7c6a00f7bdd2ce7704bb6e923ec6d6ff76f10e66903c5b5c015df9bc7060113d

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stealer_obf.exe
Size 24.7MB
Sample261107-md9krsef26
SHA256 7c6a00f7bdd2ce7704bb6e923ec6d6ff76f10e66903c5b5c015df9bc7060113d
MD5 78de65411bb4f76383b60d6c433bfd25
SHA1 4e17fc0ae7c7bac5409227960226a4465c4b8e05
SHA512 2fddd3f885fbcdc9e9ff1860862a690b1a2b131f567bf7f80db9528f8c038604290adfaf3e48b460f372b044ed19d46c968d271dea2da968e0d93d859c77f34a
SSDEEP 393216:Ko7WDarSbLtvn9Ca/4tCi1CPwDvt3uFhCu1SVlfJVojB:xCDarmd
TLSH
T1A6476C0277B441A5F466E17888234207E371BC19A721A3DB35AAF62E1F377D18B7D788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
124	stealer_obf.exe
124	stealer_obf.exe
124	stealer_obf.exe
124	stealer_obf.exe
124	stealer_obf.exe
124	stealer_obf.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	stealer_obf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	stealer_obf.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
5224	chrome.exe
5224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 124	4868	stealer_obf.exe	88
PID 4576 wrote to memory of 4664	4576	chrome.exe	90
PID 4576 wrote to memory of 4480	4576	chrome.exe	91
PID 4576 wrote to memory of 3956	4576	chrome.exe	92
PID 4576 wrote to memory of 3956	4576	chrome.exe	92
PID 4576 wrote to memory of 5492	4576	chrome.exe	93
PID 4576 wrote to memory of 5492	4576	chrome.exe	93
PID 4576 wrote to memory of 2332	4576	chrome.exe	97
PID 4576 wrote to memory of 3840	4576	chrome.exe	96
PID 5976 wrote to memory of 5880	5976	chrome.exe	98
PID 4576 wrote to memory of 2332	4576	chrome.exe	97
PID 4576 wrote to memory of 3840	4576	chrome.exe	96
PID 4576 wrote to memory of 5372	4576	chrome.exe	100
PID 4576 wrote to memory of 5372	4576	chrome.exe	100
PID 4576 wrote to memory of 3264	4576	chrome.exe	101
PID 4576 wrote to memory of 3264	4576	chrome.exe	101
PID 4576 wrote to memory of 2616	4576	chrome.exe	102
PID 4576 wrote to memory of 2144	4576	chrome.exe	103
PID 4576 wrote to memory of 2144	4576	chrome.exe	103
PID 4576 wrote to memory of 5736	4576	chrome.exe	104
PID 4576 wrote to memory of 5736	4576	chrome.exe	104
PID 4576 wrote to memory of 2676	4576	chrome.exe	108
PID 4576 wrote to memory of 1824	4576	chrome.exe	109
PID 4576 wrote to memory of 2676	4576	chrome.exe	108
PID 4576 wrote to memory of 1824	4576	chrome.exe	109
PID 4576 wrote to memory of 612	4576	chrome.exe	110
PID 4576 wrote to memory of 612	4576	chrome.exe	110
PID 4576 wrote to memory of 4220	4576	chrome.exe	111
PID 4576 wrote to memory of 4944	4576	chrome.exe	112
PID 4576 wrote to memory of 4220	4576	chrome.exe	111
PID 4576 wrote to memory of 4944	4576	chrome.exe	112
PID 4576 wrote to memory of 5452	4576	chrome.exe	113
PID 4576 wrote to memory of 5452	4576	chrome.exe	113
PID 4576 wrote to memory of 1728	4576	chrome.exe	114
PID 4576 wrote to memory of 5924	4576	chrome.exe	115
PID 4576 wrote to memory of 1728	4576	chrome.exe	114
PID 4576 wrote to memory of 5924	4576	chrome.exe	115
PID 4576 wrote to memory of 1220	4576	chrome.exe	116
PID 4576 wrote to memory of 1220	4576	chrome.exe	116
PID 4576 wrote to memory of 4244	4576	chrome.exe	117
PID 4576 wrote to memory of 6140	4576	chrome.exe	118
PID 4576 wrote to memory of 4244	4576	chrome.exe	117
PID 4576 wrote to memory of 6140	4576	chrome.exe	118
PID 4576 wrote to memory of 432	4576	chrome.exe	120
PID 4576 wrote to memory of 4808	4576	chrome.exe	121
PID 4576 wrote to memory of 4192	4576	chrome.exe	122
PID 4576 wrote to memory of 5224	4576	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe
"C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe
  C:\Users\Admin\AppData\Local\Temp\stealer_obf.exe
  2⤵
  - Loads dropped DLL
  PID:124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff988f0c728,0x7ff988f0c734,0x7ff988f0c740
