acrstealer | 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17294ae5b3fd.exe
Size 6.5MB
Sample260828-rxea7adc39
SHA256 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f
MD5 4780771e3d27ff89d6f81648c197b8a6
SHA1 7e295dbfbb54c73ef9a1cb0d567e25043a4add21
SHA512 1d8f96ff993c4caa09508fa46f5367bca234ba1a0740dc22b3d582edb0217a283392469d733aff26c1cc6d346f961987e1927fd604a06912dd9252591db7e8ca
SSDEEP 98304:nX6hoeIhDcgndodDjuEfJhkt8sfeJ36/i5Sq54IizhvMScU:nXvhDcg+DjBJhq8H30i5Sq5UF5
TLSH
T13966D02BF39B9536D48E067624B75325A37DE50443034BD763E8693CDE222F12F3A686
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer installer spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha1

stream.echovale.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 23 IoCs

resource	yara_rule
behavioral2/memory/1736-50-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-56-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-57-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-60-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-61-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-93-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-98-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-99-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-140-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-141-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-146-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-362-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-361-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-363-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-366-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-367-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-389-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-403-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-405-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-406-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-428-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-451-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1736-499-0x00000000001D0000-0x000000000029A000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1736 created 1732	1736	AutoIt3.exe	80

Executes dropped EXE 3 IoCs

pid	Process
4328	17294ae5b3fd.tmp
1072	17294ae5b3fd.tmp
1736	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1736	AutoIt3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2620	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4156-1-0x0000000000330000-0x0000000000419000-memory.dmp	innosetup
behavioral2/memory/4268-7-0x0000000000330000-0x0000000000419000-memory.dmp	innosetup
behavioral2/memory/4156-11-0x0000000000330000-0x0000000000419000-memory.dmp	innosetup
behavioral2/memory/4268-16-0x0000000000330000-0x0000000000419000-memory.dmp	innosetup
behavioral2/memory/4268-48-0x0000000000330000-0x0000000000419000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324013035694421"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1072	17294ae5b3fd.tmp
1072	17294ae5b3fd.tmp
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe
Token: SeShutdownPrivilege	5336	chrome.exe
Token: SeCreatePagefilePrivilege	5336	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1072	17294ae5b3fd.tmp
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe
5336	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1736	AutoIt3.exe
1736	AutoIt3.exe
1736	AutoIt3.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4328	4156	17294ae5b3fd.exe	90
PID 4328 wrote to memory of 4268	4328	17294ae5b3fd.tmp	91
PID 4268 wrote to memory of 1072	4268	17294ae5b3fd.exe	92
PID 1072 wrote to memory of 1736	1072	17294ae5b3fd.tmp	93
PID 1736 wrote to memory of 5336	1736	AutoIt3.exe	95
PID 5336 wrote to memory of 2948	5336	chrome.exe	96
PID 5336 wrote to memory of 4848	5336	chrome.exe	98
PID 5336 wrote to memory of 2620	5336	chrome.exe	99
PID 5336 wrote to memory of 4848	5336	chrome.exe	98
PID 5336 wrote to memory of 3036	5336	chrome.exe	100
PID 5336 wrote to memory of 3092	5336	chrome.exe	101
PID 5336 wrote to memory of 3036	5336	chrome.exe	100
PID 5336 wrote to memory of 3092	5336	chrome.exe	101
PID 5336 wrote to memory of 4944	5336	chrome.exe	102
PID 5336 wrote to memory of 4944	5336	chrome.exe	102
PID 5336 wrote to memory of 4844	5336	chrome.exe	103
PID 5336 wrote to memory of 4844	5336	chrome.exe	103
PID 5336 wrote to memory of 2032	5336	chrome.exe	104
PID 5336 wrote to memory of 2032	5336	chrome.exe	104
PID 5336 wrote to memory of 2880	5336	chrome.exe	105
PID 5336 wrote to memory of 4612	5336	chrome.exe	107
PID 5336 wrote to memory of 2052	5336	chrome.exe	108
PID 5336 wrote to memory of 4612	5336	chrome.exe	107
PID 5336 wrote to memory of 2052	5336	chrome.exe	108
PID 5336 wrote to memory of 2032	5336	chrome.exe	111
PID 5336 wrote to memory of 4808	5336	chrome.exe	112
PID 5336 wrote to memory of 2032	5336	chrome.exe	111
PID 5336 wrote to memory of 6044	5336	chrome.exe	113
PID 5336 wrote to memory of 4808	5336	chrome.exe	112
PID 5336 wrote to memory of 6044	5336	chrome.exe	113
PID 5336 wrote to memory of 1828	5336	chrome.exe	114
PID 5336 wrote to memory of 1828	5336	chrome.exe	114
PID 5336 wrote to memory of 1840	5336	chrome.exe	115
PID 5336 wrote to memory of 1840	5336	chrome.exe	115
PID 5336 wrote to memory of 6040	5336	chrome.exe	116
PID 5336 wrote to memory of 6040	5336	chrome.exe	116
PID 5336 wrote to memory of 5332	5336	chrome.exe	117
PID 5336 wrote to memory of 5332	5336	chrome.exe	117
PID 5336 wrote to memory of 4556	5336	chrome.exe	118
PID 5336 wrote to memory of 4556	5336	chrome.exe	118
PID 5336 wrote to memory of 5700	5336	chrome.exe	119
PID 5336 wrote to memory of 5700	5336	chrome.exe	119
PID 5336 wrote to memory of 4356	5336	chrome.exe	120
PID 5336 wrote to memory of 3140	5336	chrome.exe	121
PID 5336 wrote to memory of 4356	5336	chrome.exe	120
PID 5336 wrote to memory of 3140	5336	chrome.exe	121
PID 5336 wrote to memory of 2540	5336	chrome.exe	123
PID 5336 wrote to memory of 5096	5336	chrome.exe	124
PID 5336 wrote to memory of 1708	5336	chrome.exe	125

