12e137463e2644f5ca4a6333f8b194fd9e4143180a2bec16000ef6d7d9d9daaf

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
Size 16.2MB
Sample260709-ts4rdsdt6k
SHA256 12e137463e2644f5ca4a6333f8b194fd9e4143180a2bec16000ef6d7d9d9daaf
MD5 d847dbffc84cef523cf4ad5ab710c555
SHA1 e34d5f455ec9a8cc3e3ccb9fb23cd0b9e2dda6cf
SHA512 5d9f4a3b18270c9b925b0ac1adf153886c3831d2823a9c42a71b7027320feb2cf24023c44eb9889bf95050a15c50577188b5b00831d8661486d62e38f62c145c
SSDEEP 196608:6WyZ/K0ttYVAAT1Kmd0x/h1+fSWyZ/K0ttYVAAT1Kmd0x/h1+g:VyZ/K0ttYZTEqzyZ/K0ttYZTEqq
TLSH
T1F9077C03F2A841E9E06AD178CE669231DB327C494BF1A5EF324076D52E77AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5324	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
3576	chrome.exe
3576	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe
Token: SeShutdownPrivilege	4776	chrome.exe
Token: SeCreatePagefilePrivilege	4776	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4160	4368	2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe	86
PID 4368 wrote to memory of 4776	4368	2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe	87
PID 4776 wrote to memory of 3452	4776	chrome.exe	88
PID 4776 wrote to memory of 3300	4776	chrome.exe	89
PID 4776 wrote to memory of 3300	4776	chrome.exe	89
PID 4776 wrote to memory of 5324	4776	chrome.exe	90
PID 4776 wrote to memory of 4764	4776	chrome.exe	91
PID 4776 wrote to memory of 4764	4776	chrome.exe	91
PID 4776 wrote to memory of 4652	4776	chrome.exe	94
PID 4776 wrote to memory of 1496	4776	chrome.exe	93
PID 4776 wrote to memory of 4652	4776	chrome.exe	94
PID 4776 wrote to memory of 1496	4776	chrome.exe	93
PID 4776 wrote to memory of 1108	4776	chrome.exe	95
PID 4776 wrote to memory of 1108	4776	chrome.exe	95
PID 4776 wrote to memory of 5340	4776	chrome.exe	96
PID 4776 wrote to memory of 5340	4776	chrome.exe	96
PID 4776 wrote to memory of 904	4776	chrome.exe	97
PID 4776 wrote to memory of 904	4776	chrome.exe	97
PID 4776 wrote to memory of 1736	4776	chrome.exe	98
PID 4776 wrote to memory of 1736	4776	chrome.exe	98
PID 4776 wrote to memory of 2572	4776	chrome.exe	100
PID 4776 wrote to memory of 3420	4776	chrome.exe	101
PID 4776 wrote to memory of 3420	4776	chrome.exe	101
PID 4776 wrote to memory of 5404	4776	chrome.exe	102
PID 4776 wrote to memory of 5404	4776	chrome.exe	102
PID 4776 wrote to memory of 4196	4776	chrome.exe	104
PID 4196 wrote to memory of 3428	4196	chrmstp.exe	106
PID 4196 wrote to memory of 4656	4196	chrmstp.exe	107
PID 4656 wrote to memory of 5416	4656	chrmstp.exe	108
PID 4776 wrote to memory of 1304	4776	chrome.exe	110
PID 4776 wrote to memory of 3448	4776	chrome.exe	111
PID 4776 wrote to memory of 1304	4776	chrome.exe	110
PID 4776 wrote to memory of 3448	4776	chrome.exe	111
PID 4776 wrote to memory of 3692	4776	chrome.exe	112
PID 4776 wrote to memory of 3692	4776	chrome.exe	112
PID 4776 wrote to memory of 2088	4776	chrome.exe	113
PID 4776 wrote to memory of 2088	4776	chrome.exe	113
PID 4776 wrote to memory of 3292	4776	chrome.exe	114
PID 4776 wrote to memory of 3292	4776	chrome.exe	114
PID 4776 wrote to memory of 1212	4776	chrome.exe	115
PID 4776 wrote to memory of 2208	4776	chrome.exe	116
PID 4776 wrote to memory of 1212	4776	chrome.exe	115
PID 4776 wrote to memory of 2868	4776	chrome.exe	117
PID 4776 wrote to memory of 2208	4776	chrome.exe	116
PID 4776 wrote to memory of 2868	4776	chrome.exe	117
PID 4776 wrote to memory of 3540	4776	chrome.exe	118
PID 4776 wrote to memory of 3540	4776	chrome.exe	118
PID 4776 wrote to memory of 2904	4776	chrome.exe	119
PID 4776 wrote to memory of 2904	4776	chrome.exe	119
PID 4776 wrote to memory of 3692	4776	chrome.exe	120
PID 4776 wrote to memory of 3692	4776	chrome.exe	120