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1712,i,7202239441283440438,6540777192715752055,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,1231010739916948919,6593628815012306216,262144 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,14348908942923462567,12262291261646443908,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,675660360150758407,3940453606660439527,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,6566525968429375735,16338205559842965661,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,16275528435686080432,14779980039648824599,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,16935940078402341064,5350427987933969835,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,15786783749186314543,17157555928730445308,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,14531431883323038969,12871965703814999494,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5580,i,16055542237301516501,2311658965211850719,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5964,i,3631242730688061400,15295556094062474734,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,13531023461147382360,12455881064404117635,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5628,i,5415974180568241293,8021060627414667337,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6012,i,3278946847875016531,18370464362235843729,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5840,i,13677953915591041716,10019508817776727634,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,11507458042744668157,13614013713581186974,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6684,i,1140260652020232718,13055267219039074049,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6520,i,9603823627709198054,14371433781210461929,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6496,i,10404586665328626244,12059850552762452238,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4876,i,2143884745099740670,12977081106619872833,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7048,i,1836442212732846124,6427121435342512351,2097152 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:9
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3216,i,9887266115380745665,7035027412248892363,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,3864352198172550738,10047983639485500795,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,7218409684049635145,17813671038118930416,524288 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1180,i,15924295942796014084,16567844222127406564,262144 --field-trial-handle=2088,i,16637965792367009132,7590745073887877618,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff988f0c728,0x7ff988f0c734,0x7ff988f0c740
  2⤵
  PID:5880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2157b8ed-a3aa-4081-a955-b1ff5b8bc33c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2157b8ed-a3aa-4081-a955-b1ff5b8bc33c.tmp
Size 149KB
SHA256 d83e80891908f767fbb7852ee9fb4fd34018e45d79c541eca651fd0c1132f3b6
MD5 2aba4ae1462a45fd6a97bd0cb0309e36
SHA1 a2d0612d86416b0a6f73c0ce94af8f40535c7230
SHA512 125451ff6b9d8ef874fffa61ffd8cbe01d314efe1acba64ae29c1ed97b23e94828b42e7c9e58df8b22ca489bb213283b5f0ec0c691934db0e1ff79447c0a1511
SSDEEP 3072:mqYzR052CzebCgy+J22sk17FyGI3sqPf3C/UOAZrrl:mtNw8CH+0JcBksmKc3l
TLSH
T117E31232DC1F046BFB77BA9B9344FA0F9E808DDB6734AE44A8D05F46035D2A65653C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 55d4100633aa6320f5ea53eadcf8acbc5919f2cf4c0617687f15fc627ae7e4d9
MD5 fb38cf4cb204ee72ff5a7007a66ac321
SHA1 5f2fb51d343bf6a525b3880f0a46982813efebaa
SHA512 552661264ba5401fa865c959f7752d9991603990938a7324c9656b6fa4d7915edb167410d7f894c9e3a92a11e2c95d2b513e1b22afe0dc09cf4134e4debee4ec
MD5 SHA1 SHA512

