94367569fc2c7303c95097a166e5b95bb4525772ce6eefa2629258ec8580cd0e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe
Size 30.6MB
Sample260818-j74d3ayfph
SHA256 94367569fc2c7303c95097a166e5b95bb4525772ce6eefa2629258ec8580cd0e
MD5 6deabe35d913135f88cb8cf3d71c8572
SHA1 766ec706f5f093383000385398461861e36c7699
SHA512 be8e6ffcccce8c1a89a1a7fb4504cc7c662a4e92fdcd9168b9fa6942bd9fa8c446fa9e829dd5a941f834546cfee32be6b4cc7f2ddf7cb6b854a6a0ef1665581b
SSDEEP 786432:VyZ/K0ttYZTuyyZ/K0ttYZTu2yZ/K0ttYZTuyyZ/K0ttYZTuA:cZ/K0ttYRu5Z/K0ttYRuNZ/K0ttYRu52
TLSH
T11F677D03F6E841E8D0AAD274CA658732E7727C154BB1A6EF225076D91E33AD07F39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
108	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315147969979403"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe
Token: SeShutdownPrivilege	4656	chrome.exe
Token: SeCreatePagefilePrivilege	4656	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4656	chrome.exe
4656	chrome.exe
4656	chrome.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 1428	5080	2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe	89
PID 5080 wrote to memory of 4656	5080	2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe	90
PID 4656 wrote to memory of 6060	4656	chrome.exe	91
PID 4656 wrote to memory of 1736	4656	chrome.exe	92
PID 4656 wrote to memory of 1736	4656	chrome.exe	92
PID 4656 wrote to memory of 108	4656	chrome.exe	93
PID 4656 wrote to memory of 932	4656	chrome.exe	94
PID 4656 wrote to memory of 932	4656	chrome.exe	94
PID 4656 wrote to memory of 3828	4656	chrome.exe	96
PID 4656 wrote to memory of 3844	4656	chrome.exe	97
PID 4656 wrote to memory of 3828	4656	chrome.exe	96
PID 4656 wrote to memory of 3844	4656	chrome.exe	97
PID 4656 wrote to memory of 2012	4656	chrome.exe	98
PID 4656 wrote to memory of 2012	4656	chrome.exe	98
PID 4656 wrote to memory of 2800	4656	chrome.exe	99
PID 4656 wrote to memory of 2800	4656	chrome.exe	99
PID 4656 wrote to memory of 5924	4656	chrome.exe	101
PID 4656 wrote to memory of 2576	4656	chrome.exe	102
PID 4656 wrote to memory of 2576	4656	chrome.exe	102
PID 4656 wrote to memory of 3668	4656	chrome.exe	103
PID 4656 wrote to memory of 3668	4656	chrome.exe	103
PID 4656 wrote to memory of 5444	4656	chrome.exe	105
PID 5444 wrote to memory of 4264	5444	chrmstp.exe	107
PID 5444 wrote to memory of 5660	5444	chrmstp.exe	108
PID 5660 wrote to memory of 2824	5660	chrmstp.exe	109
PID 4656 wrote to memory of 2876	4656	chrome.exe	111
PID 4656 wrote to memory of 3216	4656	chrome.exe	112
PID 4656 wrote to memory of 5064	4656	chrome.exe	113
PID 4656 wrote to memory of 2876	4656	chrome.exe	111
PID 4656 wrote to memory of 3216	4656	chrome.exe	112
PID 4656 wrote to memory of 2900	4656	chrome.exe	114
PID 4656 wrote to memory of 5064	4656	chrome.exe	113
PID 4656 wrote to memory of 2900	4656	chrome.exe	114
PID 4656 wrote to memory of 4704	4656	chrome.exe	115
PID 4656 wrote to memory of 4720	4656	chrome.exe	118
PID 4656 wrote to memory of 4764	4656	chrome.exe	116
PID 4656 wrote to memory of 5580	4656	chrome.exe	117
PID 4656 wrote to memory of 4704	4656	chrome.exe	115
PID 4656 wrote to memory of 4720	4656	chrome.exe	118
PID 4656 wrote to memory of 4764	4656	chrome.exe	116
PID 4656 wrote to memory of 5580	4656	chrome.exe	117
PID 4656 wrote to memory of 1332	4656	chrome.exe	119