PID 4776 wrote to memory of 3940	4776	chrome.exe	121
PID 4776 wrote to memory of 3940	4776	chrome.exe	121
PID 4776 wrote to memory of 2496	4776	chrome.exe	122
PID 4776 wrote to memory of 2496	4776	chrome.exe	122
PID 4776 wrote to memory of 4272	4776	chrome.exe	123
PID 4776 wrote to memory of 1992	4776	chrome.exe	124
PID 4776 wrote to memory of 4272	4776	chrome.exe	123
PID 4776 wrote to memory of 1992	4776	chrome.exe	124
PID 4776 wrote to memory of 4516	4776	chrome.exe	125
PID 4776 wrote to memory of 4660	4776	chrome.exe	126
PID 4776 wrote to memory of 1836	4776	chrome.exe	127
PID 4776 wrote to memory of 3576	4776	chrome.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-09_d847dbffc84cef523cf4ad5ab710c555_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff63bfab618,0x7ff63bfab628,0x7ff63bfab638
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff96facc728,0x7ff96facc734,0x7ff96facc740
    3⤵
    PID:3452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,14342785262719205351,16086568890786954590,262144 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=1632 /prefetch:2
    3⤵
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,2832036591073793137,17464993063048401642,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,8238653746346473168,5195600658445587698,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
    3⤵
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,3878264643712638726,12710810973856499101,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,8970297794948725676,11659988240396645430,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,9845419849322166832,15921763273691713770,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,10789416416784284472,17122689763098704504,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,9630454657406787224,17349971857846229914,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,11237402707463269765,8481529206879032440,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:1736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,2935424575151329020,10638235969332882763,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5428,i,10828113791635961138,10086646040007902715,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5440,i,11733358057024898838,14542911294918724295,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x258,0x29c,0x7ff727cd55a0,0x7ff727cd55ac,0x7ff727cd55b8
      4⤵
      Drops file in Windows directory
      PID:3428
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff727cd55a0,0x7ff727cd55ac,0x7ff727cd55b8
        5⤵
        Drops file in Windows directory
        
        PID:5416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,9082321535987530726,16387019428751674748,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:1304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,14631722009923928478,16653333742836948630,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:3448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6136,i,11421631268475231209,13397554226074616859,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5892,i,972439940911241002,16864630481661406034,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:2088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,7762660023728873614,5037912287278973646,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6184,i,5360452527206002084,17907345725382166235,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,16248823341144051218,12538930424484285153,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5432,i,16227879993423416117,17196724820310420302,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6348,i,2681651097677359675,15446863155976873573,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4612,i,10960928917351878096,7352281178605196518,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:9
