe7f2f8355e7
MD5 2ce13a3390de3f7e9060e04309ad2f94
SHA1 5ccefbaa96b7b5e8f1dec2f30c6b12c9aa97c37d
SHA512 ea1fa6d128cfa2d8ea37cd0f2102b3c32d0a41c76fc752c19d63f37a08e8f8b6fd532ed02f63bdaa535aa46dd403d3618851e2f1d709e975e6b7b6a2bb671150
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5egNDSB6ndGyvze9afjbfEv4a:uFC0t+W1I04DUD/y4wL9afjbu
TLSH
T1CEA11A31E56D4CBB54B6D949B1533A43CF79A26BA4219F94D9ED6B0C04B70EC0782123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

991437a4-5e7d-485d-93b6-1eb14d08476e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\991437a4-5e7d-485d-93b6-1eb14d08476e.tmp
Size 151KB
SHA256 3a5502c4e63202b8ee4f28a2209e4e4fd551a470228fc5f90954ef79d5baf923
MD5 3b7bf0e0de0d1452decba6521d8288e4
SHA1 070c1dbbd4f79aa93f406f0c88f3b644302a80af
SHA512 f9cb7ac8ff9496d5412eaf95a74782381041d793920378b0b36c02bb0347e6252ab47de8d340baca64b8a1ddb19448ab86a36559c77ec26da67913f47f9359df
SSDEEP 3072:7Ese0KO9e1eQMAKVgfqxrq4eCktSgECO2h4rDEzF4C:7Ese0X9rDVgfqxXePtKCO2h4rrC
TLSH
T1C0E31276882328D89C725F0BA40E2A6BCD31717F4A1DAA50CFFD964F801E7DE4727981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15288b70-c26b-4808-b76b-222e17e7105e.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\15288b70-c26b-4808-b76b-222e17e7105e.dmp
Size 114KB
SHA256 2961c2a7d324a99c6905e00da91bde1fffbba11952e38d5af1bf3ab2eb91d00c
MD5 722110fd4d3c2a05876ace4593d5838d
SHA1 75af2a74befe96ffb637ae0487ebdcfa7c71e106
SHA512 e77a3d2495c6eed42b6ee9f218dcecbd5149f38e4676fbbb7c65d125f965189114acc604a7116e1cb1e25be221ab0fc742c6dc1abd88454f3ba1d279b15c4d98
SSDEEP 768:fhWqbU1b9iYj2PhwpywrwVGKFi1AR6DbvKtH6rC9d:vU1b9ZjAJVGKFi1A0vIae7
TLSH
T1AAB3DA56BB9808B5F1AA16B458872754EBFBE86E0B53071F4A44C27A1C7374C7F30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 c414448bbe060e4a60b198f5530612393cf6ce3e2127fea378f16d34d823faa8
MD5 9ebdf7ad5e46f06f530ef2af591cd993
SHA1 80c28bbac7f3d09dd4ff63bb02d42bdd9d5458e4
SHA512 0cfc3790446996b71f021acd35de0defe6679a6d6d78749eacd2babf6eb87437efa0950b7b75eee4ae449b9f5dc6fed3bf232f0f652486015d126f956a6940cb
MD5 SHA1 SHA512

