a24c47698cc56877ffebd16a07dc225bf602a902bd33891a99e695d707496747

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
外贸单证与装柜系统/外贸单证与装柜系统.exe
Size 262KB
Sample261104-wthxesb13y
SHA256 a24c47698cc56877ffebd16a07dc225bf602a902bd33891a99e695d707496747
MD5 b78e4c4311f9a7807031e16a2c7f6844
SHA1 9999e1e4473ffbb587fac18fd2b916c6b9822a20
SHA512 50d38b88eb28e2fa5c38001e299b072265b29beb70006c7b58c24d254c508a0cdeb340109b9a78d662eb6acc289016c324099376c6d3938faeeb1824e1b54806
SSDEEP 3072:5Wd2SIgoo/V1b+J9APRgz9pANx2J4wP4jCyMP0ZJm1s6uiuA40hW8TCyg2Qv8w:5SnIvAw+gz9xJ4wP4jJNA4enTLq8w
TLSH
T137446CC1BB86ACE7C615463589BB43293338F6D11B839B07193872351D27AF4BE8B617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3208	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
4264	chrome.exe
4264	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2596	chrome.exe
2596	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 2596	5300	外贸单证与装柜系统.exe	89
PID 2596 wrote to memory of 3696	2596	chrome.exe	90
PID 2596 wrote to memory of 1480	2596	chrome.exe	91
PID 2596 wrote to memory of 3208	2596	chrome.exe	92
PID 2596 wrote to memory of 1480	2596	chrome.exe	91
PID 2596 wrote to memory of 5012	2596	chrome.exe	93
PID 2596 wrote to memory of 5012	2596	chrome.exe	93
PID 2596 wrote to memory of 5496	2596	chrome.exe	94
PID 2596 wrote to memory of 5496	2596	chrome.exe	94
PID 2596 wrote to memory of 4852	2596	chrome.exe	95
PID 2596 wrote to memory of 4852	2596	chrome.exe	95
PID 2596 wrote to memory of 3532	2596	chrome.exe	96
PID 2596 wrote to memory of 4276	2596	chrome.exe	97
PID 2596 wrote to memory of 3532	2596	chrome.exe	96
PID 2596 wrote to memory of 4276	2596	chrome.exe	97
PID 2596 wrote to memory of 3344	2596	chrome.exe	98
PID 2596 wrote to memory of 3344	2596	chrome.exe	98
PID 2596 wrote to memory of 1364	2596	chrome.exe	99
PID 2596 wrote to memory of 1364	2596	chrome.exe	99
PID 2596 wrote to memory of 2804	2596	chrome.exe	100
PID 2596 wrote to memory of 2020	2596	chrome.exe	101
PID 2596 wrote to memory of 2020	2596	chrome.exe	101
PID 2596 wrote to memory of 4972	2596	chrome.exe	102
PID 2596 wrote to memory of 4972	2596	chrome.exe	102
PID 2596 wrote to memory of 2460	2596	chrome.exe	106
PID 2596 wrote to memory of 3436	2596	chrome.exe	107
PID 2596 wrote to memory of 2460	2596	chrome.exe	106
PID 2596 wrote to memory of 5876	2596	chrome.exe	108
PID 2596 wrote to memory of 3436	2596	chrome.exe	107
PID 2596 wrote to memory of 4680	2596	chrome.exe	109
PID 2596 wrote to memory of 5876	2596	chrome.exe	108
PID 2596 wrote to memory of 4680	2596	chrome.exe	109
PID 2596 wrote to memory of 3308	2596	chrome.exe	110
PID 2596 wrote to memory of 3308	2596	chrome.exe	110
PID 2596 wrote to memory of 4668	2596	chrome.exe	112
PID 2596 wrote to memory of 1544	2596	chrome.exe	113
PID 2596 wrote to memory of 5148	2596	chrome.exe	111
PID 2596 wrote to memory of 4668	2596	chrome.exe	112
PID 2596 wrote to memory of 1544	2596	chrome.exe	113
PID 2596 wrote to memory of 5148	2596	chrome.exe	111
PID 2596 wrote to memory of 4464	2596	chrome.exe	114
PID 2596 wrote to memory of 4464	2596	chrome.exe	114
PID 2596 wrote to memory of 5360	2596	chrome.exe	115
PID 2596 wrote to memory of 5360	2596	chrome.exe	115
PID 2596 wrote to memory of 3652	2596	chrome.exe	116
PID 2596 wrote to memory of 3652	2596	chrome.exe	116
PID 2596 wrote to memory of 5060	2596	chrome.exe	117
PID 2596 wrote to memory of 5060	2596	chrome.exe	117
PID 2596 wrote to memory of 1300	2596	chrome.exe	118
PID 2596 wrote to memory of 1040	2596	chrome.exe	119
PID 2596 wrote to memory of 1300	2596	chrome.exe	118
PID 2596 wrote to memory of 1040	2596	chrome.exe	119
PID 2596 wrote to memory of 596	2596	chrome.exe	120
PID 2596 wrote to memory of 596	2596	chrome.exe	120
PID 2596 wrote to memory of 4684	2596	chrome.exe	122
PID 2596 wrote to memory of 1196	2596	chrome.exe	123
PID 2596 wrote to memory of 4120	2596	chrome.exe	124
PID 2596 wrote to memory of 4264	2596	chrome.exe	125