PID 4656 wrote to memory of 1332	4656	chrome.exe	119
PID 4656 wrote to memory of 5196	4656	chrome.exe	120
PID 4656 wrote to memory of 4056	4656	chrome.exe	121
PID 4656 wrote to memory of 5196	4656	chrome.exe	120
PID 4656 wrote to memory of 5652	4656	chrome.exe	122
PID 4656 wrote to memory of 4056	4656	chrome.exe	121
PID 4656 wrote to memory of 5652	4656	chrome.exe	122
PID 4656 wrote to memory of 5532	4656	chrome.exe	123
PID 4656 wrote to memory of 5532	4656	chrome.exe	123
PID 4656 wrote to memory of 2200	4656	chrome.exe	124
PID 4656 wrote to memory of 2200	4656	chrome.exe	124
PID 4656 wrote to memory of 3032	4656	chrome.exe	125
PID 4656 wrote to memory of 3032	4656	chrome.exe	125
PID 4656 wrote to memory of 1228	4656	chrome.exe	127
PID 4656 wrote to memory of 2540	4656	chrome.exe	128
PID 4656 wrote to memory of 4996	4656	chrome.exe	129
PID 4656 wrote to memory of 6112	4656	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-18_6deabe35d913135f88cb8cf3d71c8572_cobalt-strike_emotet_glassworm_hijackloader_icedid_njrat.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff7165ab618,0x7ff7165ab628,0x7ff7165ab638
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xe4,0x134,0x7ffedb0ac728,0x7ffedb0ac734,0x7ffedb0ac740
    3⤵
    PID:6060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,8871854802472891515,8135097696435518515,262144 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:1736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,13228474264325364906,3128412010904327963,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,18285803875262750840,11824468511247545149,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:13
    3⤵
    PID:932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,5063854544268571710,17159915570980220164,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,5007616960831964492,13112203734934371001,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,13464354686148005041,15335966584030524681,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,17647381676311577383,551911726244841404,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,2693815332834934779,2592188345331765274,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5404,i,11117120702237519092,1105917168110052056,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5416,i,12573514003515126267,12168921334573372852,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x24c,0x29c,0x7ff69c7655a0,0x7ff69c7655ac,0x7ff69c7655b8
      4⤵
      Drops file in Windows directory
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5660
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff69c7655a0,0x7ff69c7655ac,0x7ff69c7655b8
        5⤵
        Drops file in Windows directory
        
        PID:2824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5396,i,5867687131763362251,3723323261233301635,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,5726136610849270919,10144661890148743293,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:3216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,4210386491694503882,8037599977723230888,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6096,i,2720651806248102715,14834508099157438632,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6348,i,1046798327572067245,17103237974783694642,