5d925be46a716210023e7661bfd8e31f5eb441a95116080679f41ed321383458

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
Size 17.4MB
Sample260709-vypebsew2n
SHA256 5d925be46a716210023e7661bfd8e31f5eb441a95116080679f41ed321383458
MD5 5e3d497bc3caf3ddc1b3317a6a24f83a
SHA1 3e92e970eef301e7be466fb1ccc16d8df2968a05
SHA512 b7940b2093ff960e8a18affed97ce763628b0a9bf81571ddd08f6a1c77ccdc339757033717859befb94f5a209c761dd9dae32bc239ff6295a7808571b7c75306
SSDEEP 196608:6WyZ/K0ttYVAAT1Kmd0x/h1+fSWyZ/K0ttYVAAT1Kmd0x/h1+zly:VyZ/K0ttYZTEqzyZ/K0ttYZTEqJl
TLSH
T1F2077C03F2A841E9E06AD174CE668231EB327C594BF1A5EF324076D52E77AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1300	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280914691041729"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 5324	1544	2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe	88
PID 1544 wrote to memory of 1908	1544	2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe	89
PID 1908 wrote to memory of 4856	1908	chrome.exe	90
PID 1908 wrote to memory of 5880	1908	chrome.exe	91
PID 1908 wrote to memory of 5880	1908	chrome.exe	91
PID 1908 wrote to memory of 1300	1908	chrome.exe	92
PID 1908 wrote to memory of 3964	1908	chrome.exe	94
PID 1908 wrote to memory of 3964	1908	chrome.exe	94
PID 1908 wrote to memory of 4972	1908	chrome.exe	95
PID 1908 wrote to memory of 4800	1908	chrome.exe	96
PID 1908 wrote to memory of 4972	1908	chrome.exe	95
PID 1908 wrote to memory of 4800	1908	chrome.exe	96
PID 1908 wrote to memory of 3244	1908	chrome.exe	97
PID 1908 wrote to memory of 3244	1908	chrome.exe	97
PID 1908 wrote to memory of 3000	1908	chrome.exe	98
PID 1908 wrote to memory of 3000	1908	chrome.exe	98
PID 1908 wrote to memory of 2988	1908	chrome.exe	99
PID 1908 wrote to memory of 2988	1908	chrome.exe	99
PID 1908 wrote to memory of 364	1908	chrome.exe	100
PID 1908 wrote to memory of 364	1908	chrome.exe	100
PID 1908 wrote to memory of 3960	1908	chrome.exe	102
PID 1908 wrote to memory of 3280	1908	chrome.exe	103
PID 1908 wrote to memory of 3280	1908	chrome.exe	103
PID 1908 wrote to memory of 2516	1908	chrome.exe	104
PID 1908 wrote to memory of 2516	1908	chrome.exe	104
PID 1908 wrote to memory of 2300	1908	chrome.exe	106
PID 1908 wrote to memory of 2300	1908	chrome.exe	106
PID 1908 wrote to memory of 3880	1908	chrome.exe	107
PID 3880 wrote to memory of 2772	3880	chrmstp.exe	108
PID 3880 wrote to memory of 3760	3880	chrmstp.exe	110
PID 3760 wrote to memory of 3068	3760	chrmstp.exe	111
PID 1908 wrote to memory of 4120	1908	chrome.exe	113
PID 1908 wrote to memory of 5604	1908	chrome.exe	114
PID 1908 wrote to memory of 4120	1908	chrome.exe	113
PID 1908 wrote to memory of 2556	1908	chrome.exe	115
PID 1908 wrote to memory of 2556	1908	chrome.exe	115
PID 1908 wrote to memory of 5604	1908	chrome.exe	114
PID 1908 wrote to memory of 5952	1908	chrome.exe	116
PID 1908 wrote to memory of 4312	1908	chrome.exe	117
PID 1908 wrote to memory of 5952	1908	chrome.exe	116
PID 1908 wrote to memory of 4312	1908	chrome.exe	117
PID 1908 wrote to memory of 4544	1908	chrome.exe	118
PID 1908 wrote to memory of 4544	1908	chrome.exe	118
PID 1908 wrote to memory of 1860	1908	chrome.exe	119
PID 1908 wrote to memory of 4752	1908	chrome.exe	120
PID 1908 wrote to memory of 1860	1908	chrome.exe	119
PID 1908 wrote to memory of 4752	1908	chrome.exe	120
PID 1908 wrote to memory of 2364	1908	chrome.exe	121
PID 1908 wrote to memory of 2364	1908	chrome.exe	121
PID 1908 wrote to memory of 4524	1908	chrome.exe	122
PID 1908 wrote to memory of 4524	1908	chrome.exe	122
PID 1908 wrote to memory of 1584	1908	chrome.exe	123
PID 1908 wrote to memory of 1584	1908	chrome.exe	123
PID 1908 wrote to memory of 2356	1908	chrome.exe	124
PID 1908 wrote to memory of 2356	1908	chrome.exe	124
PID 1908 wrote to memory of 2972	1908	chrome.exe	125
