a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8

Analysis

max time kernel
36s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
Size 2.6MB
Sample260707-sp4fsaf17t
SHA256 a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8
MD5 56beef19d493fb2af19d97f841aaa880
SHA1 b98fd74312d616cb442f648a4dd1a4082d0441e2
SHA512 7d4fa1f4f4c107cebcde145e1857877060c574988a496c1a5bddf127ec8996e913940df1d07e4c5a0741fb98335d2c2010e7b285130b5e4b6122494b7f1645e2
SSDEEP 49152:n5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUe9KTnUVz:MTrVI4dGOgGpYHCL
TLSH
T124C59D62F782D0B2E4D201B151BEABF74D787635537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1728	chrome.exe
5396	msedge.exe
4932	msedge.exe
5364	msedge.exe
3324	chrome.exe
4368	chrome.exe
2512	chrome.exe
1344	chrome.exe
2876	msedge.exe
1096	chrome.exe
4656	chrome.exe
5580	chrome.exe
4180	chrome.exe
3580	chrome.exe
5380	msedge.exe
5872	chrome.exe
5964	chrome.exe
5696	chrome.exe
4532	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	chrome.exe
2516	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279118508975329"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5696	chrome.exe
5696	chrome.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
Token: SeDebugPrivilege	5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeDebugPrivilege	5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5696	chrome.exe
5396	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 5696	5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe	90
PID 5696 wrote to memory of 1772	5696	chrome.exe	91
PID 5696 wrote to memory of 2332	5696	chrome.exe	92
PID 5696 wrote to memory of 1500	5696	chrome.exe	93
PID 5696 wrote to memory of 1500	5696	chrome.exe	93
PID 5696 wrote to memory of 5588	5696	chrome.exe	94
PID 5696 wrote to memory of 5588	5696	chrome.exe	94
PID 5696 wrote to memory of 3324	5696	chrome.exe	96
PID 5696 wrote to memory of 3324	5696	chrome.exe	96
PID 5696 wrote to memory of 1096	5696	chrome.exe	97
PID 5696 wrote to memory of 1096	5696	chrome.exe	97
PID 5696 wrote to memory of 2620	5696	chrome.exe	98
PID 5696 wrote to memory of 2620	5696	chrome.exe	98
PID 5696 wrote to memory of 4368	5696	chrome.exe	99
PID 5696 wrote to memory of 4368	5696	chrome.exe	99
PID 5696 wrote to memory of 4848	5696	chrome.exe	100
PID 5696 wrote to memory of 4532	5696	chrome.exe	101
PID 5696 wrote to memory of 4532	5696	chrome.exe	101
PID 5696 wrote to memory of 5872	5696	chrome.exe	102
PID 5696 wrote to memory of 5872	5696	chrome.exe	102
PID 5696 wrote to memory of 5964	5696	chrome.exe	106
PID 5696 wrote to memory of 5964	5696	chrome.exe	106
PID 5696 wrote to memory of 4656	5696	chrome.exe	108
PID 5696 wrote to memory of 4320	5696	chrome.exe	107
PID 5696 wrote to memory of 4656	5696	chrome.exe	108
PID 5696 wrote to memory of 4320	5696	chrome.exe	107
PID 5696 wrote to memory of 5580	5696	chrome.exe	109
PID 5696 wrote to memory of 5580	5696	chrome.exe	109
PID 5696 wrote to memory of 2512	5696	chrome.exe	110
PID 5696 wrote to memory of 2512	5696	chrome.exe	110
