9d81ceb6d1d0e1827c238344acdb94809fde9143b5032ccbbcee371eab41048d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
Size 17.3MB
Sample260703-q9nvqaav2x
SHA256 9d81ceb6d1d0e1827c238344acdb94809fde9143b5032ccbbcee371eab41048d
MD5 a7317011e8ae319f55c0260fdd26ceb1
SHA1 888514533fec7ac45fe2572a302de4ba1ee64904
SHA512 2b1b347089fd32096ac2b94ac2864bddf14a1de52bbf6d66c2d145eba2785a8b6fc71d34bf883b34dfbadb3f2ef49b30447a041d5ba0154dc0189817ac89a11f
SSDEEP 196608:6WyZ/K0ttYVAAT1Kmd0eolySWyZ/K0ttYVAAT1Kmd0eoliALO:VyZ/K0ttYZTEq0WyZ/K0ttYZTEq0coO
TLSH
T135076C03F2A541E9E06AD174CE668231EB327C594BF1A6EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4424	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275606880575503"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4820	4528	2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	88
PID 4528 wrote to memory of 5832	4528	2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	89
PID 5832 wrote to memory of 4132	5832	chrome.exe	90
PID 5832 wrote to memory of 4424	5832	chrome.exe	92
PID 5832 wrote to memory of 2000	5832	chrome.exe	94
PID 5832 wrote to memory of 2000	5832	chrome.exe	94
PID 5832 wrote to memory of 5128	5832	chrome.exe	93
PID 5832 wrote to memory of 5128	5832	chrome.exe	93
PID 5832 wrote to memory of 904	5832	chrome.exe	95
PID 5832 wrote to memory of 2420	5832	chrome.exe	96
PID 5832 wrote to memory of 904	5832	chrome.exe	95
PID 5832 wrote to memory of 2420	5832	chrome.exe	96
PID 5832 wrote to memory of 5764	5832	chrome.exe	97
PID 5832 wrote to memory of 5764	5832	chrome.exe	97
PID 5832 wrote to memory of 1288	5832	chrome.exe	98
PID 5832 wrote to memory of 1288	5832	chrome.exe	98
PID 5832 wrote to memory of 1804	5832	chrome.exe	99
PID 5832 wrote to memory of 1804	5832	chrome.exe	99
PID 5832 wrote to memory of 5984	5832	chrome.exe	100
PID 5832 wrote to memory of 5984	5832	chrome.exe	100
PID 5832 wrote to memory of 568	5832	chrome.exe	102
PID 5832 wrote to memory of 2328	5832	chrome.exe	103
PID 5832 wrote to memory of 5912	5832	chrome.exe	104
PID 5832 wrote to memory of 2328	5832	chrome.exe	103
PID 5832 wrote to memory of 5912	5832	chrome.exe	104
PID 5832 wrote to memory of 3256	5832	chrome.exe	106
PID 3256 wrote to memory of 4360	3256	chrmstp.exe	108
PID 3256 wrote to memory of 3792	3256	chrmstp.exe	110
PID 3792 wrote to memory of 3868	3792	chrmstp.exe	111
PID 5832 wrote to memory of 5484	5832	chrome.exe	112
PID 5832 wrote to memory of 2084	5832	chrome.exe	113
PID 5832 wrote to memory of 1464	5832	chrome.exe	114
PID 5832 wrote to memory of 5484	5832	chrome.exe	112
PID 5832 wrote to memory of 2084	5832	chrome.exe	113
PID 5832 wrote to memory of 1464	5832	chrome.exe	114
PID 5832 wrote to memory of 2888	5832	chrome.exe	115
PID 5832 wrote to memory of 2888	5832	chrome.exe	115
PID 5832 wrote to memory of 4892	5832	chrome.exe	116
PID 5832 wrote to memory of 2044	5832	chrome.exe	118
PID 5832 wrote to memory of 2768	5832	chrome.exe	117
PID 5832 wrote to memory of 1616	5832	chrome.exe	119
PID 5832 wrote to memory of 4892	5832	chrome.exe	116
PID 5832 wrote to memory of 2044	5832	chrome.exe	118
PID 5832 wrote to memory of 2768	5832	chrome.exe	117
PID 5832 wrote to memory of 1616	5832	chrome.exe	119
PID 5832 wrote to memory of 5592	5832	chrome.exe	120
PID 5832 wrote to memory of 5500	5832	chrome.exe	121
PID 5832 wrote to memory of 5592	5832	chrome.exe	120
PID 5832 wrote to memory of 5500	5832	chrome.exe	121
PID 5832 wrote to memory of 2732	5832	chrome.exe	122
PID 5832 wrote to memory of 2732	5832	chrome.exe	122
PID 5832 wrote to memory of 4996	5832	chrome.exe	123
PID 5832 wrote to memory of 4996	5832	chrome.exe	123
PID 5832 wrote to memory of 3124	5832	chrome.exe	124
PID 5832 wrote to memory of 3124	5832	chrome.exe	124
PID 5832 wrote to memory of 5056	5832	chrome.exe	125
PID 5832 wrote to memory of 5056	5832	chrome.exe	125
PID 5832 wrote to memory of 5044	5832	chrome.exe	126
PID 5832 wrote to memory of 5044	5832	chrome.exe	126