C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\外贸单证与装柜系统.exe
"C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\外贸单证与装柜系统.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --app="file:///C:/Users/Admin/AppData/Local/Temp/%E5%A4%96%E8%B4%B8%E5%8D%95%E8%AF%81%E4%B8%8E%E8%A3%85%E6%9F%9C%E7%B3%BB%E7%BB%9F/app.html" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --no-first-run --no-default-browser-check --disable-features=Translate
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffca6f6c728,0x7ffca6f6c734,0x7ffca6f6c740
    3⤵
    PID:3696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,16494351825516982524,5844811335124738992,262144 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,4779678899280217817,7160865950844002178,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,834242471905310553,7202468691556378209,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
    3⤵
    PID:5012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,6615980552047213772,6205646138039653823,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,16985195702648006185,7346732085540574388,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3980,i,1854433088267094407,11165496583531202824,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:3532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4020,i,16910807603781082583,5568471005494698911,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:9
    3⤵
    PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4720,i,8137184480802180315,6842944429990413879,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,1052638282378435463,1869300364337686119,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,3616151736618205875,15666216280695271080,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5668,i,3090095354946819624,9216393895015552562,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5676,i,13806870876895376926,6825789947724539469,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5856,i,14795833448655922257,12597903992261467431,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,2908774452125989252,2471413463063956416,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:3436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,17459339539709679735,4686778050635723246,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6132,i,2943239144760210321,12747561617803027395,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5924,i,7028849546601968469,35162360929673152,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5752,i,14450137128135907312,17837284325699313747,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,9209085955260939620,8498256892967868041,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,10978574098103303114,11440297180036878266,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5836,i,2949070695596385017,15361136560565995617,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=6768,i,2308016547345415017,1159069472121558603,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5732,i,4890785241773973565,6486078528498558978,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,13122473311229734245,18429160090207437972,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5760,i,7868610100882184492,16570241037673730519,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6356,i,10082548431675925366,822465210509796434,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:9
    3⤵
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6744,i,382800675331214156,9323387052662525607,2097152 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:9
    3⤵
    PID:596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,10895647778746042246,3597416134831621981,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=6404,i,4492900846545934363,6540130522039476709,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,15388343835369694124,6920974771618995402,524288 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6140,i,8408697165507594107,16795350547773236466,262144 --field-trial-handle=1904,i,9368017764808422479,10104284742738205600,262144 --disable-features=Translate --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

60551f73-4d92-4b76-89cc-61a889eae483.tmp

Path C:\Users\Admin\AppData\Local\Temp\60551f73-4d92-4b76-89cc-61a889eae483.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2c89fcd-4029-4067-9e8f-f18c95a38215.tmp

Path C:\Users\Admin\AppData\Local\Temp\c2c89fcd-4029-4067-9e8f-f18c95a38215.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_1886395396\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_919110522\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

3e117d17-821d-4ec2-8b47-dd42fa749e85.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\3e117d17-821d-4ec2-8b47-dd42fa749e85.tmp
Size 145KB
SHA256 d24629e21d767ef2c63305eaa796ab0a94bc8d051b7e9f64ab1371c680e6cf96
MD5 ecdb7bf1bc09b734fc0c2b654de47d13
SHA1 5176978a88bc605c3490be4ae72b0d5145b69319
SHA512 b1dc48a4103cacc60b11f1721676b196d79a71f962ca4a6def09b5201664516173faccf1cf8aebca0b35df4d3b3f12a284f041ea40191c4cbbacff477147e906
SSDEEP 3072:wnxwqX7DTfpyc9Mtpus0QZWxS71NPgNYluFVdl0Ep9tmwq:wnX7DTEmMyUAS71N4NZrQEpnml
TLSH
T128E313727FF97C06613D1C8CF0AE760A0CA5439768A8C73AF9C1474752979C5B21AE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