PID 5696 wrote to memory of 1728	5696	chrome.exe	111
PID 5696 wrote to memory of 1728	5696	chrome.exe	111
PID 5696 wrote to memory of 4180	5696	chrome.exe	112
PID 5696 wrote to memory of 4180	5696	chrome.exe	112
PID 5696 wrote to memory of 5220	5696	chrome.exe	113
PID 5696 wrote to memory of 5220	5696	chrome.exe	113
PID 5696 wrote to memory of 4588	5696	chrome.exe	114
PID 5696 wrote to memory of 4588	5696	chrome.exe	114
PID 5696 wrote to memory of 1344	5696	chrome.exe	115
PID 5696 wrote to memory of 1344	5696	chrome.exe	115
PID 5696 wrote to memory of 3580	5696	chrome.exe	116
PID 5696 wrote to memory of 3580	5696	chrome.exe	116
PID 5680 wrote to memory of 5396	5680	a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe	118
PID 5396 wrote to memory of 2592	5396	msedge.exe	119
PID 5396 wrote to memory of 2516	5396	msedge.exe	121
PID 5396 wrote to memory of 4676	5396	msedge.exe	122
PID 5396 wrote to memory of 2304	5396	msedge.exe	123
PID 5396 wrote to memory of 2304	5396	msedge.exe	123
PID 5396 wrote to memory of 4676	5396	msedge.exe	122
PID 5396 wrote to memory of 4676	5396	msedge.exe	122
PID 5396 wrote to memory of 5380	5396	msedge.exe	124
PID 5396 wrote to memory of 4932	5396	msedge.exe	125
PID 5396 wrote to memory of 5380	5396	msedge.exe	124
PID 5396 wrote to memory of 5380	5396	msedge.exe	124
PID 5396 wrote to memory of 4932	5396	msedge.exe	125
PID 5396 wrote to memory of 4932	5396	msedge.exe	125
PID 5396 wrote to memory of 5364	5396	msedge.exe	126
PID 5396 wrote to memory of 5364	5396	msedge.exe	126
PID 5396 wrote to memory of 5364	5396	msedge.exe	126
PID 5396 wrote to memory of 2876	5396	msedge.exe	127
PID 5396 wrote to memory of 2876	5396	msedge.exe	127
PID 5396 wrote to memory of 2876	5396	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
"C:\Users\Admin\AppData\Local\Temp\a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9ed11c728,0x7ff9ed11c734,0x7ff9ed11c740
    3⤵
    PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
    3⤵
    PID:1500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
    3⤵
    PID:5588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:2620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:3260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:3164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1864,i,3173218611786605756,17546298830124220607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x280,0x7ff9dd31c188,0x7ff9dd31c194,0x7ff9dd31c1a0
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,2113396533955451254,2225599595228052747,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:5164

C:\Users\Admin\AppData\Local\Temp\a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
C:\Users\Admin\AppData\Local\Temp\a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 486e6319e404021b221d9d17a037402d28559715181a8e0b2c627ccabcc8b0f2
MD5 b38e51ad557f530d1c41661f7c0638ef
SHA1 62df03cfd899bfe57c977fc405a532402a037d46
SHA512 5a5585fbd824dc8bc14de904ad1119ef5ee29ef29be521808bb8ca1b8b6756a3d81970155dfec8934673ac8cd475aabc791a9247b21f420614aa95329769fe7e