PID 5832 wrote to memory of 1600	5832	chrome.exe	128
PID 5832 wrote to memory of 708	5832	chrome.exe	129
PID 5832 wrote to memory of 1560	5832	chrome.exe	130
PID 5832 wrote to memory of 3092	5832	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-03_a7317011e8ae319f55c0260fdd26ceb1_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff797b9b618,0x7ff797b9b628,0x7ff797b9b638
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff98a7ac728,0x7ff98a7ac734,0x7ff98a7ac740
    3⤵
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,4152724379984085090,14232866539807007217,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,1291173056598155030,17327619199758827584,262144 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:5128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,6472678366517361991,2183340847283195234,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
    3⤵
    PID:2000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,15191541644280186635,3223957935848772767,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,18031197543051223178,2083063269492348794,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,4715097293127180234,14074454364108157377,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,13884522290197168360,103387748591994050,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:1288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,1050089565016710560,9965150101091099482,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,12940363385094983172,18048520797558016937,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,8055207674173260438,1099545269720945323,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5640,i,5074850371469505351,14255268664880645677,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5652,i,8994732720701671538,5100319789889211569,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x254,0x7ff61a9d55a0,0x7ff61a9d55ac,0x7ff61a9d55b8
      4⤵
      Drops file in Windows directory
      PID:4360
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff61a9d55a0,0x7ff61a9d55ac,0x7ff61a9d55b8
        5⤵
        Drops file in Windows directory
        
        PID:3868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,9743501104009937612,12035814883761302037,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,10101060499717237544,11248611521917113629,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1061890601928120159,5663416723216984428,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6004,i,6118811524872211427,1262413523011177136,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5052,i,1600666694878262970,4826256575320266928,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,7323839717593975066,6457483877275244499,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,5138972625339496293,4507501638909013204,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:2044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6408,i,1286040889887399488,18220835662586078794,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6444,i,15460120799017818501,17407710447467801396,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,8620694106331406443,3583754180388223336,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:5500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,6549529398038608841,9421367958120251991,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:2732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5764,i,3146967692092995110,16577358007123407899,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6428,i,16844747017132271412,12930485904980212018,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6068,i,7817495142666844734,16534933549743263803,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
    3⤵
    PID:5056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6044,i,2007956801858191281,7793994857494446302,2097152 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:9