573f47c5-c5e6-4203-bc5c-acf9bf9892a1.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\573f47c5-c5e6-4203-bc5c-acf9bf9892a1.tmp
Size 146KB
SHA256 439687db2d8d3675b9e425732b1ffad5f6020f0b459aeb29b85fd1eeef026e95
MD5 56fb4c8cf10abb4d3ff9cabdcaa0cfc3
SHA1 ef5637b49833e13bd50d71dd4f85cf146d751404
SHA512 9454b9698da472fb53e357ad57bb5d4ad0cf43f9a67ff6d91beb704f32611f70bb51ab68d749e5f3425a588c245347f6dec376e144d5067e75600b0d2057be04
SSDEEP 3072:oKxwqX7DTfpyc9Mtpus0QZWxS71NPgNYluFVdl0Ep9tmwq:oKX7DTEmMyUAS71N4NZrQEpnml
TLSH
T150E313727FF97C06613D1C5CF0AE760A0CA5039768A8C73AF8C1474752975C9B21AE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

703d6fd0-4383-4dc2-9edb-51f03e39fd34.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\703d6fd0-4383-4dc2-9edb-51f03e39fd34.tmp
Size 144KB
SHA256 61e9c48f044216afe834b547e45b559219f4a3756f2f00b462e1d5f0c8afaeb8
MD5 995ff6c47ce9477156b9f88ebf6cf0b8
SHA1 74f0caf8f2fca021489cbccc215fe160b367dd60
SHA512 7a28167b9cef87c67cc96410142fe2b822f65ee9b5c59a415721d6d2b4761d1897ab2ed0c35644bb38c91ecbc16dd9a9f031b423579465f21137063360cc9717
SSDEEP 3072:sxwqX7DTfpyc9Mtpus0QZWxS71NPgNYluFVdl0Ep9tmwq:sX7DTEmMyUAS71N4NZrQEpnml
TLSH
T1B7E312527FF9BC06A13D5C5CF0EE620E0D650391A4A8C777F9C1834B63A79C5B21AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fff255b-ab47-4319-aea0-a6a4ca9e382a.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\9fff255b-ab47-4319-aea0-a6a4ca9e382a.tmp
Size 144KB
SHA256 0b59a603644eae38ebd8bea4b6813ac75aec2c6ec2979a5524aa97d36fa1e06c
MD5 3464ab05a770b878d8dabedfdc9b77db
SHA1 a37381d5419644600d6b7db955b479df606526b9
SHA512 609b397e6f56a59ed21a6db18148dd032ffbc4a19e68503b72850c6651bcbb5121a53f99d5c5a51793a01cecd2adc7063065b7a6cd04655e00c094928eabc0cc
SSDEEP 3072:NxwqX7DTfpyc9Mtpus0QZWxS71NPgNYluFVdl0Ep9tmwq:NX7DTEmMyUAS71N4NZrQEpnml
TLSH
T194E312527FF9BC06A13D5C5CF0EE620E0D650391A4A8C777F9C1834B63A79C5B21AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Crashpad\settings.dat
Size 40B
SHA256 b83e180e95c0ac1bf2c0875a8b085b788f8ee9ace884e98b15c2e2d9e6b1ae4f
MD5 3215378a99f484452828502551d10f35
SHA1 8adc7e423ec39fa85b02f8d6fecaee60158e8a26
SHA512 94d2b389c1b8c02761e4493c00976305ba8e72c35836744ef0903fd84de406cd4dbe178b4d5b586e6dfae3d1dc84cb70e876f204f7f5e687af1c8bf9ffc99c0c
MD5 SHA1 SHA512

