0f8dc56cd4365e722bf7be8dce376abf7381b104d07e090f81d9ff97239e9301

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe
Size 22.5MB
Sample260803-hfcatsdk5x
SHA256 0f8dc56cd4365e722bf7be8dce376abf7381b104d07e090f81d9ff97239e9301
MD5 bcc926aef9789b0853b5973356277c3a
SHA1 018b77c03c041de476f42065d7b48e438bbd2735
SHA512 cb4dec5ff7a30dfd22f3fc0b2dc0ab97e7018ea1337a369874ca8cf0f23d03250a5bf496cdd3156821411cb602c08c329811a149be990a77c20f9ceeceb16599
SSDEEP 393216:VyZ/K0ttYZT/yZ/K0ttYZTfyZ/K0ttYZT/yZ/K0ttYZT:VyZ/K0ttYZT/yZ/K0ttYZTfyZ/K0ttY1
TLSH
T12F375B13F2E841A9E0AAD174CE769731DB327C5A4BF1A5DF224076D42E36AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302128433661896"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
2288	chrome.exe
2288	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 368	4904	2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe	89
PID 4904 wrote to memory of 4440	4904	2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe	90
PID 4440 wrote to memory of 4232	4440	chrome.exe	91
PID 4440 wrote to memory of 4412	4440	chrome.exe	92
PID 4440 wrote to memory of 4412	4440	chrome.exe	92
PID 4440 wrote to memory of 864	4440	chrome.exe	93
PID 4440 wrote to memory of 1328	4440	chrome.exe	94
PID 4440 wrote to memory of 1328	4440	chrome.exe	94
PID 4440 wrote to memory of 1900	4440	chrome.exe	95
PID 4440 wrote to memory of 1900	4440	chrome.exe	95
PID 4440 wrote to memory of 5756	4440	chrome.exe	96
PID 4440 wrote to memory of 5756	4440	chrome.exe	96
PID 4440 wrote to memory of 1972	4440	chrome.exe	98
PID 4440 wrote to memory of 1972	4440	chrome.exe	98
PID 4440 wrote to memory of 5692	4440	chrome.exe	99
PID 4440 wrote to memory of 5692	4440	chrome.exe	99
PID 4440 wrote to memory of 2532	4440	chrome.exe	101
PID 4440 wrote to memory of 5664	4440	chrome.exe	102
PID 4440 wrote to memory of 5928	4440	chrome.exe	103
PID 4440 wrote to memory of 5664	4440	chrome.exe	102
PID 4440 wrote to memory of 5928	4440	chrome.exe	103
PID 4440 wrote to memory of 6036	4440	chrome.exe	105
PID 6036 wrote to memory of 3184	6036	chrmstp.exe	107
PID 6036 wrote to memory of 4392	6036	chrmstp.exe	108
PID 4392 wrote to memory of 5108	4392	chrmstp.exe	110
PID 4440 wrote to memory of 5492	4440	chrome.exe	112
PID 4440 wrote to memory of 1400	4440	chrome.exe	111
PID 4440 wrote to memory of 5328	4440	chrome.exe	120
PID 4440 wrote to memory of 5492	4440	chrome.exe	112
PID 4440 wrote to memory of 1760	4440	chrome.exe	114
PID 4440 wrote to memory of 1400	4440	chrome.exe	111
PID 4440 wrote to memory of 5328	4440	chrome.exe	120
PID 4440 wrote to memory of 1760	4440	chrome.exe	114
PID 4440 wrote to memory of 3476	4440	chrome.exe	115
PID 4440 wrote to memory of 3476	4440	chrome.exe	115
PID 4440 wrote to memory of 5692	4440	chrome.exe	116
PID 4440 wrote to memory of 5692	4440	chrome.exe	116
PID 4440 wrote to memory of 4136	4440	chrome.exe	118
PID 4440 wrote to memory of 4136	4440	chrome.exe	118
PID 4440 wrote to memory of 2288	4440	chrome.exe	117
PID 4440 wrote to memory of 2288	4440	chrome.exe	117
PID 4440 wrote to memory of 5328	4440	chrome.exe	120
PID 4440 wrote to memory of 5648	4440	chrome.exe	119
PID 4440 wrote to memory of 5744	4440	chrome.exe	122
PID 4440 wrote to memory of 1512	4440	chrome.exe	121
PID 4440 wrote to memory of 5328	4440	chrome.exe	120
PID 4440 wrote to memory of 5648	4440	chrome.exe	119
PID 4440 wrote to memory of 5744	4440	chrome.exe	122
PID 4440 wrote to memory of 1512	4440	chrome.exe	121
PID 4440 wrote to memory of 1912	4440	chrome.exe	123
PID 4440 wrote to memory of 1352	4440	chrome.exe	124
PID 4440 wrote to memory of 1912	4440	chrome.exe	123
PID 4440 wrote to memory of 1352	4440	chrome.exe	124
PID 4440 wrote to memory of 4540	4440	chrome.exe	125
PID 4440 wrote to memory of 4540	4440	chrome.exe	125
PID 4440 wrote to memory of 2060	4440	chrome.exe	127