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,15340691600871275347,12073428236583297769,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5700,i,13743735149790065433,12269210130761579049,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,1559201513343747359,3250103524357833766,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5912,i,9179589635959045479,16505086318393718510,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5588,i,5482593400106950046,14422718842305146056,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,6281422425487173303,18018458354893668549,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:4056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,12270104405715859810,220032460363491165,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6320,i,16317063327155637144,4026625246648358868,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5368,i,17650060635753275949,1067224318265969407,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:9
    3⤵
    PID:2200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6192,i,5524992240860024799,6712140856194563826,2097152 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:9
    3⤵
    PID:3032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,10785585382988647424,2206271252107739427,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
    3⤵
    PID:1228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,17722103690446570175,5210392666236684984,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,1203467182848232199,16876962253152687945,524288 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6172,i,2857809839780188999,13737865828704909640,262144 --field-trial-handle=1956,i,558156925883770481,11681993116638563349,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5444_13431514797222838.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5444_13431514797222838.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5660_13431514797169587.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5660_13431514797169587.pma
Size 696B
SHA256 2585c255c9eccbee4e4a8d9c2c137bef1660139a212e4210b41aed5c9b49f1aa
MD5 ea061987abd88f9b323e71fb9b92e467
SHA1 cc7770ac4ad376e7031d467565b2888050bb0c77
SHA512 a9659d46e15b30845448caaee821f1c719fb91dc6626e30e51d0d9299d75cae4309ed9ff21973a981e3b9fecb34f37b4f08cf486539cec85979810540b18e9dc
TLSH
T1DD010E46B3544F77CC468E3584FE27512BB4FA502B821BBF7B10764F2E021C89E9A168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 95cb62b42698e7f06379df40c942fe0fce2247fc09a055fbd4067a1415770e80
MD5 0aed033326e24dfd351e48d099e4af90
SHA1 e813b2ae43ac30d036c421e5f17ab707fbdd9f81
SHA512 fbb6f429690618fc3282cbe579539d91e3408878f2b220a977cdf48285600dfd42494ced9a6aecb4b17c0ab3df982d2fe7b4ccc0dc78b9523cf9eac0774198e8
MD5 SHA1 SHA512

Submit Download

225f5c9c-cf99-4e1b-bf4b-bf5de50cb585.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\225f5c9c-cf99-4e1b-bf4b-bf5de50cb585.tmp
Size 17KB
SHA256 58110feb427d773eae16fd2c0b6d7a054e74fb37099dd0720e0922661fde4467
MD5 fc108e88ba007cbace18baa058d89764
SHA1 b12d5f0fcd0d5d1fdfb67e382a131f37f3e6827d
SHA512 226ef261b1057626f3426a00b5a7a24b64ecdd0749d8478621e543ff214d29506194dfce17556a9e0cb45d24edacc94a1715d14cecfc6a86fb13366270baf773
SSDEEP 384:uEjEn7KxkXqKf/pUZNCgVLH2HfgslMq7pLuLceQMtXODEL+ErU3IIGCHGqnSch9:uIEn7KxkXqKf/pUZNCgVLH2HfgsWq7pt