Submit Download

3e39a62b-8f48-492a-8978-bd1fb6a5ea29.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e39a62b-8f48-492a-8978-bd1fb6a5ea29.tmp
Size 12KB
SHA256 f84e28ed5bbfd822da843c2a650e71761b6fb7284dfa5bd9c0ae03fddeb91561
MD5 8e130c4be8987b3025b9dca4f15ab64f
SHA1 d457e549d81d1853ecfd1451e09e5c4137220d30
SHA512 a573b29cf82f9721df59235104ed9721ec8f17e0fa684c95a057abd2313180690eb2ee556f6107745e9f0d22881df4fa3d10e44c54212c9440dfb21a897fc996
SSDEEP 192:7R9WTAFxTv7ALvIPRp4b9BHsb+WNn57PY2SaAs3VyIsnAUgE:7R9W8Fxr4yXCDwhPkabE
TLSH
T16842A52EE914793B5CDBD22AF9367B97E3F5102164942E88E6FC893C25E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59bc6dad-bc83-42f3-869f-56601cfb7ea6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59bc6dad-bc83-42f3-869f-56601cfb7ea6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7b5b9790-c429-44a9-86e2-569d52b6a9ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b5b9790-c429-44a9-86e2-569d52b6a9ab.tmp
Size 11KB
SHA256 b352a468b8b8acf827fde24f4b2d09b32ad7c1d11ca47f8e3cff856863eb0973
MD5 84e2de77fe2c17aa570746249c4e5a5e
SHA1 4369ceb21d22700034163745bf8b654e10569488
SHA512 0c2023b55ee6e987cd78f2180d265fea70f447cc4b44a1380775deca9cbddc0919c4edb0c91f8f32412c31d71c2643bcabc9b1a92fa9f0899d31318c24e06c3c
SSDEEP 192:7R9WTAFxTv7ALvAPRp2b9BHsb+WNn57Pv2SaAsEVyIsnAUge:7R9W8Fxr46XUDwhPva2e
TLSH
T10732A52EEA14793F5CDBD22AF9367797D6F5102160942E84EAFC892C24E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4f1587f2-372b-4972-8f11-142709c0bdf9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4f1587f2-372b-4972-8f11-142709c0bdf9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d6040551-24a2-4135-a388-773b4ff54998.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d6040551-24a2-4135-a388-773b4ff54998.tmp
Size 1KB
SHA256 30fbcc873ea3d95ed118dbe70864763c237b9d50d7e5e8674d98ae291bb5a92c
MD5 78e77cb9a92b6f90020454af43019a1c
SHA1 9df256c30ef5f8fb18fe783f2e5c7a2423e5395e
SHA512 7d9168b977dac4d056b74963fcdfc8122642f6d5a4d7a57936575582dc712967b68108aadf64795dcd5cc4f50afd99c1c67c13e2aad1de8fdf13e0091a239be6
TLSH
T178318CF797B4857E891192E4EB156E1FCE6D0524131C3C62C8D4AE1B57F2872D24079F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 2927ef3ae336dac3ae4803bc16648b963573190600ef792145e2c8fb6eb42504
MD5 8508420d6ffcbde317bebbe1637bd960
SHA1 f429b0a54caa92735addb88b74d72647f9588815
SHA512 2f47739e6534496c25b4949e767551982bdfdf293842ea28e2f48dcd6dd92b4fbc5a2c45b2f83f7a3772748d1c7355e15d0815827f9c4d6c60f2d3d4c0525f39
TLSH
T1D8A0029555C54455CD1162F2E171454132A689281562830355A5C657C95FAC06111505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6ddcc11d80681cc790be86b7f7e37b3f7954d71f128e52d9e6ac4996368cbcac
MD5 f267158d5b940d9b41d4cf8b0816a2b5
SHA1 6fba85e37ceb1db27a4a75f56d43f3858a9d9cab
SHA512 95c0412a5dd4769521afeece24d2bb2c674a421726f053ce72522cfc5e33ea6e35faaf429fba6cc88da144bd9b199e346906a84b4422e31fedade95bb0999494
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa45da2e-ec51-466f-a5de-135a30a58862.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aa45da2e-ec51-466f-a5de-135a30a58862.tmp
Size 13KB
SHA256 305dc8e60805b307c4aeea99d04c1a8302f927d18ac8eb26dc4854d7b6e4091e
MD5 d2322bce583e5d240df0603d6b18d9d1
SHA1 167774da81d3cd9d3bd85c86576cb5bc3d82e44f
SHA512 c8f41deff4a97138c290288c2d6ee30fb4b52ecc09fa32790fa58688b5557fa7101cfc2cbd0102ce0668332cf22a7545e597e615e4915095928271d175bc2979
SSDEEP 384:XRjg77KxkXqKf/pUZNCgVLH2HfgslwgXODg3+ErU33WHGAZP6Wesfn+m:Xxg77KxkXqKf/pUZNCgVLH2HfgsOKO87
TLSH
T1FD52086B648C9A7B0FD8D58CDC27BF8FADB501466264492456FB5C0803A57CE124B2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1a94391-5c80-43b8-863e-c90b28c06917.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d1a94391-5c80-43b8-863e-c90b28c06917.tmp
Size 151KB
SHA256 6e3aa890e7288a4429c9690af9745d5714463e4ee7111e26c61a001c05f7b350
MD5 98e80f87d699cc22235fe5082ebe6ce2
SHA1 c1bd870c9ffe55fa4553fa452ddd48976e0cffac
SHA512 3e7376b618b0016d9cb4924ed868cdea6a0aea21384873fcaf7562904ed5ce6e9c59ced1544239a68e83a218ddcc4f9b53f659c3392a065d72064081769e7ff7
SSDEEP 3072:LEse0KO9e1eQMAKVgfqxrq4eCktSgECO2h4rDEzF4C:LEse0X9rDVgfqxXePtKCO2h4rrC
TLSH
T15DE31276482328D89C725F0BA40E2A6BCD31717F4A1DAA40DFFD964F801E7DE4727981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdc6b8f1-071b-44fe-b446-c9f741a5885d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fdc6b8f1-071b-44fe-b446-c9f741a5885d.tmp
Size 150KB
SHA256 b6a6faffd50a14af2b0b2e22e4ec2406f9dc8ba4993e6f688b3d42b270ec820b
MD5 ca3b2f05c94a1bdbb02a75a58a87400c
SHA1 d6192d297738e70828f497ddc715845426bd6e27
SHA512 288a74ecf2b6346f0e12b74474b5235d34c314f4037fb0f27fcd7e2676842720f93d983f898ddebaee1f5dad0b41e3ff622441bd469f003ee175861638ec4957
SSDEEP 3072:VEse0KO9e1eQMAKVgfqxrq4eCktSgECO2h4rDEzF4C:VEse0X9rDVgfqxXePtKCO2h4rrC
TLSH
T12BE3126684332898DC625B0FA40E262FDA32713F451E9A51CFFDD24F805E7DE4736982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9a8e39a-174d-464d-b247-088c3227d971.tmp