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1732
- C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe
  "C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\is-ULTQMEZYX9.tmp\17294ae5b3fd.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-ULTQMEZYX9.tmp\17294ae5b3fd.tmp" /SL5="$400A6,2860944,890880,C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe
      "C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe" /VERYSILENT
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\is-SUHQM16B08.tmp\17294ae5b3fd.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SUHQM16B08.tmp\17294ae5b3fd.tmp" /SL5="$400A8,2860944,890880,C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1072
      - C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\Programs\node-runtime\asartools-1.1.0-py3-none-any.whl"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff98ce9c728,0x7ff98ce9c734,0x7ff98ce9c740
    3⤵
    PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,4609672776575723563,5012224119796583388,262144 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,8631166233667932757,14030002323841758352,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,11035451377397776463,11391771979125142590,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,17901515426209226213,15271233265553788026,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,6549051154342071159,16202879362127246051,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,16928832903637556794,8552912092546898247,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,18346436593710523058,9789321939624122030,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,13476303330361432024,11014840498668504495,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5336,i,7776808341502191161,6345696866547491519,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5372,i,14191195047777175102,4537377889208201255,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5688,i,2913916058787219934,12081954919734330300,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,6276210048510074024,4654543885551890535,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5404,i,8320099034862837953,12014512332047096723,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6428,i,3380029548031527542,5137999667757665518,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6424,i,14546621895474325654,5563092674368125602,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5380,i,16149050722533953647,13253973816304459863,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5780,i,6398499573384063527,7662698346823152342,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4484,i,11560292362339499539,67471683966798084,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,16911652640672774651,15778003333787246706,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5512,i,9213566724947080362,1050031705265221719,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5628,i,475209801479818044,9367641229819474618,2097152 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:9
    3⤵
    PID:3140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,10969438669325433204,14566410743005155234,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,1906015847673725086,5558985557538187706,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,2842446562646904986,5876339185138511138,524288 --field-trial-handle=2100,i,7879312546090489919,7280744164841314199,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
    3⤵
    PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32f5c1da-8ab8-4c55-9051-1adafc4b04a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32f5c1da-8ab8-4c55-9051-1adafc4b04a2.tmp