    3⤵
    PID:2904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,11539852818552454872,6561359571389656386,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:3692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,15410963636111977479,10337472951524256528,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,4798495932022837098,13310096226409470097,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5532,i,8644213199170163951,9948101574788703923,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6432,i,11071873719884174802,10841772800888507299,2097152 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:9
    3⤵
    PID:1992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,5688897256742766865,5318651062400391171,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:4516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,11549221170184440138,15663330541625311382,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,13181026359874141126,15975438299474247837,524288 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:1836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6376,i,7317114822140275063,12377142300868605875,262144 --field-trial-handle=1640,i,3861680903753916703,1666195017284073284,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4196_13428087628106544.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4196_13428087628106544.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4656_13428087628058889.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4656_13428087628058889.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1bf612abfb0e469996d5ee350299f7d3920a6e9c711140af2b5947a209f729d6
MD5 7490573a357c52f34203bf895f8ded25
SHA1 fdefd9318e3eb2c65e2b61bf581295c2b1601ba0
SHA512 433598381ab6fce191db63ea71b36cb3e9af5d3f3a8eafc3e71a2879098bcf716456fc87914659a43a1a9f14484ef16418d8748cf8254faf63f7415d5561c27d
TLSH
T156517AF3C7D8C66D891196F49B217E1BCE2D0A18422C3C6688D8AE5B57E2872D20168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4cf0e88bb6bcdfb62cf1363c98ad3d3464f54ccd3c85761afa965f7ea0e78361
MD5 5c0aab0699034ee6b2cf5906ec9eacb6
SHA1 209d3166c300ed25af408a27d8568910631a84e2
SHA512 7bc634da05d50ef4a1758350f8b403dbad183d6cf70bc9a24afe55314fb6e03bee1fbc00e782236a73586e97bd41ba631f48bc2bb936078eb45c1f3b20d02fc7
SSDEEP 192:IRhEQtNqeHc5zv7BpAPRp2uXsb+WNnzp2NCiyIsnAUge:IRhE7eQLtUXFXw92Je
TLSH
T11022942EBA156A7B6CCBD21AFA657693D3F5102521D02E80E7F8CA2C1AD75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 71157ca9a0adf6572a68f2480cc4649202e5a5381029bac28b617600bbcf8bb3
MD5 0a357b7728b21b2a5a2e0fe3f4e65fa0
SHA1 805932fe930a66d2f90e49644c145408421c8611
SHA512 f439c8db2f04bfd642ec4bd5ac163a746d2b81ddf062d57118c77109195889c4af10329d7e99d40a6a2f378e402eb8fbe5d16ec2035a2c20ee1fcb32eefc2f0a
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslaU7pLuLcWaU1XODmd+ErU3Xt9rsg9:MKm97KxkXqKf/pUZNCgVLH2HfgswU7pf
TLSH
T1F062E967BC4C9E7B0F94C988DD177B8FACB5025762ED886492FB581503D4ACE110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7d9b342f5225c6d8268bd0de52e581806cf719a89a9686d010939a456c3d435d
MD5 9440239247ddd652b3bfc980360fe5b3
SHA1 daf76f30298d0b1affd7e980a3a2aba1733b5590
SHA512 b37f12b1c409770b50ba5eaaa3db01eb4025d30b58ce9303d3cd23a2a6e6fcbc40441ecddec27c64c1cfdfad15af1d210fec4a50c5de2025aeb4f4158eac8a05
TLSH
T166B0121C854F1B10C80041B41105504D33156E2190004707D2D15B999CA30F44352115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e56033d8269c53611f1a8ad1dd054ceaf13310cc987a14cf5da03f79b921fdd0