PID 1908 wrote to memory of 5844	1908	chrome.exe	126
PID 1908 wrote to memory of 2972	1908	chrome.exe	125
PID 1908 wrote to memory of 5844	1908	chrome.exe	126
PID 1908 wrote to memory of 1584	1908	chrome.exe	128
PID 1908 wrote to memory of 6108	1908	chrome.exe	129
PID 1908 wrote to memory of 5612	1908	chrome.exe	130
PID 1908 wrote to memory of 4380	1908	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-09_5e3d497bc3caf3ddc1b3317a6a24f83a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff71b70b618,0x7ff71b70b628,0x7ff71b70b638
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe4509c728,0x7ffe4509c734,0x7ffe4509c740
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,9341928449863047791,15018033021110823048,262144 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:5880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,7605136412251050014,5834147679335560217,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,13556216346638673910,9721357797945302251,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,13115627698217775737,6220290272345021456,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,10866790153510446648,2311372336964200054,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4612,i,5780508707459611082,12601412794408502941,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,18057429836373383501,10940693399887698750,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
    3⤵
    PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,3624389128653415064,6048040992122365078,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,9161471343915082579,10825852566944437278,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,5707663574662390162,4372170057784938867,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5468,i,16226843261252613213,6064526580908196866,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5500,i,2763687046095153940,13675705298248521464,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5408,i,12838615307467328128,10456743736428580160,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x258,0x29c,0x7ff7c20155a0,0x7ff7c20155ac,0x7ff7c20155b8
      4⤵
      Drops file in Windows directory
      PID:2772
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x294,0x298,0x29c,0x26c,0x2a0,0x7ff7c20155a0,0x7ff7c20155ac,0x7ff7c20155b8
        5⤵
        Drops file in Windows directory
        
        PID:3068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5908,i,972462418523205420,9406022561467317660,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,10648753751512910434,4686545344406420380,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6008,i,17099894332975637907,13416759604466059715,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6192,i,11710054834224964812,4359123205119288129,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,4748206591708718582,6486940394894944719,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5452,i,14420349153619119140,13132118656029769413,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5880,i,17950616724218901745,7572077021239382140,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,2127064521633038707,16426031928165815634,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5592,i,2393299144584964202,13095137891606386890,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:9
    3⤵
    PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,15728802549567906477,2308810253985094209,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,16092170456295522716,2443645108380854964,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,11705456183631136285,9067323492295622210,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:2356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6236,i,4719589392136772926,7646204029447689785,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:9
