0ce4643451302881743d177e954d24d5685e04a5fd7c776f1b1003bd43f81b12

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe
Size 35.7MB
Sample260701-jnellabv8z
SHA256 0ce4643451302881743d177e954d24d5685e04a5fd7c776f1b1003bd43f81b12
MD5 bd97e4b826ac8c3a9bc0596056d7b8fa
SHA1 c8682702df832bb2bc72768b1dceda1f48d06c0c
SHA512 6c762bba8c5a0018ea07cb48c1f696adaca1a503510ec969c348e7ad89fda87b767dc52b2f17e4e0cd8be78a44d6434fc150eaa241abdd2147e830c3c62d2d1b
SSDEEP 786432:VyZ/K0ttYZTEqsyZ/K0ttYZTEqyl7yZ/K0ttYZTEqsyZ/K0ttYZTEqyl2:cZ/K0ttYREq3Z/K0ttYREqylmZ/K0tt5
TLSH
T109877C13F2A441E9E0AAD174CE669231EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5632	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273657501548211"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5600 wrote to memory of 1916	5600	2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe	88
PID 5600 wrote to memory of 988	5600	2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe	89
PID 988 wrote to memory of 5552	988	chrome.exe	90
PID 988 wrote to memory of 5872	988	chrome.exe	91
PID 988 wrote to memory of 5872	988	chrome.exe	91
PID 988 wrote to memory of 5632	988	chrome.exe	92
PID 988 wrote to memory of 1176	988	chrome.exe	93
PID 988 wrote to memory of 1176	988	chrome.exe	93
PID 988 wrote to memory of 4752	988	chrome.exe	95
PID 988 wrote to memory of 4752	988	chrome.exe	95
PID 988 wrote to memory of 2864	988	chrome.exe	96
PID 988 wrote to memory of 2864	988	chrome.exe	96
PID 988 wrote to memory of 3456	988	chrome.exe	97
PID 988 wrote to memory of 3456	988	chrome.exe	97
PID 988 wrote to memory of 928	988	chrome.exe	98
PID 988 wrote to memory of 928	988	chrome.exe	98
PID 988 wrote to memory of 5680	988	chrome.exe	99
PID 988 wrote to memory of 5680	988	chrome.exe	99
PID 988 wrote to memory of 4852	988	chrome.exe	101
PID 988 wrote to memory of 4852	988	chrome.exe	101
PID 988 wrote to memory of 1784	988	chrome.exe	102
PID 988 wrote to memory of 6076	988	chrome.exe	103
PID 988 wrote to memory of 6076	988	chrome.exe	103
PID 988 wrote to memory of 4280	988	chrome.exe	104
PID 988 wrote to memory of 4280	988	chrome.exe	104
PID 988 wrote to memory of 3552	988	chrome.exe	105
PID 988 wrote to memory of 3552	988	chrome.exe	105
PID 988 wrote to memory of 1472	988	chrome.exe	107
PID 1472 wrote to memory of 1556	1472	chrmstp.exe	109
PID 1472 wrote to memory of 5516	1472	chrmstp.exe	110
PID 5516 wrote to memory of 3436	5516	chrmstp.exe	112
PID 988 wrote to memory of 3144	988	chrome.exe	113
PID 988 wrote to memory of 4224	988	chrome.exe	114
PID 988 wrote to memory of 3144	988	chrome.exe	113
PID 988 wrote to memory of 4224	988	chrome.exe	114
PID 988 wrote to memory of 5756	988	chrome.exe	115
PID 988 wrote to memory of 5756	988	chrome.exe	115
PID 988 wrote to memory of 2640	988	chrome.exe	117
PID 988 wrote to memory of 5116	988	chrome.exe	116
PID 988 wrote to memory of 2640	988	chrome.exe	117
PID 988 wrote to memory of 2596	988	chrome.exe	118
PID 988 wrote to memory of 5116	988	chrome.exe	116
PID 988 wrote to memory of 2596	988	chrome.exe	118
PID 988 wrote to memory of 2968	988	chrome.exe	120
PID 988 wrote to memory of 5548	988	chrome.exe	119
PID 988 wrote to memory of 2968	988	chrome.exe	120
PID 988 wrote to memory of 5548	988	chrome.exe	119
PID 988 wrote to memory of 1508	988	chrome.exe	121
PID 988 wrote to memory of 1508	988	chrome.exe	121
PID 988 wrote to memory of 876	988	chrome.exe	122
PID 988 wrote to memory of 876	988	chrome.exe	122
PID 988 wrote to memory of 4904	988	chrome.exe	123
PID 988 wrote to memory of 4904	988	chrome.exe	123
PID 988 wrote to memory of 4280	988	chrome.exe	124
PID 988 wrote to memory of 4280	988	chrome.exe	124
PID 988 wrote to memory of 1872	988	chrome.exe	125
PID 988 wrote to memory of 4228	988	chrome.exe	126
PID 988 wrote to memory of 1872	988	chrome.exe	125
PID 988 wrote to memory of 4228	988	chrome.exe	126
PID 988 wrote to memory of 3456	988	chrome.exe	128