Size 11KB
SHA256 69c6d0eb63ba7c7879413a5064bc163b1d25a65b2ec5cdee45411b25f2cbb63e
MD5 44a5795391cc0b80bb08255e05a7f887
SHA1 902b29d142a6b1c566b4a46670cc3318a6633ee3
SHA512 6a4a1cc76846f5279e8f3b36407281a1af387b7528ff4700a090e9bd8d88ed535a9aacbfab48540f81dbd78f57bd2904e79f7a90139a82b0eb1fd4b28bb1b43a
SSDEEP 192:URD22gXav7xAPRp2W9SHsb+WNnIH01l2q0aczVyIsnAUgE:URD2n2IXFEwE0H2JaSE
TLSH
T11A42C72EAA10793B6DCBC22DF9257B53D7F5102625942E84E7FCCA2C25E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f99d29a7421ecfe9b21fe12670ca112875e63bb9b5f5435610e1995a8e5caf14
MD5 6f615e6044c41845064b4f87434acfa4
SHA1 8058d4824abba0b1dae50dfe6e618c33448a9966
SHA512 5bad831793433c019fc6af5d98ce7057730bd66ccd773e00d406e044b0b2bd8f1124254f378f2393137764f37b1535491cf032e080adc30e5d4b88888c10193c
TLSH
T108E02BB9C9249C2B19F9076C60500B45E754039B3B42484F373D8008CFB163B858685C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 81607955a71eddf912d389f4feb29cc87f9f5d27daa738881cf7143429005226
MD5 553d552b97794489679c6847b58a1409
SHA1 06a1e2f6ebdcb06dce5a827d51d6c19b5b8b749d
SHA512 ff732c163ade6c9f0c069a503cc93f57bba9f09e5b107c8cb12039a01dbd17208381bb57e5ec885e4d43f4d86dd634627f2a266c5b8f68e290f7d09ac1813042
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd51jroBoowIcPU2irPIhj:TeW9aw/aHLopFMavU1iBNH13H5JtyIJ
TLSH
T1C792EC8E1F303214C0F88736E9C248AB1E7D221CD3637AC9AE5464B2DD9659FF5061E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 081f16d62e5e199a13f5df8d10a75bd8cc6357eb9d7c6adfe31079dbdc569052
MD5 6233d5e71a835f4dbf72161c815841af
SHA1 5db19bc2e5effaeec50ab7e0c9b0e74a65029340
SHA512 6e4b7727b0990cbd812915233057b483af721a7ff2c0dba729a0fd723e0e263fd9d61a285bd4b64eb2ed4de8fe9bba6ced647f7e46e652e9e2d864caa15845c5
TLSH
T1CC518BF7C7E8867D891556F4AB216E2FCD390A54122C3C6688D4AF5B53E2872D20069E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a486597d8072afd70a64b0d09df43d3f421ce5992c51fb8c065c42835c88bec4
MD5 cfb990fe47c39faa0a451beb96c0a17c
SHA1 f1be541e760783ac7f860e9e39d74fecb4cbb1d1
SHA512 9d0769d1aed6901c14a2ee624d1e7e8dba907c88bd93242aaa835462b37980528bb21942e46e5aeaab20abc075a275a900c38e9ba504204fbbefb1bb9c8e9b15
SSDEEP 192:URD2qgXav7xAPRp2W9SHsb+WNnIH0+l2q0acUVyIsnAUge:URD2D2IXFEwE062JaXe
TLSH
T14132D72EAA10793B6DCBC22EF9257743D7F6102625942E84E7FCC62C25E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ca8a6299c388d4b1ebed43bb336346ce4364eee8efe980c7ee22722e7625b15a
MD5 d1047831bbfecce367576ce6714164ab
SHA1 ca812a3f331b4750b07664142a47bc6efc0d6931
SHA512 6a00e1ac70cff0a4fb3ecb38cda942cf181ca5f190c35ad4f99ccbe0e7e3b89cfc702653c2b8c72df90afd98c677e02281799da6b75b8f5c6dad4d994587be97
SSDEEP 192:URD22gXav7xJPRpBW9SHsb+WNnIH0Vl2q0acXVyIsnAUgE:URD2n2vXYEwE0n2JaIE
TLSH
T11E42E92EAA10793B6DD7C22DF9257B53D7F5102625A42E84E7FCCA2C25E76CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 0c5dd088fd49898d293bca7e1b3e73e7b1d629e356eedb13607386e316de030e
MD5 355d6b7796926cec3d5448bc6ef5218e
SHA1 bbf1c8f55934a24dff073fcc7f54fb2407c49de1
SHA512 69d6f21e74b1bfc698e9dd5cd7bd88cfa4853fd058120ec4b9d16db6ffd377cf27a81e27bdda7518216af7f0fa33edd539506f00151f2faf5eb9da888e92c418
SSDEEP 384:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOXODt0+ErU3erHGw1WBw:Dlts7KxkXqKf/pUZNCgVLH2Hfgs4UOpS
TLSH
T1D452F867648D9A3F0F98C94CD813BF4FADB6025666784D2497FB9C0803A57CB124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6cba260ab573d41d813887f614e284997d6274d692515375e77572f4b57e98d9
MD5 b516785345c6f4e81d2320e4e2cfbb63
SHA1 ee1afcd46beefc39361ee4948fd3bde0b39a5cc2
SHA512 877eaad2a0c6ddf8c37b28b1f6543182a43e62c36872bf842d7b65615fbcd988e73afc7f90085045e57d9958a97d1e5d24b21a10419c82d8f93cb8e151201009
TLSH