    3⤵
    PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,2053429157659985815,15223343560195635526,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:1600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,6982666783890470966,17521567227882845741,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
    3⤵
    PID:708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,3859695822655301175,2323189250799995580,524288 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=788,i,1421194670757786302,9604447790045859111,262144 --field-trial-handle=1936,i,438438729619433436,6281350670194577144,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3256_13427560688430689.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3256_13427560688430689.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3792_13427560688387180.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3792_13427560688387180.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 3019a1f81222bf7edef1ef8e46debc8426ad2fb79176c46b7e07f4c03ea7b8d9
MD5 d6ea4157e52d102fcf7ec3c7f6f1b9ee
SHA1 ac189861cde2620c83b8f3e804123040ec360903
SHA512 3180f59a7902a0cb54266bfd8e48542e1fa7f6552bb0e4212065f92aba9505b412a8a0e21be25baffc87c64cb3827ebb54a3ae73a563299da368a827fa988d95
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0fa30f463af58abfe3ae587262fc63b5d4fe87bdb544f977f91cef9dfff10abd
MD5 408f417b9d374dbd1d8fc9f08d40b63d
SHA1 cb01970358dc508fec90b230e24157e6407e1933
SHA512 1603ec893677972abf383946a35f7bc57de74ef311a57243e40bb8e059173062454183386dcb2ab14b19ab77faec1efc8d512daf73746f01bb0dea28c19a1f9a
TLSH
T183618DF7D2D88A7DC81156F49B217E1FDD3E0A28522D3C66CCD4AE4B53E2972D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b3d698d24b7753a8eeaf7a0964a3827585aec10985f9df647f77f3c408e4017a
MD5 adf617ffacfa512366040c1acef3bd8f
SHA1 203ad29b47b476a263c572ced5b1557aa690be25
SHA512 6ad1c9d7833c1ec6bd114ce2d3a1186c342df4323fa914b19aaa1c59245363555a0ee58171ff2e01ae19b5578978e7e92ff2833200ef9995fb3eeba764460195
SSDEEP 192:/RHyswPv7JYpAPRp2WXsb+WNnYt27ceqiyIsnAUge:/RHfwHNYUX9Xw42pe
TLSH
T14522842EB914B53F5CCBD25AFAA5B757D3F5102161D02E80E6FC8A2C16DB5CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 ee91bcb2a621340f79b85d85421e2a871727d48a4983dce1ca6ee3497ff92462
MD5 b3237077c0b1a4adbfdb85a24bb50698
SHA1 6d704c8ef23127b8fd4ba16ffcd473faca0ac772
SHA512 8eae7a92c10420986db3c8ee68e6c03ab8bd837e28a5ef01e5f3e4e96b5532e9e729e9291010cb8b220e8e17ea4b60b9753368414a531deb6a30bba018007da6
SSDEEP 192:/RHysg6Pv7JYpAPRp2WXsb+WNnYt27ceqiyIsnAUge:/RHf9HNYUX9Xw42pe
TLSH
T15432B52EBD10B53B5CCBD25AFAA5B757D7F5102161D02E80EAF8CA2C16DB5CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598265.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe598265.TMP
Size 3KB
SHA256 882b500074118d587a2a1531e2d13ae2be2607e332872e93dcc5118a3ac8c4e5
MD5 de1d7dfa954fc4c8316c4fc62baeded7
SHA1 c031a14376bb5682022d0ae25cac44886786d0a2
SHA512 e119c86ba884bb6436fad1f2a99a6e9e66babcfc3839527eb39a8010fd061a03daba4304a82c1dff55c886f216e07d52bcd839dcb07dfa52ab375cf8b76a659f
TLSH
T13661502DD1A4ACA72AB1B739783D1B91FA56823B164014063E3E08CC4FF6D278185F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 793e5a8dcc155efcfb752e232d5c2d0ba124a40afc9a59e625649eac1e361001
MD5 0701135ea28937a1f2ba26029b6ebc83
SHA1 913fd1f06fdc1db9d63d933f4f501fbe0434f57d
SHA512 b6ad723f38c95d2046bc6aa670054c6950407de1dd436b06cb520e8452051cd86eec4e64134102470be41255a9f381235cec94df6cd28363de35c8bcb6fc0b09
SSDEEP 384:JvjtE7KxkXqKf/pUZNCgVLH2HfgslCWXODts+ErU348HGlmvWy0XuYqvtTN:JbtE7KxkXqKf/pUZNCgVLH2Hfgsk8ORh
TLSH
T1FD52F827648C9A3F4F98D94CDC167F4FADB5025762A8092457FB5C0803E6BDB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b440738e9515822e8a9f764ef60b21d4553f95167a00e9fc3f4c456076dba65
MD5 63b54498d5dec680e0a346516905718d
SHA1 762b67b3acaf5a0a0c0b48d08e19d1df1fea448a
SHA512 faeac861be9424964aacd24b5c290e6b1d95d4eedb8d0e027fbaa64c30d9a84bc6eb73deac18053d45396ece166221dc1e631e098ab0e98d79d340333a6e43fe