PID 988 wrote to memory of 2640	988	chrome.exe	129
PID 988 wrote to memory of 5716	988	chrome.exe	130
PID 988 wrote to memory of 1964	988	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-01_bd97e4b826ac8c3a9bc0596056d7b8fa_amadey_cobalt-strike_darkgate_emotet_glassworm_hawkeye_h.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x7ff768d7b618,0x7ff768d7b628,0x7ff768d7b638
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff948a3c728,0x7ff948a3c734,0x7ff948a3c740
    3⤵
    PID:5552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,17032957845579214365,672695109149278449,262144 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,10272636163958923310,11822255166898188559,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,8573420314685105087,10913232167830739919,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:1176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,3708791966564862697,9932473980270045779,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,1127573725093620775,6466868711216465701,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,8122708561118620240,3916274304733313187,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,15353801254913119992,15246197546594350392,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,8685066348160625445,8242400850349712955,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:5680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4820,i,3066112946899648173,2121909833575955792,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,677793896542423496,2109791417431559277,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:1784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5440,i,1990389234875487239,524014202141851931,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:6076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5480,i,8206241350467757808,10829343857118743388,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5804,i,9660845656085884617,13148884958761704964,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x25c,0x29c,0x7ff75e8b55a0,0x7ff75e8b55ac,0x7ff75e8b55b8
      4⤵
      Drops file in Windows directory
      PID:1556
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5516
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x240,0x29c,0x7ff75e8b55a0,0x7ff75e8b55ac,0x7ff75e8b55b8
        5⤵
        Drops file in Windows directory
        
        PID:3436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5524,i,6611266240722925286,14974001789303021472,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,9363940933108314183,11144131499897343548,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6088,i,12339423564414787120,5504867915155086792,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6192,i,10860884702777580891,6570051360983211392,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6188,i,8663010748066445506,9928860343006203206,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,1916879498636367236,7590955106348135822,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5532,i,16567695427773541818,12287821560959605096,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,2608718511990697662,11384840092669295092,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:2968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6432,i,4397513842776073843,15061892232848666966,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:9
    3⤵
    PID:1508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,8350220724831536703,7977197885545868032,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,14206089221160306634,17773290312327008719,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,4238584449211511242,8208771681602522314,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6548,i,4807555354742741403,6470504002072876075,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:9