T1AFA0021952C07815DD1842F468A14A4163B9482C2651836375D149488D9B5C19B13101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac564.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ac564.TMP
Size 48B
SHA256 05ad088041ba1e91b47825cc8f7fb4e502463df6bb210286189aa2d454d23b05
MD5 d9bcfd415a526187295087b1d2d01845
SHA1 3ee7c8a99efc66e565f3ecf67985813c8dbc63cc
SHA512 af10af0c2d3f0b83d759b66fdbd455cfdc3c5f33681be3d120718345fa5e4f7347e6d074c2e18d5f68a4cb4b2b47af09491598ef38c0f6dd7866803e4bc7a446
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 f087d53cf0c77373ede65565e927e86112b30d38bfde5afd1b76a8e1b2e7eab7
MD5 3d9be30a47f98d0722761a87cd84a805
SHA1 aaaabe648caf1018af0649295f18448e4bb8412a
SHA512 5c0085366ea863550b064ad2b33ade388fa9610dee8bde3104637d6430d3e1e6092e4d1b00f42cc4c21796cab08d1d6092eb41352ec8f8d48671a63fffe0c70d
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OjpX6oh3qwVumXRwkr:jeuvBnhJsueMEGvIW1DcP2Ot/jVumhnr
TLSH
T17BD3864B3A747102EDE58A726CE054BB5D3CB16D8F15A1D428B62058CEF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 0fda4bcc066d063bca5ff864762015cf21c0cc76cf394b393f3c2fbcf7100e22
MD5 00f8a51d68f5257ace1fa2269716eefb
SHA1 3f79854b3f03cd5a82fb48b833f42f12321ca3f9
SHA512 b6970d52925b2d786fee85860676dd4d797ffe6b2f9c84c080e25537c64abd409b8e9a9ebd757699333545626887e354ddcf4248b2c65d264f63c976a518f4b8
SSDEEP 3072:U7fWQvyjQv1JePEuff2Gyi7SG+nXWqkOArWNW5c5kG:OfWnkvaMuff8iuG+XWqkOAv5cX
TLSH
T177D312F07C9B3CB78C33D822324B1E172CD4B6BAA058E906D5959F0B69FB65DD653012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 01f49f82b0defeb76f3629d1064b58c26ea13f3d154ecf6942263e9e66028c7f
MD5 f9de37dbb1abb58d5bc314df6006b700
SHA1 733b42d3d5f4e2326b47d320719a1b1ed7b784cd
SHA512 624c7cbbb41488a0dc5d7469218c473f692bc0ce99318123ab3d842cecc758e40418d822c1e30e924b97e8880cefc1887591d0daf348b3486e55d4624f8cdcb8
SSDEEP 3072:+7fWQvyjQv1JePEuff2Gyi7SG+nXWqkOArWNW5c5kG:UfWnkvaMuff8iuG+XWqkOAv5cX
TLSH
T1EED312F0BC9B3D778C37D523325F5E1B2C91BAB8A098D402D5968F0B7AFB6689653011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 148c3c91e1b8962b6383a02df5e6e97c39850af2e86dca341a00cb85bff7d36a
MD5 9558213bde1546e34ca49552f9a786e9
SHA1 0a13567c1e07950787dff13882f1778c97057207
SHA512 b738c86d3a9d1ab8a54ce9c74f3b557ad302078839dc5d8adb57c0c0ed452fd823109fefcc7c9dc8a27bf521dadadab74d11e4ba256a0b263add7563e725ddf9
SSDEEP 3072:z7fWQvyjQv1JePEuff2Gyi7SG+nXWqkOArWNW5c5kG:3fWnkvaMuff8iuG+XWqkOAv5cX
TLSH
T13AD312F0BC9B3C778C37D523325B5E1B2C91B6B8A098D402D5968F0B7AFB65C9653012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 43a767f9a8d8a0439e38f9b10c2cc941adc7838a3966d37f000df24076203362
MD5 c992128cdcfbdf757da0aa0f5529cd4b
SHA1 572845f00c24342d53104147ccf814d57cb6d813
SHA512 0af4f43ce4753ef708d40ee6fde49b4e63362b6fb7498880730aa1104ce9b3017d644679032cc19b44e82627106fb249306ff3fe11bac15658b4f4b981085ead
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5o9D9B6EGyvP/e+0aZPEOLv4a:MC08UR5rYv3eDUDajgae+0aZsOP
TLSH
T1DAA11973A46A8D7BA976C485B1463B47CEB5B17FE521AE90E9DC5F0C11E70EC1301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17294ae5b3fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ULTQMEZYX9.tmp\17294ae5b3fd.tmp
Size 4.2MB
SHA256 a08d482f5e3127d09659f55f99cffb6eea813c8be6ad5995d09314ba5f7d88dc
MD5 e2480370b710d9046394c5b677364313
SHA1 dd7c5de2a5fb76c5bd2f7c8e83327d6d9d942c23
SHA512 da18bdc01ae5daf8a9072e66fe50f98dea75642de6d176be0b36c885939b33ec7a93f7e2326ef50fee200978b463a65d4d105d053f6a79298874189dbc658e68
SSDEEP 98304:KiDj+6GqBH6KwsvcHJ4c91usxgkod1sc+333PR:XjpG5ucZus5Qn8R
TLSH
T158267D13F784653EE46B1A3A4837A254993B7E303A16CC477BFC298C4F396406D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5336_1311278664\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asartools-1.1.0-py3-none-any.whl