PID 4440 wrote to memory of 4520	4440	chrome.exe	128
PID 4440 wrote to memory of 3716	4440	chrome.exe	129
PID 4440 wrote to memory of 2288	4440	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-03_bcc926aef9789b0853b5973356277c3a_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_remcos_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x290,0x7ff6c708b618,0x7ff6c708b628,0x7ff6c708b638
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc4cd8c728,0x7ffc4cd8c734,0x7ffc4cd8c740
    3⤵
    PID:4232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,14542777436030528768,14395207981793469362,262144 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,11666104095277304132,2082775366854486918,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
    3⤵
    - System Time Discovery
    PID:864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,5923150297532707479,1963740869105508279,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
    3⤵
    PID:1328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,15022204505866524671,1117839688824951929,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:1900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,14007573987491317518,15875077548144942470,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,4620594975849430192,2714779975030389237,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,7203989955498698546,18090823819992452939,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,3655344138285301319,3731299044894730273,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5400,i,12501426275838351735,16621286000344383295,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:5664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5412,i,1788070491943439766,15689664703830827810,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x244,0x29c,0x7ff62b1055a0,0x7ff62b1055ac,0x7ff62b1055b8
      4⤵
      Drops file in Windows directory
      PID:3184
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff62b1055a0,0x7ff62b1055ac,0x7ff62b1055b8
        5⤵
        Drops file in Windows directory
        
        PID:5108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5600,i,3043802071337189471,191959608856226732,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:1400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5404,i,8340772414023645259,16880682647911838210,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,713002524033605274,13975600740323681083,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,13910361681671888711,7616376303782560995,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5456,i,4236646005439797401,15245042422243666681,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,1294952625016523609,4802719223464428307,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,71652861902659132,5476757404865180176,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6184,i,1984212710108523334,4296659283513108532,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,12136895550175279746,6725485811861207155,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6324,i,7483741648661722235,15675369066161162595,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5976,i,178215798855579948,17724616534808346885,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,16099000968161298271,1234806846106653718,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4656,i,11979269737662336965,4388252245162063166,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:9
    3⤵
    PID:1912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4652,i,7865210875690894696,11343561786922496998,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6112,i,13116720003948170012,13431284706293782251,2097152 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:9
    3⤵