Submit Download

6d1a692f-e001-45f2-9b1f-df79520011f6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d1a692f-e001-45f2-9b1f-df79520011f6.tmp
Size 13KB
SHA256 9dbfdeca871b09c804abe0193170056539d4ddb21f3b3025739b0c3be469f8c6
MD5 8d2c32b68140c6c40f87fc08b2762d84
SHA1 8d04d42518d59a9eda46c47d9bbafc7c262e2bd8
SHA512 70d4a92640ba3ed0a83e64e112358b50f562f65b79627bd2a8602e97590f4a0fbf91fdaa298d62c4591fefd33b82769a9b2098f6bb50d2a4512153e458fc9452
SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU3E/HGJ7sXSJbdpiFav:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOtn
TLSH
T110520A27A84C993F4FD8DA4CCC266F8FACF5025662640D6496FB9C1903D97CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

882d5588-c848-415f-9e41-d3c09a098b10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\882d5588-c848-415f-9e41-d3c09a098b10.tmp
Size 11KB
SHA256 d8e67fa69579357eff6c72f767f473655a10c33dfe8e155ca56850f16e71a08d
MD5 b0956a2e58630aae6a60fc93ed3f8f42
SHA1 086c7ca571ac22c0479987d987b8786f0db36f8c
SHA512 619defd2aef64bd5a234afde9455af71d3095894b7faf2f4755343ff00934b408a2610727803086ae6abc5a6991b603c2a912d177ee0deeb33785661e4eb7a3f
SSDEEP 192:0RWJASjv7WAPRp2P9bHsb+WNn3MeykSgcxmCDVyIsnAUge:0RWJnbDX4Bwce7SgrCle
TLSH
T1B342B52AFA10793BACDBC229F9617B97D6F5102271902EC4E6FC892C15E7ACC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

9877b80b-ec91-4f12-b4a9-5629884749ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9877b80b-ec91-4f12-b4a9-5629884749ff.tmp
Size 2KB
SHA256 d6eb21ae78e59e7dff193f585c7db5d76c88d0d79685b7623604e3f10f06d79e
MD5 25534493f8f9fc3b6904bd33a4883063
SHA1 f123b7f9b746c92265d53eee379cb87cff7389e8
SHA512 5636eb526835e03b30b07228a453d0c087e97249c598670436efcaeb8747dc83386486889b74d8aa552f6928fc8f2b41539543e4b0eeda8f361e17937ee708ac
TLSH
T190518BB7D3D4867D881156E49B216E2FCE3E1A58032D3C6688D4AE5F53F2972D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

9dd7d29f-80af-4f10-8816-eb0c40b415ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9dd7d29f-80af-4f10-8816-eb0c40b415ec.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 7eba26f68a123524f797ee65ae933bf0779a2383cf692ea67847d9ea7c6f4de7
MD5 bb3711a38f77cb67ea0221197f7cd595
SHA1 c4f791456d4168c31ab8718a1f65a79c3fdc4522
SHA512 729731583801339abe83a811966811be44f03b5510906ab9b60f5cbeacbc891b92fae7905776e8f775435d86f0e65f2f5ea3a87df2bc41006ad01f0524045c28
TLSH
T108A0021155D49C25DE1457716261874636779D2515A2430755E244858DBB1D18111A14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 782416992ebf7afc8ffed4febe8afa6d1190e39fa4c24a04e4bcaeb030755e61
MD5 d8e511a163c232dce9220ff980178f82
SHA1 e5413bbe84ab0a4f675b6d56404d99f10e6f4972
SHA512 90943123fcd3e0127ca1fcacd379cca71f32663c35fe0f9d432a6af5311b06d728ef05c7d38eb6988fd6dcddb441e6f5056cbb0ae3a86594ef7391bd8d8287b3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1a0b45e-869e-4e19-a6db-2f8502978fc8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1a0b45e-869e-4e19-a6db-2f8502978fc8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