Submit Download

5eb4a34c-1fa6-42ec-85a1-5fc5691a0c94.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\5eb4a34c-1fa6-42ec-85a1-5fc5691a0c94.tmp
Size 17KB
SHA256 19766be23dcbcd93c4d31701d86c9e376e48951b9c12a533a948f47e6d54c8e0
MD5 eb3624f6fcb0fefdce4b819bbcc3aa78
SHA1 85f9cda63773b618c223207cb85a69d8db0c8f56
SHA512 df2e2d25883abec2e2d6e9c431fc5f5bbdb77838bc78e750878ca242b1814c245cc8975c07ca67aca5b454585c369916d41d21fbecb90e20c037a067e9d26698
SSDEEP 384:qAj2Z7KxkXqKf/pUZNCgVLH2HfgslgS7pLuLcEWCu0gBXOD2R+ErU3OyHGS7bSt:qk2Z7KxkXqKf/pUZNCgVLH2HfgsuS7pl
TLSH
T1A872F867684C9E3B0F94CA8DD8177F4FEDB5024B65E9C8A443FA582903D5ACF110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 246714386b86994706ce5d9d035cfa2f30be4cc9fcc02d46bb6a8973aa2df2b6
MD5 32525e4c8087a11a24c1f2676f7b3897
SHA1 ecbc07f0c8f95bef7ce0b8f81770580d0bd429e6
SHA512 130d4b99ea130e0c032c880c69ab68c9947e24336ea2a58403ab00709f382910dd9e467139396c68528a0e36ed0fddaf28818ca3f997b59a469acb85559ca5f3
TLSH
T135A0022457CA0941CFC0C371D57105C1331089750111535BD6D080C888536EA51952C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 cc0845d1b2a375f544ee030345935e7c17e75180adafb55e52425eaab47ddae1
MD5 e2c8cd2930dfb1be019ed54d7929b0de
SHA1 be8ee5b1983ad758a322828093d893a4b966df0c
SHA512 8b7ab412dd7beaeb5a6e27ba1d685302d1e12971e633373d387881a5e48108b1e53b8d8b48678a051f48e9e4055dcf5ac0d0f4bd25a7ed9b10de8c7d35bc7442
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\service_worker_bin_prod.js
Size 137KB
SHA256 63b3d006783e106d3aacb9cda3224d48a218dd45d50db663d38b45d2d9b2bff0
MD5 97b43ffd3c415ea9887f0113d43f5a2d
SHA1 1afcebee8c88dcc9c3ff7d43ffdc3b00a329f9c0
SHA512 279521e204cebf954dbf991ba66b9d4a30534d77650c898ce2f052034263d9dfd9a1ea122a548f51a061ebee9859fd2e88860ebece906b23b9d6dffdc7d85c97
SSDEEP 3072:cFMbB96nK7qtBnZ8CDPDHbSVh6lGE4C0S1wmF9cWMzK:cFMqMGvSVh6lGE4CymFiWMzK
TLSH
T147D3D9CCF6A5B0124363A5F5402F000BB239B8B9E44C85A8F288D9E97D7556D8277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17a419c7-32db-4827-8fdf-b950e1138484.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Network\17a419c7-32db-4827-8fdf-b950e1138484.tmp
Size 1KB
SHA256 11de247a4260b438a177ce24240eeb557d6377b11f5778bebba931960af39ef5
MD5 3b92624f0a3056874eec83b0d370a00f
SHA1 1816374952347dd11ec017d306009f1149182475
SHA512 d889f4552f1eab1f8a1708cf75696cca3441447eb3b49346051bbe599421ca5f96790f79688013cf8131313d4231953a4546de24bbe3dad6d1ea243775816db9
TLSH
T11A317AF7C3E8853D895142F4A715AE1FCE6A1D18832C3C57C8E4AE1B93E28B1D24059E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c53515637267cae61bca64a774cdc0ecd33929d982a1bf6b82c56b9f5934fb6d
MD5 301793719584f5ac973aea856d94252a
SHA1 ec63fd0df76c642323192893dfa24422937a6c1e
SHA512 af75563612a7ebf3accf6502ca0ec8f5427f218375071230a831d802f6a163ed33487f2cf4f0244ffacb4374cee9d135e343bf65044d232041f2580194100efc
TLSH
T1FFB0120581475740C880C1B03206108423105F259110074283E0998DCC470D05367288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 02cd24a9de1870c7debae151af5ac6977fdaa92e9634f89cc4d1bd215a423c45
MD5 4a3237ac0089e4db63c2ee304e8db643
SHA1 4031fd758471f1d97575cf7c25f6f6a0250a4d91
SHA512 d3618a8dc4acd34a3fc6eda36f79afb0c3cf91ee5774360c5442b655b4ee452fa5806446a8ccdc7f9c0e180ce1feae5a0d6f499277476341294cc18535f913f2
TLSH
T12BA0025607508112C14053B06981838A3621B9298A83431776D04776CD616524911695
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 d26622b31b1344181427d2b9fa692d69c1f8e191bb2b19e83774221ae3637009
MD5 895de4f3e6e0f8ac0dd71e4d69eccc79
SHA1 659d269a118d9c64ed59c52f76b46ae642c2234d
SHA512 f7f3d8742730fd833aae89a287bbdf22841a2e25a5d18c1fcf458e42c62d55e70eabc3b0c4a1f5bc247818f1b07a0f16cdb915cfb849c136646f58efc4fee3a3
TLSH
T1F7A0021143C4056EDDC08370E5710D412E71C92819A283235BE10494885B2E94611390
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d96bdef710a78b868d2056e597f00578c77c64852282493d5b6763bc3171a54f
MD5 9066aab04ce87d67e66af8f176133256
SHA1 bdf57ba214e3f882b9c566366d5408f0b5ae96ff
SHA512 df31f5e0ef6874603fc382c4cc31d8789269b3eed73b0c3c61f080bd3b8a0ca37017eaa8164c524e5885c0d1ec54aa944fac42a603be1b18b63d86c37eddbd47
MD5 SHA1 SHA512