    3⤵
    PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5672,i,8082923269761469126,12535379865536046864,2097152 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,9449948452520408312,11021375472040045090,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,826725894997501771,16237036874591997000,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:6108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,14390067584874167966,16316306978079015069,524288 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:5612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5996,i,14786350753416297371,16112337644666829011,262144 --field-trial-handle=1940,i,15927505562419443548,1755080450730807834,262144 --variations-seed-version --mojo-platform-channel-handle=796 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3760_13428091469352282.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3760_13428091469352282.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

3880_13428091469399268.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3880_13428091469399268.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f356cb928957239a1b3e0cbaf0cec01906734673c777c1da50929a0979b0cd9b
MD5 4f5bbc1468804d492728bfcb395b2ea5
SHA1 77010c4f7cd5039b28cbb0c5f23da0790c4c16ca
SHA512 010690964d577d4899823a266343343b52f0d16a054be75e0b302284d670600ed8050335f3953fe3e74cad39e1d0d5852b629748f2d3d2ec7ac46537041f399e
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5bf9f4d4e6cc0a7e24327c3f54990efc38cfd09023b3d70669cec8e0670f304e
MD5 a9c745a0e419d832c19ad4c4f6153885
SHA1 adc1f665a8de125f17abb953ec31a57afc33e1e3
SHA512 5f468fb7c4c7c50363d2fbfb0d7b7b3a67f4997115b7490f9075833cf78bd4b49d8ab215dac6f8ef3a419e213d33dae2c3b671d58f39d7f16e8fa3617cc4d596
TLSH
T1D9718BB3D7D88A6DC45156F4DB217E2BDD2D0A14522C3C66C8E8EE4B57E2572E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 7b3f6cf76e83fd5c5508f33ce2a92ffcffd9e1b03feb6cd686a3fa3452b72b67
MD5 96b3fbd9ced249e63da0b3f9a378b3ea
SHA1 e56745c4567fe3704066a5ae007b703ae64058d6
SHA512 d9ab03eece60781cd47b44230ef4c8e7272f9d661324bdd580e29deeb6145505e279f1c20842398c3e8ff8b6cf28d6bea08e154a07ed095c2971323f98917916
SSDEEP 192:jRd+QQ8emzv7erpAPRp2aXsb+WNnUI2jYeviyIsnAUge:jRd+ORLirUXlXwL2we
TLSH
T1A432A42FB914687B6DCBD21AFA267A93D2F5103975D02D80E6FC862C10E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5982f2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5982f2.TMP
Size 3KB
SHA256 0a23b78bca7fd5472b2bc2e7d338a78d4553b4840110d0123b2f688e866a6b53
MD5 1ee436c852720ba61db7684a6dd7dfcb
SHA1 46f4fc0511c5e6f787e6f9af9b2570243aca9e74
SHA512 a6aa2db533e9202b583b2038bdc0ccbe00020b7fa4df6bc258343e7aa1825ba4967c52af480ea8ca6bfccf7a42bdb7085f063cdf64c80c84bd5ebe2f837269ef
TLSH
T15361616EE5580CA70DF67735783A0F42FEA0033F1680180A3E7E488C5F728978184F69
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 385a3042bcc4e3153849bb16bdd3b6d6dc5e16093cc00818d156e10dda128018
MD5 ab8d193ea2b1c0ec4b0eff8aace85479
SHA1 9b3b27e00a1d38a10fc466224e481ce82354a056
SHA512 13474aac37b3f2796f3e4690daf5b6a4c0bed73813ea677dff3adf47660b5ee3c23778ce0ba7f3a5b5be7ff0a01f7e8daef9ba6a38a3112aa77c2d9fd781986f
SSDEEP 384:sWjOR7KxkXqKf/pUZNCgVLH2HfgslL57pLuLcWa+fXODOJ+ErU3dRd:sWOR7KxkXqKf/pUZNCgVLH2HfgsV57pr
TLSH
T1E162F867BC4C9E3B0F94C588DC177E4FACB5025B36ED886493FA981503E5ACE11492EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0137b4ecf70787f279bcb8c4b1039cf14ff7d2aa27e17be83edc9b33fd71506c
MD5 570716b283571f188399b3a736061f09
SHA1 e172f5df1d8cf0b77db1ca84212153df6431565d
SHA512 c1682acd144c51d783056696c178d6e7ce26fb106ec6e532c865c04ea28b01e319a882d8cd7b0e22e38bac0dfccd9278c6dc672a196b785360d3770f2b0e2232
TLSH