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6372,i,5212970008660858577,9452163785852700128,2097152 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,6994964242404148655,17615745092504273802,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:3456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,17314084910889600206,14399053011130492859,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,9038683753554753177,2353174102185708326,524288 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6468,i,6708168289051377222,12410102666043917521,262144 --field-trial-handle=1956,i,12346196824199434154,4879540479369673895,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1472_13427365750416396.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1472_13427365750416396.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5516_13427365750370360.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5516_13427365750370360.pma
Size 696B
SHA256 a9b2076d4f738343233f52bf28715b9527ff6559922c1fba210e0e0ef0f9c016
MD5 b7d6a28a61606be7dc80bd699ad966c1
SHA1 b736f2a94a5324da05a034f078f778731fe06a59
SHA512 571c66d30392163836953e8d2df0d80447495d19aeb6738b63ae667d5555a96e1a4356960547dc693cfeb2c9dac8391f42b0765e5b2d10d610af352bc927e787
TLSH
T11C01C94AA3544F67CC468D3584BE27512BB0FA501B821BBF7B10764F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f6348165b88c80a43fa7320cfaa76120e2db51c3a8258b366f83feee6f64ee93
MD5 6e5fcd50a4af495cce3115f759901ef3
SHA1 8652f21f5aee6a6c229c41881e93e524571d49c0
SHA512 3b4ae0a6cea4a5cbdcbba6d4a3e7d099994595c7eb90673e1c2559f9cc8e7050b83a09567433d1a62999bd13a277a8f7b9c2cb7e8f166e6dbd9753c6601c061a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 21299deeca2bcda64edf104fda43d244451748a58412721da125433988ecfa0a
MD5 cd38c844654277cba7e25d9462e771fc
SHA1 8eb39624238d2cf5732e4fd5be734fa35157d63c
SHA512 9b13094e5a6e4e324fedaef17e1f1cafea35eb141c7f7343534b44ca32eed357cc060b1be567a76177fefbb9363f1fa0cc66d7d0f76a9e90eaa4201c5e22a3b8
TLSH
T1B861ACB7C7D8866DC81156F4AB206E2FCD7D0A24532C3C56D8D8AF4B53E24B2E20075E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 877300d6de419e286cab865944117329a492cbb7de416a3acc0a89da69c8efe6
MD5 396fa84eede69ba5800971cd7162b76f
SHA1 530d20ba99535c501f19251a9e142ec9145dc754
SHA512 2b5682a40daa8b6e333925c36d62b4e2a4e47e99c13fa440205a1c8baba9a37dffa77be3ed92810cee8ab5d6e3cd0308a029e6f061d20ccdcff7723eb75479d8
SSDEEP 192:3HRVDTXYPJSd0tX/6iT7+RSgjxuhemiPX16v7TpAPRp2JXsb+WNnVE52ptHkeFgE:XR5OcWNFPUXCXwI2Qe
TLSH
T1CC32952FA924B57B5CCBC229FA65B757D2F5202525D02E80E6FC8A2C11D75CC321B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58e0e5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58e0e5.TMP
Size 3KB
SHA256 c835e543ae7f7dfe4f22cb1ca2db45931e8f260ce44ea775e1b912bc71e26608
MD5 0d4474776363f1591f14d2bb50f2ef9b
SHA1 3f23f73624df5851754b58ea0e9dbb5df771b5b7
SHA512 65a26a34ce1716c05281bd8695d8f99862862c5e87050cf3cba5a905a076e627f5ef831a0244f9516b657709df6ef9c0e6388d2468af1f258f6931caa962a783
TLSH
T1416133ADD4B48CA75CB56731B8391BC2FA51533B1140980A3EBE15CC0FB386B8081F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 2ce014c676add0f65efc1b86a187069f7179e829739cb09ff4ccbb17e953a2b1
MD5 5f21b6efa7f7b94286cbef6c756bd322
SHA1 5da9d44105d5db4b0430a5b22d380be813557c6a
SHA512 1e23825988586b340f83fd14efb5614be2a44ca2056539bff504cbc37c4681828a149258ae0bbcc7e949ae3b8e497cf17ece3914462c2706eed602453d3ba2bb
SSDEEP 384:s+jyF7KxkXqKf/pUZNCgVLH2Hfgsl2g7pLuLcWaW3XODyF+ErU3gkgHgExx:sOyF7KxkXqKf/pUZNCgVLH2Hfgscg7pu
TLSH
T10862F977AC4C9E7B0F98C588DC177E4FACB4025A61AD886892FB981503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 41150e39349a1dace2b4c9d223bc1cfdd2a73fbd2b0399065f56ecb3c3f4d922
MD5 bc678492ba1188db4ef6e32e0eb11d6b
SHA1 34bae6aafe812611f6e7b7a58693c9dfdd22c0d7
SHA512 2f6f092e63f3d462b44d3ba58ae559dcefe32b56cf82d17b64b0fc8df2040b5a0ac5657bc93580dc09806437822260bcb057f9abeb14692514ff3fa25cad8d42