Path C:\Users\Admin\AppData\Local\Temp\d9a8e39a-174d-464d-b247-088c3227d971.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4672_262364236\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

msi_b4e1a0e170b8a4b8.tmp

Path C:\Windows\Temp\msi_b4e1a0e170b8a4b8.tmp
Size 712KB
SHA256 d0bdd462ff336ca577a794c617bc165a53e74d9d349bb3025ff2647215d2a838
MD5 57938a366d51bd22c909bc6a9d1c0ae4
SHA1 e40f55486b55806d9d6475e74ba0e05ad5c4fbc7
SHA512 514c1ee4e93ed0ae5fbbcee0d1ab37e436ff5e7991557de7291e26ef578077a2de41b57792ed4025ac10b08aa2f340822e4556beea7f29f86a2c53baaddf6139
SSDEEP 12288:9Zk2KIdAIBkBy2aKs/epFCpCvA5KlV6pGNMHNKgwjh1TzvCPQBZfCqnnnnnnnTnM:jk+yIC7CeqCvIKlVJMHNqDZfQ
TLSH
T16FF4021157B4604E7A20258986DFFD953EF7AE26F8DF2D4506C83808BCEC745A2D8DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-0-0x0000000003CD0000-0x0000000003D82000-memory.dmp

Download

memory/1752-17-0x0000000003CD0000-0x0000000003D82000-memory.dmp

Download

memory/1752-6-0x0000000003CD0000-0x0000000003D82000-memory.dmp

Download

memory/1752-8-0x0000000003CD0000-0x0000000003D82000-memory.dmp

Download

memory/1752-5-0x0000000003CD0000-0x0000000003D82000-memory.dmp

Download

memory/1752-7-0x0000000003CD0000-0x0000000003D82000-memory.dmp

Download

memory/4520-67-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Download

memory/4520-14-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/4520-12-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/4520-13-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/4520-16-0x0000000077298000-0x0000000077299000-memory.dmp

Download