    PID:4540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,6420569583266469386,16974898512744328150,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
    3⤵
    PID:2060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,2719556266867587589,13990999212833893426,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,2284952475517365413,909375367924532343,524288 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5900,i,16770366409658526987,11956310715187364389,262144 --field-trial-handle=1928,i,819934634742020010,1179803801965059930,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4392_13430212843638068.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4392_13430212843638068.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

6036_13430212843672018.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\6036_13430212843672018.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 50de6db7f62bbfaef939d29c9c142a2ac9612163193282e1e14e07615b9d610d
MD5 555493624a94e891767d3c6a6ecaa359
SHA1 0a2c1f7ccc1e8770b60d715405438da6485cc1c2
SHA512 b92e4b2aeedc3fa12c38b78036faa41a383464767e11063431260004d35254a396361a21a189787035f322833e1b26685d967c8a2745c633fa5f8b658ee8e72b
TLSH
T16F61ABF3C7D8C67D885556F4DB207E2BCD2D0A24522D3C66C8D8AE4B93E24B2D24125E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 1e59d0f1bfe99453690d65f7b52d9f618c0e7e7a6fcc61428f2defc26b97a4f8
MD5 f871e65bcdefe9e630c83522ca7c4614
SHA1 09046357a996eb3ce742358631377ad8181471db
SHA512 9e6295348be9c0bc20a37e288e280a262927ef9cc9bddffe24b0f37a5333ef182cacb696843225f489630e7a9a46d186a837e2f6e8d794ff707c21c1b612dfd3
SSDEEP 192:4R3a4Ov7YpAPRp2CXsb+WNnRf2ebHMkwFiyIsnAUge:4R3a4q8UXBXw12vIe
TLSH
T1D532A42EEE54793B5CCFC21AEA257A63E3F9102520D02E94E7FC952C14E79CC2267127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a2db64f5f4f1da3bd7f655374c951a01df930c4b041817b37ca2217745132368
MD5 a34d15918a50c5c947c256185569a87f
SHA1 e9c560c16d34fd630501ec0342649d12d2e58a24
SHA512 30296e1fd40edf9fb3959d2d62d7f804281665f9f9f580dc084e03749713c2c2c287efc6d108bd514e574e9b03ccfa2fe9b4bfc6b372f7997ef4ecaa14c47d18
SSDEEP 192:4R3aGaH4Ov7YpAPRp2CXsb+WNnRf2ebHMkwFiyIsnAUge:4R3ayq8UXBXw12vIe
TLSH
T1B532B42EEE54793B5CCFD26AEA257A63E3F5102520D02E94E7F8952C14E79CC2267027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bd610d0a3bef46ed336e56c5e805c85fe7e89b6a533a9a696240c67850c82b0e
MD5 b657f3f1adb802c7c9f3d34b5e03ad08
SHA1 7c0a469ecdd9c46299f1bc5fb6ea9bcbdec84fc2
SHA512 cdee4256bd7c5b4cfcfedc0326879c64f3617676199b0613bc51861797fa0f46494ca394dadb3ae5fac688df13b37ee40e72946f5a13a16750dfe4c87df0fe5b
SSDEEP 192:4R3apaH4Ov7YpvPRptPCXsb+WNnRf2RbHMkwTiyIsnAUgE:4R3aFq8NXtqXw12meE
TLSH
T13842B52EAE54793B5CCED269FA257B63E3F5102120902E54E7FC992C14EBACC2257127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe596836.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe596836.TMP
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c782153129cb91f12865b253aa5d9e6259769d0ae864e16b5abafcb3004957bd
MD5 9793c9bbeeaa0cbd9b5e4538c03c1ee6
SHA1 b85987944437b16afeb1e6da4b43b8c797e9d207
SHA512 a1efa82fddb35d1a062b741b7d7fed748a704d2507713a68521c27a0ef16082483fee71dd18a5d024fd27352e382ec2c015f67d6d099ad00de605e6fb33c5ace
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2Hfgsll1XODmd+ErU3W+HG8tSNr3gK:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqH
TLSH
T11252F867684D9A3B0FD8C98CDC176F8BACF502576278092856FB5D0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 97f14badc88a2e8f3f6ad9f7120cae4db62b966892002fca2f548c5886deba3d
MD5 2e2e934073aed43b3c13d3073d768b2d
SHA1 668c4381ff44224d97ccf8b39c51574b1ccb1f2a
SHA512 2e295d041a6c7cb91929db18f82168a9c45a1a7e06c67b9ed2e90c4abb16d0bf663238dc6fd5ce48b84a0acdf6b3dfee72706b8df12ef4d63fc5b5eb219875ab
TLSH