T19EB0120980CA7B20C8008371618A908432155E36D1041B43F2E099C58CB30F04367204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 58d904636e9b582ed93be9287d911da25f2d8f597f516fbe34f66f67bc6a3c27
MD5 c6526ff743fcf11003ad5c6b56149ce6
SHA1 c518c0a99809d5790284762965885d4baf3a037a
SHA512 9b4c1b9f52fd2a33fe004a13805eb9a4b411c80e02b29787e619f7bdd5ffb4cc38763f374f15f40ff7c725276d6b77cc48470b8ff07268faec74966eb525155c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0ed39448d435458bb4cb8e8a56d16c2c3a7e53adfc78c58e5df4afd729408aca
MD5 c7e3ec817a5be3cd42eecc845c7c2f8f
SHA1 eea4dc6e29d486c4bb92881e0a36277a757af3b5
SHA512 11105a7e1956889ed15414eb67ff82e21ac551d97f056ec69a84e7109078c619e2a7a8847d6618367dcb986f99d98d234b445327af56475b244f1221a56c4732
TLSH
T1EBA0021496D01413DD31E67068A14942267A59546955573365E2168A897F1C04311609
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 221f83e4e781207845aa8ec56c8fc3dd39b8fa785a6b2e9a207f582792f40c4e
MD5 81aedf9e0a941844ffec1655f2629d26
SHA1 3dbbb1f23f28e7b8b564a41049e2789ed59227b2
SHA512 312df94ba31aadbd9001341e4d9b00a88f42013465ed2ec9e62ac79bdead22f0cd0d9c4e7d9d69f9b7fbaf3c977cf0570b7da750e59a47e9b3a12a6b3b780eca
SSDEEP 1536:iUkguvJ++8Jl2bxlxDwoMZ+Zb/QPU6papRcOl9QprVCe9ylAcR+slDfXzXEbe1fs:hksXtwbYNapWiCpB9y7trjUK1/Aj
TLSH
T10BC312B697625933CBAE1C09670B3B1A9FF401A70D2ADCC4B8D96E1D84CBC853B1958D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 c8fb26f22d5ba3c84ffb1af5932aa070c6f853260cd29108bfaa0196a4db44e3
MD5 172e0bbe0ddbea87b472768e1ef816ec
SHA1 b17124036d3ab360812bffad62a00192f72a3685
SHA512 072ae810d9893233b9e531c697938b2baf7b94959e69619632c199719465c0425397224e6f8ee0a87a9ddaac6e4b6416c5d09fc861ba08c6252768035ee7209c
SSDEEP 1536:zU8uvJ++8Jl2bxlxDwoMZ+Zb/QPU6papRcOl9QprVCe9ylAcR+slDfXzXEbe1fX8:I4XtwbYNapWiCpB9y7trjUK1/Aj
TLSH
T114C312B697626933CBED5901AB1F3B0AAFB500970C2ADCC1D9D59E2D84CACC1332498D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 90af9da75894ec34efe5c7378f8a0577fb489acd8e20407a5d9f689e738babf5
MD5 ef6d0b7ed402727da295cb40ca2d60c9
SHA1 eb18a835b5eef4e2597d31b1d98b5f6a44c70a25
SHA512 731ce68f02b4b4a9ebdf82eecb94d9c7f7521993620a48cbc210007f1b51fb67c69babae68211c805cddc4defb81280341c3c2e93de89f11c0230ad169434506
SSDEEP 96:3C6U6d+acl8CHIuxfTVKnvpSRDotok58NTDDB6iGyvKtcJaobB4Rv4a:3CQZclJo6SuDUD6dufcJaobBI
TLSH
T1E0A11A71A16D89335577DA86B9027F43CEB5706BA711BFC4E9EC1F0C09FB0A81702656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 fd87802a3442f5b02370ff654ff1c37870fd1ba33472c5e2ec689694daf58945
MD5 5bcecca11b5445d26660d47d03e79280
SHA1 016a8e1e6a15a9e734196c6dd065772d4d10e146
SHA512 7f2fa2105f6f8994242b51f086a8168529318419023602300c32d6baf78982b8ee1622e2c93033d1773a29d6030f5f1b5110f04c93d0c2bd45e03e19424879b0
SSDEEP 1536:iU8uvJ++8Jl2bxlxDwoMZ+Zb/QPU6papRcOl9QprVCe9ylAcR+slDfXzXEbe1fX8:h4XtwbYNapWiCpB9y7trjUK1/Aj
TLSH
T1CDC312B597666933CBED5901AB1F3B0AAFB500970C2EDCC1D9D59E2D84CACC5332498D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1908_1919341685\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 0bd2d189a211fa34cdb250af304fd05caa00c612d73a6c6fec07674697a3f67d
MD5 947e8af7ac4e0abb2060373230b1d837
SHA1 8718466a7be92c5782bc001da900982f5756a945
SHA512 c025c498147f618903a1b37ee3dc340c03a02e5e3a928b7e4149da115a19b2510ff520ca97c4585a8c571c5f54fcdc3d9f7016025cc4015b85fdaed50f62c2c9
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 49ecb991490c09c776a1628a87ed811f739685833bfe2433c3334b2d5bf428bf
MD5 6bcb75bf8d8c2759089b5bbdd0eee282
SHA1 78a237d12e67c4254168722e737afc328225a71b
SHA512 0e37c2a6af50af0a973162831b746e212df39e6750c0fdcbe2186d3012ce26691a247c058a96134565e214a93d7fe7a9c23ca9e47cea86f88b80a5741e0f43f5
SSDEEP 96:DZaZu6HLY6KSochK2NK2YkD3Dj45FS9XfPhK3qK3nZ0:oEgY4HG/F4N2K
TLSH
T1E0D1C0D69E0248BF7BC68B3B339331616D6B240AC7E8A4727BDF9546B0CE564001F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download