Submit Download

02707e6a-6ce9-4666-a2fc-ba9368d38f26.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\02707e6a-6ce9-4666-a2fc-ba9368d38f26.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\temp-index
Size 48B
SHA256 fc6072f1045770e3628299a25990d60580c3d325fc4a5234a6b41bfd11a53ab6
MD5 c98d220c6bd535a606d91ef395267223
SHA1 3859001b43601766cc979e645a138b709991d3d7
SHA512 f8df7d98e67eff8982b9842583f27180b18a3ea962930e7c2942a79f30381dcea84909a0da14904fa451d9fbe0a04bd11fc4fc7f575a78b9109af1854ab2c5d5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aecdbc35-6f29-41c5-9758-174f698a2a8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\aecdbc35-6f29-41c5-9758-174f698a2a8a.tmp
Size 9KB
SHA256 6724a3522eeead1028a34e77584afc2102f4db69c347a40b9ab33bfc9e13bcc5
MD5 5a87a559b4801fa873a8e4c869bd238b
SHA1 0fc279997f58d36a5716150dba27b37455cbe636
SHA512 514fbf160cde15ded1e06869e6590574c45668231d9525fcdfa9dbe434085690a333ba28e6889ed2e20c4f0cc1965dea13514ce29428d0ca3e877044b568ce0b
SSDEEP 192:zRJ59DsCLuv7iAPRp2WKXsb+WN4ejiyIsnAUgE:zRJ5mCW3XWXw4hE
TLSH
T11512B52DAD64A93B5CC7E31AF92A7B42E2F5102170D42D44EBFCC92C15EB6CD222751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc4d9eb8-dec2-47c8-9df8-f3871abc9559.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Default\bc4d9eb8-dec2-47c8-9df8-f3871abc9559.tmp
Size 9KB
SHA256 82dc0845a5e415cd0e9a6b40d8057f04206173819d79896f405342c3c8d20c12
MD5 59343a3e1b23495c92d32be4f5095754
SHA1 f890fc5276ba76270405e7b0d6a684c7703e908d
SHA512 10a0700608ea37d052209742159fefa6abd679b2bf9102fe85848ba06236eb399a4bb05e3b1832ab5e34749d1ee91583d3e550f7e45e2517d38155faf5d6317c
SSDEEP 192:zRJ59DsCLuv7iJPRpCWKXsb+WN4z1iyIsnAUgE:zRJ5mCWwX6Xw40E
TLSH
T1B022B42DAD64693B5CC7E21AF92A7B42E2F4203171D42D44EBFCC92C15EB6CD226351B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\Local State
Size 1KB
SHA256 b5c14dee7f144d2de3799022778eaa0fbf58563db8c682c46c0c148982e289c4
MD5 ff384cf4673e46b6e6fc561dc8c98c76
SHA1 71bc771c4c6ec3a295083e31969ee18f8b8e8317
SHA512 489d62835b18da1d90cba1bb77c17ef0174f34672e16b3d8eae9fc7ad49e581e851dff1dbedcb912e04f2453d890685f991b06feb6b915463518245cd79bc123
TLSH
T1FD11A571DD6C39B2AD6A1B5D9152C2BB1DBE133BC012CE1D29DD1B1846A63AC3707D38
MD5 SHA1 SHA512 TLSH

Submit Download

4a81e3cb-9a1c-4bc5-ae60-4f35ccbcc3bc.tmp

Path C:\Users\Admin\AppData\Local\Temp\外贸单证与装柜系统\userdata\extensions_crx_cache\4a81e3cb-9a1c-4bc5-ae60-4f35ccbcc3bc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5300-0-0x00007FF608C80000-0x00007FF608CC4000-memory.dmp

Download