T145B0125480473700ED00A5B01106508423105E3991504B0383E059D9CC530D07353504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2d032b4266186fdd6429f013b969014acfa20e8e2a49949f8faa1724f285bf4b
MD5 430ed52531878ee2e90012bd43d7bbde
SHA1 a5b2b1659d21e6b65a02863332eef23e45b391a1
SHA512 505359a7216de76ce558ec3e82f660dc93df70c7ad88bc1af25a869a34c54aaaec14dbed5b84da93eb6b5382f8c5e6d81e4dab7a7bb8cce7037c1c79c48f3565
TLSH
T1B6A0021491C45495CD415375A07B058533A29C182B514F03B99945C6895F2D54516140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b462.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59b462.TMP
Size 48B
SHA256 afdb23c76ae125c07dafb3ebc55c12361d4b4f4a5bccd0a8ccaf76916339b751
MD5 193e93f087b58c2d89f9edcd8dcff4c5
SHA1 721a369aeb1be05b317f7580dbe5d2e7e9423caf
SHA512 c56c5ff01a15c4739ba706242212b03fb54e2ddc7b5b255a5be0643d349c08d43ae0fc0e2a323bc4d6bccc782497b30e801e920c8b07d8cd3b5ef2d0522f49ca
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 96d614a4cd3c9dcc8f93447d3b2b75b71387afe2634361abb6be3fd46b45232c
MD5 a62e02846eecddd68cf5e31b1ea97648
SHA1 1566249cc17ef8d713d1d8c3c5ac54062fe98c9d
SHA512 832eed546582f65b15779fc5605588e1b1202dd954137aad2aa260e8d099e006d5004d431f6dea6a8dea8c8ac277d2eab846ba7a29a8b90c21982fe9a14bdd4f
SSDEEP 3072:xdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAU:x8i0Aw9NDv+qw5ZtAU
TLSH
T1ADC312316F13CCA74FE95456741B8B4E8ED4F82BE988EFEA69C47F1D421A8DD202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 99ab38113e0beba10b8a27449827bba54614316783172b50a64480488dddf5ea
MD5 07ce3b926bc94745a618eb0013ee5f89
SHA1 6ead7dbc88a77a631ad2ebcd57c041b8ad5d5d61
SHA512 4abebe31b1c8ec9a83cd17177cb8f068298afce5a52afe450806355e3043e06f73db03d6ac01c9d9d7b5e6c12473a37bbe8c0c3f69e12eabd2f07d9ab556c31a
SSDEEP 3072:cdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAU:c8i0Aw9NDv+qw5ZtAU
TLSH
T16CC313316F12CC778BC96466641FDB4F9EC4FC2ED584DEE659C47B2E425A8EE202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 730df1bd8b1d6b21226ad7f86e852efcb2d7272f472d385c37189320c555cdbd
MD5 a922dc2b7e9ff4786df6e8b7c2f81343
SHA1 3079d705f31c6241f725dffa9412157718ed072a
SHA512 0363e5f8ae0c87743dd6bcb58ef0b239d6545ed18bcc11cb005dc233ea575c11df3b6db3498aeb27fdbb0dd0865b9adc62759f19f59fc67e953d5acb4be05ee2
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5BHDEB6eGyvkonfob1v4a:MC0HJm5FHuPgXDUDZoW8nfobZ
TLSH
T109A12BF1A8B94CB759B7D345F9823A83DEA4A2276990FF90DADD1E0C01F31D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 64448ba03c8eafa8d0abf3636036ee6408e46bb68db049ca8c8122b0640b6db1
MD5 9425cb37674f043b17832f86d2fc9ee5
SHA1 fed84a7f94a28db3a817a1aeec56b89ac12a703b
SHA512 30629db14a087d639680f778142765cd0be324f002569d9706001d59dc6fb91b0e5b0d1c5a571b8b3b67760b1e7c5b507543abbb19b330a634c4e8df0915b146
SSDEEP 3072:pdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAU:p8i0Aw9NDv+qw5ZtAU
TLSH
T1B3C312316F12CC778BC96466641FDB4F9EC4FC2AD584EEE659C47B2E425A8EE202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4440_1217460484\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 8c8f023e8571238b5da916d457275e7bb34ac064caf5cc52ddeee584144a8aa9
MD5 1146a38f2fe543c9723a70dac28cc20c
SHA1 37cdc1b5a046d20e49ca1b48ba183282d29dedbb
SHA512 5f8c02745b6c5e3b8d79449790f0302fde094553cecd1d3b5b904ade886da7113e22439249d4d424e414e288a99290996cf9333e86150ac9415aaa68b15cdb69
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 39902f9a528cf2942d54264ad4b3cb58d229df6fc2837e3fe8de32f4e49f86fe
MD5 f7be1cccbfc6b3f4e3f9dec2b6aed188
SHA1 f3b365689dbd81ccc72e1985845ccb6f1f93b426
SHA512 728ba2e5bb3fd97e47171cda913dec6062af2057cffc4924c73fb21cc9199d7f64fae30ccd3d8551bf4c8148cfcd7185852001c835124917fe4da449b5e075f8
SSDEEP 96:UHaunJU4KQMvNCwBhK26K2fFMe5lsJm6vNPtVhK35K30Z0:U6coj1YJQmUahK
TLSH
T1ADD17E969F0688FF3BC19B7B338321515E9B640AC7D4647237EB9106B0CE6B5041F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download