MD5 ed348b8d8816b16c034cbcc3faf41230
SHA1 fe9ae725c4fbd0b463cff33b53a9256d5b1cd081
SHA512 e58057d58ee3e8523eebe98d8cc88f51a6da3638d20e6cdcf3f2b41e7b85eef22724bbd8403d76c517c9c27624a7fbd6e8cc828263801e140517eded145f4d30
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a0d1ebc01c6cc17c22346dc2f5e248c4ff161d1e679eba0990f6c2971196f667
MD5 c2a5642ecd7b9a834a8c291a2f47b7e1
SHA1 4b25f3980f297d90f48e935557402fdcd80a77f8
SHA512 509ee2cf176239ed9db4f2ef0fd750580511d6ac0e8e23fb28ae078ce11535a961f9d5e812eb1e251cf879aa4f4c1c399eba208454368009fa3747beb28949ae
TLSH
T131A0021041D25952ED10A77064721A437652C9283561570368D38448895B6C25111610
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 2058478a0e21eb6e35622f575f84791fff516c695d0e959031e96d10d6ab234d
MD5 bfd9f2e4927f887e5f33322892a2ec47
SHA1 76b9fae6154c35eacb99823578bb9aa939e47812
SHA512 1fac07d1d30b2717b2d1e22cd818d18a66cd8607ee6bc2ebe9bc2ab55ed769a03f97daf323409be0d261545b353c74f19faf1ad8c311a2fd574f3356d8e3b4eb
SSDEEP 3072:5nMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkY:5neRinYKkQTo+OYUxY9R+in1qLt4Ct
TLSH
T197C31239A87B6C3686BB836A3247B98204FC563340D589B4D36D6BCF4A13F5235D5AC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 7c669c7975eb82d2d138f1ad81aa448227739d7febb9ab7b6cda3e6478c2c121
MD5 382b73e815692f3a19e4c4e7409bc2d1
SHA1 32bb71642f99c65a68ae44175cd64d42ea90cf74
SHA512 bec8f3440ad76e8b8550602218684a774fe96ad3a8d45ed99fa9d52816ff0eb8d5d4f4c44e5cb094375bbc4e9b0ef0ca871e5a2e8399d761587101f0df0b8bd7
SSDEEP 3072:unMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkY:uneRinYKkQTo+OYUxY9R+in1qLt4Ct
TLSH
T1A7C31239A87B6C3686BB836A3247B98204FC563340D589B4D32D6BCF4A13F5235D5AC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c57ea1f65ecdbdb53b89dd064f0d94a67f8ac396e0170543fd40f9e546ee40c7
MD5 b4281d301ad45bf63e7084d0a9972d4b
SHA1 5fcaecca5680752aa6c57fa523d1480a95e5c4a3
SHA512 f7f06c2cf3c4a49016a41f2e90914a07556fd4aa8690fa172830064cfb080f7e6fecbd7f0bb833bc8eda916eb210d419c799adb5deacab635ea8658c593cd68b
SSDEEP 96:5KC6jd+oJm4V0FH+pqf+HBKyoytsRDotok53HDjB6eGyvkonHob1v4a:MCIHJm5FHuPgXDUDz9W8nHobZ
TLSH
T1AAA13AB178BA4CB719B7C248F8923A83DEA4A22765A0FF84DADD0F0C11F30D81301627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 b20e96cb36d94a07baea5fab58f16d83b49b67f69c25fec0170bcfd343f73e6f
MD5 fc5918a5bef4680ce8859b00cebf7067
SHA1 5c0e69e117915ddb820e85b81258210d1afa4543
SHA512 53a29c5a2473792560eee8b32aa2a0cfebedbcb624cc7e58ad5c1923600556211048d23df6cc990c96348096a22262e828960aba199d7b15e63bb7c74bb561f4
SSDEEP 3072:mnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkY:mneRinYKkQTo+OYUxY9R+in1qLt4Ct
TLSH
T167C31239687B6C2689B783593243BA810CFC563340D98AB4E32D6BCF4716F5636E65C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4776_1717787336\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 8c8f023e8571238b5da916d457275e7bb34ac064caf5cc52ddeee584144a8aa9
MD5 1146a38f2fe543c9723a70dac28cc20c
SHA1 37cdc1b5a046d20e49ca1b48ba183282d29dedbb
SHA512 5f8c02745b6c5e3b8d79449790f0302fde094553cecd1d3b5b904ade886da7113e22439249d4d424e414e288a99290996cf9333e86150ac9415aaa68b15cdb69
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 ae05c1e8f148e9068922c5a5e8f6132f5150daa87a5448360d470ba71a17e756
MD5 867cb9da778e5c45fb60c22e437069a0
SHA1 5627a1515d39cf42ccd38136a23d04c01c7b8181
SHA512 036247e33ab29434a26b559fd7ac031cb214917778aca3cbe8977e6de9216f184310ba5e245557162c6888b0d86e6f3779f0b78c6e16cb088ea374e22097730c
SSDEEP 96:UHaunJU4KQMvNCwBhK26K2fFMe5lsg1Hmcmb9hK3pK3I90:U6coj1YJ11HkaRu
TLSH
T193D18C968E0248FF7BC18B7B338321526E5B540AC7E4A47277EBA207F0CA964041F5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download