TLSH
T19E51ABB7C3D4966DC91156F89B216E2FDD2E0A28421C3C26C8E8BE5F53E2972D24134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 105214b2cee20f3a7c85ae38745a8d66cb68f4223e27b64510c8ae56b0f2047f
MD5 a20c650d806fc921f9150b4a35f2e749
SHA1 596faf09ae3d2f2668a7447bcc7eec954679d811
SHA512 f466584d1cb567f679c2303c013799acb9fc1c1419e85d5f8e908315ec78433ffffa19f3f334bbcf7aca3c498dce36e49d1340df862604670e32b2be12561139
SSDEEP 192:tRHHIGy8v7DDAPRp2q99Hsb+WNnGGdyeeXkYVyIsnAUgR:tRHH0omXd/wbdWR
TLSH
T1A422852EAD54653B6CC7D21AFE713B53E6F5102132D42E84E6F84E6C12EB6CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8096e1ec485038339c60e37adb79e31d9a612a21a8168a850119ac0b1f999c1c
MD5 b5e14ffc1336871d7e016390d737c29b
SHA1 d5a6db4d3484f3ef3e4990b1f7e95cde8429e415
SHA512 9858a79e1d9d3f26b52b8948c51eeed241d1ff627aa47b76d4cb95a738d4a3a4b0dc8612a2c4f931eafb03f3e50151221eea25410dc3ba200c514b3c90f703f6
SSDEEP 192:tRHHIGy8v7DDBPRphq99Hsb+WNnGGdSeeIkYVyIsnAUgE:tRHH0oNX8/wbdnE
TLSH
T19532B62EAD54653B6CCBD21AFD657B53E6F5103162D02E84E6FC8E2C12EB6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 63d256f0f033f08acfa5901d2088d24f643ce545c57839ad97ccbc398ea6623d
MD5 17842e9ade6862aaddca3bc319a502cd
SHA1 58de8d8f63d6bcf286db2e15b50a92289e6f2ecf
SHA512 cdbc516ee733117efbd93c426660c0592f7d6a1ed3832710255b06ff2cb2a68bc7c6ea8735a5f1bbf9be19c46fef9e32d955f718966497d6276611c9c203b660
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEFPdXzKD/K1+ErUkKN9MlwLBH+ux:3ZjyV7KxkXqKf/pUZNCgVLH2HfgslwdY
TLSH
T18F32DA27A98D9E7F4FD8D51CCC566F4B6DB5025633280C2452FFAD0803A97CA114E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4af12be39825a21e081d5f6271f0a595163f33faba9e62cf412b098f41c11129
MD5 37907c65de1344ce913ccdcf818a252b
SHA1 db9d8640bdbedce3847b62833b0c5018b2b076d5
SHA512 8355aa07cc9edb9c2a5a1164417a6230d1bffb0392f19707ee7dbd7052c6430eb596235eae549ffb213faff2a2f9504a37d5581c9e39bd32c14715240ec50199
TLSH
T15CA0022441F40812CF2252B4B975C9E3769A58255596474395F145CDD9AB1C18111145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0c84.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a0c84.TMP
Size 48B
SHA256 de6b4092df08efda72501e3d17616af45c29d5d7423e4f9adc664889d1fb5e82
MD5 79aed740ff586f1962fa0f525b3a6d5b
SHA1 24d7de9683c3f4a9eda59da858a05cc3c06bbbda
SHA512 69d3e8e2a8a687bd4168035d9c4dbc2a486e4f589cb5bbfae5073934d12c9aa70ffed0dfdcec4ea03ef0a8ab48619b0e44e4463fe49a18b6634ebdd3f20ef452
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 d542e183d0a091712715f3aef283f012e1b6b22ef9a489792c445907acb0ca1f
MD5 caad210202f946bfa6f54468eba4cdfb
SHA1 7f4fe71ea7574cea4689f3d94ee4dcf6acb5cf4d
SHA512 e48c340943d73a8d0cb97af47b854b6996ee25a66cb85df56f852588b6a271ddc19c74533c1ffad7f03c1ca5f7af7b506e9909bd65a8a46ff850e0eda7bc506a
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OCXnVumRntY:1nbZeMrv/hGtCXtntY
TLSH
T16FD3884B3A743002EDE59E722CE051BB5D3CB16D8F55A5D428B620688EF2953A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 a5efc34a6edb5b329628631d0ed22960676a5b2deb7f6696e51fd71a3b7aaa12