TLSH
T1EBB01248815E5B10C80441F82105204833115EA191001707D2D0E985ECD30E45252924
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0b673914ab5a35f894fc4ac03f3489c26be2fa96207728926014c1f6148021d3
MD5 93d8c3e69d3bac689796cdda55b11b38
SHA1 b3e0187df617625fedd885959a46960b0010937d
SHA512 f840ee49c30130923a9ee8e92f8bca778e3921bc3ed2ca45dd8e2a459c65dbcbb50b567b864786043fc782e1583b1cac6aad6a5eb82c6bb3437df18d4f71d5c6
TLSH
T139A0022243C52411DD085778606A07C223618F58555263035492885DD85B1D1D187A04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59742c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59742c.TMP
Size 48B
SHA256 70e6c70c90c3fdc82deccbb42ff126f9afefa2d7e4a25cbaf23c15db5a8f27e5
MD5 e25644c1130a542976d1d33c5fa19bce
SHA1 02bb55c7e1be3a456a7f0dc125abb7e4b6e879e3
SHA512 b94eea24ea14118b1c78d8f96b544209f71a8fc6993030051f2eb7047db675278aa76dcbf122471b1abc12255d5d2e97a4bb6bcb8c27e45945c70bfaf2c0e130
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 23115a16f5c794c97d6f1e8f949c3aeb81a26db960c6b735ab81e242f969d3bf
MD5 e5d87cdd8dd7b546dfad88cef6141f72
SHA1 15cfa50a8f81995589f2545b9adfdb6e66b44357
SHA512 b91802c5444414a03d08f9802f63ed93837439a6acced1cde8ab78206d955c52bd1bec366dd6e83e3cea05774e62bc32b7b6ce8973f9c5264ea595003f3171d0
SSDEEP 3072:HT1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL58:Hpmg1kQfATCFbzQACjH
TLSH
T1A5C3125A89F409BE171604A121422EB9F2D9673FDF522EDC93AB07F61ADBC461346423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 318dd0e4c3042f5426916c50d71d9caf4d00084057e3f046160c97eafc60c488
MD5 f67391eadb7d9bde005a43ff85c4662c
SHA1 621234c5ee0c12c8320f072d8cdf94798cfbbae0
SHA512 2d42a2a5961d64d3340408b185debb147d9e35721d05fd0f5a6c8f6c0cc49ad5680224ecb9b522ba70c94bb9234e6a7114acdb4745b14fce4b1c345639febe62
SSDEEP 96:rC6Td+xHjVupEnr/FmK9f9NIzYRDotok5VMpzDV2NB69GyvGl4irCabgv4a:rC0K2WTcMN1DUDV6HV2Thf4irCabK
TLSH
T1ACA106366029997718BAC989B4423A53CE78615BB661AFC8FCED1F0C16BB1B81305537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 739562c3224e8e0acdfb00f9a39f2e17277fe5bde8453af612bd2e487b82418f
MD5 c7abf701723ee66c421f7c99c2116352
SHA1 293489f4b8f02c78bc0b9cfac72d1e6917e0d755
SHA512 8399f4d671010d798da60369cf3f3e860b49d0c39c85b9bda52343896d23edb09646a82c07b628f3418a4042e60fc9032d7907a6f78158486509dd058adf7a9b
SSDEEP 3072:IQ21mgCELZtCpXh5qTfATCuIbzQACV1cnJLL58:IQ8mg1kQfATCFbzQACjH
TLSH
T182C3127B49E409FE171208D121422EA5EED9B73FDF163F9C926A0BE615CBC4A1347823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 08cce230100da39d3e4f65a82f5d139aba65c8505c2d3c9512e3c9eae081363d
MD5 86420c999e47e5ac9f67752946d09a70
SHA1 937af101201efa4834d82a23701e8f86ad751b98
SHA512 436d6da538b77e53108a6653d04b69e11ce570b1e99d4e639641e34165cb174b1e668b20046d55ca1585aaa36e3886ca216c164e79ec73504478244c8e9f8546
SSDEEP 3072:IT1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL58:Ipmg1kQfATCFbzQACjH
TLSH
T1C7C3125A89F409BE171604A131422EB5F2D9A73FDF532EDC93AB07F61ADBC461346423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir988_554245100\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 28d8a8dab16464075979f9f73aad95e0c00a36cfb2d21e76a438f184527c0e64
MD5 145c716718f7100f830dd69a8f6bf463
SHA1 a0d4aceced26b297dd415d32115ed6339ba1f1ce
SHA512 53a5d9f6290bf2b9ec2c8e59242f514b9842b994fef58eae2263e2fb41f0afaf06291d608464ded0cd25e1140c6e4cc1ad5189ec7d13b5c7261f252f73fbb346
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 5319c071bec5cfacc93d4b8fc8e517b2b895da28677e0f56c6d200dec53c407e
MD5 af2f7ca59898fe9460ebb5e1439897ef
SHA1 63e3b1a8a84c52d1e809245114b03bbe2f6214bb
SHA512 d5885c78e169fa3ef97b60858528b4506ef38304ba0c3e1ec49c105f75f2bce9a1d64dd7a0adf13916d4ca4e87a7ef4942890f51588abcdb5ee20a260a49a9f8
SSDEEP 96:TaiOF4OxVQ3AyqFhK2JK2kuXd7DVjYq8PeojThK3gK31oO0:u7F4UQOrCuHr8xDIw
TLSH
T1BFD1A0969E0349EF3B828B6B33433153AEA72849C7D4A57377DF9605B0CA964011F1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download