TLSH
T1527209677C4C9E3B0F94D5CCD8277A4FACB5024B66ED886483FA982503D5ACF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\service_worker_bin_prod.js
Size 132KB
SHA256 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
MD5 4208fdfeff374e23801e43b0fb3be7d0
SHA1 7115966dc5b13d52e04ecab1915d83ff4f851c0b
SHA512 93c65fa0c727676bd1741fca7d31166798ffeec416322c30dab27f5ae7cf7d77b3d4cfc72e2d75fde9d9c389dfba9a57c2417321ddf29ff01718beba0717c070
SSDEEP 3072:NMMPOfeioQnKd8lIuG5sVFbcBvahMWlURPLVV+9Wy7:NMMZQy8h0ahMWlURPLVV+o0
TLSH
T165D3D9CCB6B5B4224363A5F5002F010BB23AB8A9E44C85A8F188D9E97DB546D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4378eab884300e39bb0163e52ff062345836993fdb213805068e538e7c0957aa
MD5 6293998b2c4fceee0bae382404806790
SHA1 664e99b282bab0f40133e38411b779b54be7dd2e
SHA512 c96e45638751a01097b2ad7a8a21d52b221e4f1a9c55501ecb2a86d0d4f2b774edd1e0304ecfe93b77704747082d72b570cb9498e4bfde6ab56cecff041a74f0
TLSH
T14551ADF7C7E896BD881156F4AB257E1FCD2E0A18131D3C52C8D4AF1B53E2872E21029E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 45b25d67cf81c9eed2f5b273e8f8113b71fd187789f9514ff531da83bced8a56
MD5 6049b4ad64686468cf091d9b04d6c35c
SHA1 fd495fc0f9bd671a3f1ce436a9358829c5923b4e
SHA512 062cca61816d8631ca870e7e2e06ea6bf8d839ee5257f8886e8e68e54c26fd7113e61f5ec5b2e558613148631acd020362e462c0a4d7b8275da49b1602ec8062
TLSH
T17D518EF7C7E89ABD881156F59B257E1FCD2E0A18131D3C52D8D4AF5B53E2872D21024E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b200c890ed0c5358680040cf02c6e4f1d938e8e85d328c193365e69ce73647b6
MD5 5e4b7ec7a671b0e042c22a5f6b2f7f7e
SHA1 d70ae744e9a51389144b07abb4b2f644838eff1a
SHA512 cf6911845da141cb987fb62ca8849e8d42c2e76e388ad972b164b1e3e7b010ccd1907c39772d95ce4b8b5f9630d7254342dd58198c332019ea70da5f70d6eab2
SSDEEP 192:1R99MsnlwuhAv7N/rpAPRp2xcXsb+WNn9t25fukw0aZiyIsnAUge:1RfdWuhcdrUXVXw/2gUace
TLSH
T1A232C72DB914783B5DCBE329EA667793E7F5002135902F84EAFC852C25DB6DC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe596817.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe596817.TMP
Size 3KB
SHA256 3943fd0affba30d03a85144959f9da166367197a2755cf1c4fd36cd23a36e1d0
MD5 36711802be9e62295bc52ec07b897760
SHA1 5806030580e60e36ff771bd3238f7742e86bedc9
SHA512 de6d6a0659ffd082af4b00c123031fc72bac49a905f0ddf44cf8f568d3993970431a4066598ccfd659d8014ec76487ed2713d4153b1582d8fded99c45960df6b
TLSH
T18761742DD8A81DAB1DB6B275B86A2741FE21533F1581180A3DBD48CD0FB7D278040F5A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a75a8b8941396b877191b619d54a7dd55533d84c620626db036e416185319a4c
MD5 beddb9f68e7258502676ffc05516d631
SHA1 826c39e8afce2ef45ab14403a165a8670452ba93
SHA512 fb8dcfdf245cadc5bdc5abef2479afcb62758f6975de40ed40b8ab33a9bdd4839f4370a908c0ccbc505ccaf6e51c0bd37fef85f927721d596329b129c6a26880
TLSH
T197B01244C0471708C80081F01105104833509F27D0141B1397D09D85DCC70EC43F7594
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a42c4bc9a44930bdb2e30172e2087aaa68f2209971532116fc2e4458fcadea3f
MD5 4eecb917d2de68917b5179fad01562ff
SHA1 a6c7a357681a7d84f066fe5cfa2275220d2e097b
SHA512 68644cd2eab98081dcb08f9e5ee8d6d283f899197560337192a7bfb003c493e785d955fa8ee5fb6ce3b8843c0518e06f1e78a9580b471af9f2a113d519f4aeaf
TLSH
T199A0027051C00422DF00437574E72AC1226548151591531B54DB4C85AC9F1E28341551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 331410ff5c1a0fff9bc23c4201c8d0b23fbbbbfe9cd0b156e398eb2d42da95ff