MD5 db047dbf14d6596f77e9890591beb7ad
SHA1 2c67e131ad2a997b5633d2854ef868382c9fd161
SHA512 17f5a3ba6ad992fe2a40caf7ed8fb8bf4cbffdcdd3774365b1e1ced3f60c6876a89502172dc89bdef707193720fd4cfd00636721ebe53398c8e7965849c3e334
SSDEEP 3072:1iT4j1UzixFZbSnN25iT6w4TJdNEyQs15oeYUeRX:1iTykocnv+1DNKs1uRX
TLSH
T1C7C312F036BD9D665EFB610D340FB12A4EF4F08F9408CFC623AD15937909BA4A691927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 d2976fbe3a25d07dc79ce2f005a8f684ee33de237e535dcaa50785fd58c374ac
MD5 5443ee438ca50694e92c9b66d23dd3ea
SHA1 8f6c49725c1e1a07bc086c868067bec933344317
SHA512 6c5dfc74af258ea8027045fd889270a55d409763ccce746c6206948767bd8fd9fa7190cb98b7de91798492a0b15c4bd740ab594d413cb6352c387f7e0ad88f3e
SSDEEP 3072:rVT4j1UzixFZbSnN25iT6w4TJdNEyQs15oeYUeRX:rVTykocnv+1DNKs1uRX
TLSH
T179C313E026BD9E665AFB611D340FB13A4FE4F08DC404CFD323AA11933D45BA466D1927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 50960f24f819b01ccbe02cbeef2d139b8ad07680a61eddffb67ebc4e6d0e5c2e
MD5 ccf0645ee31271a70a2cd794bb564027
SHA1 b394b0183e8cf04c66980c0d4bf2c908d1ab10a6
SHA512 f81947b1a3a0da25e8f375e9bf62f5fb047b3401c35d14d529d7f48d08fe1122e6ac8b832196a87931b7a717e6066129627989fdabb217f95a0cad71ed5d7fd7
SSDEEP 3072:rgT4j1UzixFZbSnN25iT6w4TJdNEyQs15oeYUeRX:rgTykocnv+1DNKs1uRX
TLSH
T1FFC312E026BD9E665AFB611D340FB03A4FE4F08DC404CFD323AA11933D45BA466D1927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 ec1ce1cb4c342d71efbb8ba81cc98aa3d629c1f4bab75b30382438f9ac08074b
MD5 f0c8fb894a288cbf555ccc93e8ea42ba
SHA1 8308020e56d0d2f6449359875ef0f222a3fa2974
SHA512 93f4a9d9c62eaaabc53eec4799169b2393928703e90aa5355513f54485c7527a22fcfe492571768ae97fbbd411c3843a52861f93113a43d62fa92906a37bf927
SSDEEP 3072:ogT4j1UzixFZbSnN25iT6w4TJdNEyQs15oeYUeRX:ogTykocnv+1DNKs1uRX
TLSH
T190C312E026BD9D665AFBA11D340FB03A4FE4F08D8408CFD323AA11933945BA466D1927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b53a5885e270ff23f3ba3237a8937f27825833b541a0f9353e7377b801c1b89a
MD5 0906c53458bf2e2e2de1aec012f68487
SHA1 a07e27c1fecb7eca484434f9d2b0b6176dd226d2
SHA512 890a3f6481d88ab6e79afb5758faed85fdf270680e6828225d7329a5fe544da71cafcade7835eeeeb6b615005f7c2ffd53c0ad5f5f6a281fdf787ec058272195
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok5JsDCB64GyvbNsbpYbcLDqv4a:8ClTjVWDUDgCgosbpYbcLo
TLSH
T1C9A1E971A5795C77647BD889B5413B03CFBC70ABA5919FC8A9E81F0C01F74E91302A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bc178f2f8e470b39c2322b0774c6ba3ae01fc64ff9370859d4bbbf8386e75a5e
MD5 d26ab905b99167662221a3a112aae9fa
SHA1 9304cf1024fd60dfcf323be549dd9d786a27f429
SHA512 a86f4ea1f2b95d7c5992062159e6fd2b900f113eec05714ff973d2301d961ce0a86fd3a0e014cc5a3399dec98d0699498ccc61c62afebcd4b9e620add8b1e93b
SSDEEP 768:CIrv+4UNbdX3PrH64hS7u37BtAwjUSzZ1UikB+:CIbsbR3PD64auoTYUJI
TLSH
T1FE03BF32A85499379CF7D289B25B2A43BFB4516385C91F94C8ED2B0D428B16D230BE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5696_73690393\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download