Path C:\Users\Admin\AppData\Roaming\Programs\node-runtime\asartools-1.1.0-py3-none-any.whl
Size 1.2MB
SHA256 3e570a5fa02da91d9e2ead9ecf43aadc5cee9e8732ad8b7c059238556f599c21
MD5 92df74d2050fe8d64225f3a9fee2cbf3
SHA1 8fb689f8d51594c09035e5599b297e291c282303
SHA512 99fec742d4b8cab3034e160bff680f74433d62f19a369a550faeca09191f4327d28fb6c4643fdbc9558941bd9e8f4237fbc611e66917525da6e4fe1f6a4b6701
SSDEEP 24576:XykRkk4SFVRXxs148+C5hMU40j8X0LnQ4coN30EKZFfkZ8JleAGIMaGq:ikR40VNmjL//j8EnQ47ekeTGIM2
TLSH
T1A94533033DDA474BF8E192F7B9FD8DB63336845E0E782804B616966D439F6B5980E60C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-20-0x0000000000750000-0x0000000000BA2000-memory.dmp

Download

memory/1072-15-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1072-18-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1072-17-0x0000000000750000-0x0000000000BA2000-memory.dmp

Download

memory/1072-46-0x0000000000750000-0x0000000000BA2000-memory.dmp

Download

memory/1736-50-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-140-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-428-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-451-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-499-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-405-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-403-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-389-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-367-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-366-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-363-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-361-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-362-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-146-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-141-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-406-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-99-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-98-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-93-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-61-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-60-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-57-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-56-0x00000000001D0000-0x000000000029A000-memory.dmp

Download

memory/1736-49-0x0000000001580000-0x0000000001581000-memory.dmp

Download

memory/4156-1-0x0000000000330000-0x0000000000419000-memory.dmp

Download

memory/4156-11-0x0000000000330000-0x0000000000419000-memory.dmp

Download

memory/4268-48-0x0000000000330000-0x0000000000419000-memory.dmp

Download

memory/4268-16-0x0000000000330000-0x0000000000419000-memory.dmp

Download

memory/4268-7-0x0000000000330000-0x0000000000419000-memory.dmp

Download

memory/4328-8-0x00000000009E0000-0x0000000000E32000-memory.dmp

Download

memory/4328-6-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download