MD5 9a6b57c9a0aff24feea02da4b7f5d9f1
SHA1 ddfd8fcad77fa1983a43b4b47cb2f53f3e72a301
SHA512 3139049588e60821d6b2da77d487482db62493cbfb19f129ae5a0aa9014f86fd788b651059167b90c446cb20b7b7bed125cd433b1253f4f83a3330a9fa36f350
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 31564c47d568b34fc2a6d4745404e46a6850845e8338dc1bf1afbcc2eec82e46
MD5 24bae189311b327b0f67c9d78d8c02e1
SHA1 5df0de13f0949ee832a3f43168b1bea6cd6b401c
SHA512 7036bd4a798500749af5c0f2ff28d69d4a2dc55d0f811c92437b1e01d7cd54dbd7580e85266033a325cbdc5ff1963557e3fac364b838ac7342977e9364caf22d
SSDEEP 3072:WvAZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6d:SNE0gT3VGi6lSzrpQY6V6d
TLSH
T128D302763D0D3E56AF336AE191501E0B4ED0906F9F58F07BBEE26F9680475E21A18473
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 69391875d3351e195cfa4c60f89f8d6649c57e7dfcd4f65ec9708467045eb965
MD5 54e35a5d2dc132d9ea77581b9838f39e
SHA1 ddca779c6dad730d01d8507d76189bef333d183b
SHA512 45692dbd79676bd56ff3483115c38b615380d40f07655155ba66bfea83a3b6d9527e9b8fdf472edd6789218d64b37e19d6e582ff65e6d7247d34b43bb14a21bd
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok57VDNB6JGyvTNm6zjj+PEhiv4a:mC0Nr7OJRPrL9/EtDUDZT9Imgjj+shM
TLSH
T141A13A32647E9CB74AB39545F5563B07DFA4B16B6A21BF80D9DD1B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 9ff8817b97c46bc5da1dcb70b1620c9e0f4ca2cdfd81aae56f85e176fb7ec697
MD5 3d8c10a92cf4a296bea1e01df759c489
SHA1 fb2b631950202becd6b0c81af18fce95bae18ed5
SHA512 ff4948db16bcc6f6f9e7550dee4d443fc7434dea613731bc03e7e854192675b46d46c089440aa66d34bbb6b5cf0a672abfc323e3d82a3ac04667781b296ca227
SSDEEP 3072:W0ZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6d:UE0gT3VGi6lSzrpQY6V6d
TLSH
T183D312753D0D3E56EF3366F1D2601E0B4FD0912A9B98E0BBAEE35E9AC0575D21A18433
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 7713939b1779e8e95f22b993acf0451243ecb0782a524b94779ad610a861faf3
MD5 18037eca5940f47a164e870394519039
SHA1 731907d77da03d93c4172b694cf52eb85600e48a
SHA512 035d7cde0228a515f69be5303a259d4137b1caec69bde528042c531e8de3f623662d7853be45d733f664c26f73f15e7199e27a35365559a9fb0c62fd0a527c1a
SSDEEP 3072:f0ZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6d:JE0gT3VGi6lSzrpQY6V6d
TLSH
T15FD312753D0D3E56EF3366F1D2601E0B4FD0912A9B98E0BBAEE35E9AC0575D21A18433
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4656_615628373\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 bd274b5c301601ac241872541de8e413813a90932cc93302d4fcf0b2f9695e37
MD5 d2f2c39ef9cb8c7bc8d90cd8d053bb46
SHA1 52b6fb05d46d9da2c2eb66a7fdf8e0f13a89c6a1
SHA512 3ba21c1864880849f3ca9d3427b35c6869f002e1aeec577771c076f68a19ab86fe73cef6f5abf9a55b6e3560132c879db51243cce5fdacae06547df85208920c
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 0abc959a9ef8090cd9f1adf28e5b8f3b2864282dae8bf413d5c3f9087df28ead
MD5 d9cbec87fd62bcfda1aa0a1d2b93fd4e
SHA1 f2767eb202538aba3eca3f355c83a5189ef24f90
SHA512 b54798dbd83db4cbee95e42649cefc49699cfedb468b48fa84d53c750f1ac04a286c842f9196b850e6e5c3e715807053d580c7f8fd8ba3442dcb9ba75cb03405
SSDEEP 96:naWoYIULVESWBrhK2PK2WeoUkWo0Qa9XO6khK3XK328:akxVoBcKQZ4T8
TLSH
T17BD1A2965E0288AF3BC29F3B334331555E6B600AC7D4A4733BDB9206B0CE9B5151F5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download