TLSH
T1B6B0120C804B5F00C80042705506104833695E25A410070BE2D06995DC9B0F0C39B104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 571109d29c55c1071c5a75be693dca4e87ea03216fdfc1361dbb248d5679af6a
MD5 afec8d47f500414e376790c4918b1739
SHA1 014e86fd38e8824b870a722c0da7f0324bbf529e
SHA512 23d80b843d5752c1892094a911195f163a271ef7dbdb807562c0c5e12e6e9e75b528f13f5f666e0b54fec651e3306a103fee735ee92e2ce4ba1fc419f0de581a
TLSH
T15DA0025146C41515DE846272B066964923A298249D51832B64E3555D8AAB1D04193111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd0a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59cd0a.TMP
Size 48B
SHA256 d46972ffb3cb4ce422276746cc2a09122425cedd8ac476af9b2567b70aa15bb8
MD5 1e591e60430c557d80871b3e1b1b5158
SHA1 cbe112127c327b2c6366fa3700b5df49275029b3
SHA512 abd8c8c0d81df0b97d231b11af2666b8d57b39bb067614a2790a1874fdd36913b97c899e42dd00c075c88f05e562bb204b2132c16dac9871f7f42e36f4cd94f6
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 cd365f7279f270539da012e7240169edf6c7f8bed62681b633c5664368507c2a
MD5 4d13ccc9b73c133551f33eb27ae77c4f
SHA1 dc9913f1a2be35b2590c8789443cab564e6e1981
SHA512 a003cbfc2935c3f7e00841572ae3660ba0ec73855601a52a1f60faa871de990c801bdbd351a67186ceaaee2ab2fd3ecbdfc568139775d3befbd96cd1cca993ef
SSDEEP 96:AC6cd+geMi2SMvXpgWRXfZowHwzJRDotok5AfD7B6yZGyvuttIGk6boiv4a:ACvvTSMXuWRRokoDUDmFFEdI76boM
TLSH
T1BAA1F831A1384D3355B6D489BA462B53CFA8712BE6519E84A8DC6F0C16F71FC5382723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 2df68beed78e4fd8540ac6b108faf0a4b52ed5a825149b94449942c079846feb
MD5 cca886fd29f81505c95433ea081e9066
SHA1 a81e23643a545ce02649fd94424f419f35c88a64
SHA512 dabac7b14ee3f19570fb30cbb0a9e6e8a0a563dc4b3f33df7c063293f35ff3ca7dd69aa0d75436d4dcad825748a6e625890fc701658905b4db47e093f56e0004
SSDEEP 3072:6R1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5p:Smg1kQfATCFbzQACj6
TLSH
T1C5C3127A89A409BE1722045132821E64FEF5B73FDE162E9C936E0BB557CAC8E5387413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 6ee7d00c7408a64feff5afedde6b308f6d971d69bf633090119646557b6154ce
MD5 96b38dab899de6b5ca474e71152d4903
SHA1 a16bd4c93c0313936ffa622b9cfd17c5a899a808
SHA512 a3f48e29e1a050064cb41636a6645799cfa258ed100f31d27307d254d2ec39389f4c0c0fd24ec42fc94c9237230286a4c6c2852830fb051509ec2f4d73ba8b93
SSDEEP 3072:6zT1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5p:kpmg1kQfATCFbzQACj6
TLSH
T1B4C3125A8AF409BE1312046131421EB5F3D5A73FDF571E9C936B0BF66AD7C4A1386423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 216b0893904ac093300bd551716c68fc6eb494cf1914b5f5d913b7126e760cd8
MD5 94723f5dc418a96f38a1829b9dbd8a08
SHA1 7761ea922b5110b0745cbe6251f5f2e3872f53d2
SHA512 5a3dab08925c9ff590ba7a9d4fe0cbedb46c89060597befdd17621fa24743309ce8f45055a4832b146c1b1c3efc55e3a330a317e46093f5f7b83992f4248fef1
SSDEEP 3072:zzT1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5p:Hpmg1kQfATCFbzQACj6
TLSH
T191C3125A8AF409BE1712046121421EB5F3D5A73FDF532E9C93AB0BF66AD7C4A1386423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5832_1678668355\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 285e5e33ea57a60903f8230eff246aa8b1d2fc8fd620d70d819c554c1ff3b6ec
MD5 8e5d5cadd8ab09111c59abbb596f2be1
SHA1 19fe143c24edcace6ce42007bf8e5044c149906c
SHA512 0b313bd7a6529eaffa22f7b96b14b7b2e26bdcd29ff484707e36d2b26709e50141ea581b22585b1765f4df6c8c365817f322705905880de5a84bad99ed7266ee
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 63efb47fd6f51217b10893a26f763c85328f3758f6b6918e26d099793a341ba0
MD5 3413c405c88e222c3c2352960cd820fb
SHA1 96aabbb572d65802054af420c591078012f5669f
SHA512 12b4ebe8d00a4948196848026d6a7054607b3277546be3b26b403ea5cca3e04dc8931f8754eebdf9badce1b92872b2114b3fdd0a57cd5be6cf10a7499b63c1ee
SSDEEP 96:MapSG8jqxpy40hK2FK24M95mPofAE2NI5KYhK3bK3T+8:jI/qunGcAlL2oi+8
TLSH
T130D1CFD68E0349BF3B818B3B338321569FA7281AC7D9A07377DB9606B0CE565041F5B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download