adb2703b-2b07-471e-bff7-64d2489c4c42.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\adb2703b-2b07-471e-bff7-64d2489c4c42.tmp
Size 11KB
SHA256 2ecaee9858497349257ca8b62c828b186e0dc8a85465e13a9e6dcc8d3cdad436
MD5 f79c48dc9b4dac12ae9f706ad2b614c7
SHA1 82827ec637d7de99f309808f74cebe1dc3e9066e
SHA512 2951ff9b8647e3262ea1e4079b00214b5c4b4b774a8e4dee0da6c74a98f9ee0cd6966127e0724dd3f7aedadf006bd78585eadd5fcbe257d9b7431e550e39e8d0
SSDEEP 192:0RWJAwjv71APRp2P9bHsb+WNnwPnPkSgcxmCDVyIsnAUge:0RWJjbsX4BwAncSgrCle
TLSH
T16342B62AFA10793BACDBC229F9617B97D6F5102271942EC4E6FC892C15E76CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b82f3cb0-797b-4c89-8a80-acee8f5ed82a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b82f3cb0-797b-4c89-8a80-acee8f5ed82a.tmp
Size 12KB
SHA256 8978fe97437f184889977ff33f047c9a30669b0eb10adf10b77a482a927e582a
MD5 671449722a6bbb2b699195a7ecc97ed2
SHA1 d77dd54c7e1932964db702076708d2cc110a9d68
SHA512 b8edcf74958662e2bdc8ba9d093d1fa7817f638b0657aae9dab7a4132ca526ba4355167e056a8fcb13f78e2787ce7c62c04e9fde8def16ff9dada4a8e58dc9cd
SSDEEP 192:0RWJAT9v7WAPRp2P9bHsb+WNn3MepkSgcxVCDVyIsnAUgE:0RWJ29DX4BwceOSgkClE
TLSH
T14C42C62AFA10793BACDBD229F9617B97D6F5102261D02EC4E6FC892C15E7ACC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbf05fe8-7fbf-40d0-ada8-9c24e23c7c2c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbf05fe8-7fbf-40d0-ada8-9c24e23c7c2c.tmp
Size 12KB
SHA256 e8a8834bd3c354bd1cbc3ed3e7ed9e759f9090c000f025792cf3c12cf782ee1d
MD5 9bd16864a55ef3ab3c86e73390dee61d
SHA1 df74653c08515ee5654c068210b3d981783a12bc
SHA512 fe92134c44ef2ea1e07e7d7695a7a24af62babd19d02af740d7d48c631bb84d09c54f0125eabd591e0d1247407081bfcdebe02b2d394cd50efff422aa269d63e
SSDEEP 192:0RWJATrv7WyPRp6P9bHsb+WNn3MexkSgcxXCDVyIsnAUgE:0RWJ2T9XcBwcemSgwClE
TLSH
T1BD42D62AFA10793BECDBC229F9617B97D6F5102261902EC4E6FC892C15E7ACD7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 148KB
SHA256 d08a86382deb44827b91424158da14dd2887dde1b75d93e079f84bbe6b0d1066
MD5 fa2dabace349631a413415dcedc437dc
SHA1 392a6bf3dcf4a7bd9696648f25e9000f1764d8e4
SHA512 1835aa3ebdf09bef6bf2fd622547e702e27745af973c1d703222bdc2b3e8b3b05d389068f8c082b79a49351ff53e9393fae5619b223115214d47961d43f718d6
SSDEEP 3072:AqYzR052CzebCgy+J22sk17FyGI3sqPf3C/UOAZrrl:AtNw8CH+0JcBksmKc3l
TLSH
T1ECE31221DC2F443BFBA6B7AF9348F60FDB804DD762744D8095D55F4603AE2A2575380A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a89c32e7-b154-4725-8d57-1859eac60ee9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a89c32e7-b154-4725-8d57-1859eac60ee9.tmp
Size 4KB
SHA256 6e859affe32a7d6f354f5fcc036ccd193057d7fc174f3768c31aee177f604a5a
MD5 5af909025292e52a4b4efea66416de37
SHA1 3114745df322f4c3db297ce78dd62b5412129350
SHA512 d1ff11f484b2b634a9246aa531a919886a6f6ce0b27d940e28bf7097681a2a68767eedb1bb1315ae51c2c68aab95d52e6db9e82254b02639d38e8c35f99b79cb
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok548DlB6vGyvQH4jYsy+0bblDv4a:qC0xJPz8/CkqDUDjbfr4jYJ+0bb1
TLSH
T102A10931B8695DB7D4B6D585B2422E03CF64B197E621AFC0B5DD1E1C14F70E81342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9fdbfb9-66e6-4cb3-a3f9-33f991f7fc2a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b9fdbfb9-66e6-4cb3-a3f9-33f991f7fc2a.tmp
Size 148KB
SHA256 e622b46495ec155404d85f80a461d5d18f9436a91b47461ce793f15bff88a2d2
MD5 344691b4393152add4af46f3491e8298
SHA1 bd44e1f7e0f185f12edf29239506bad01c80f5c4
SHA512 35e46d7d4e2f79baf29f011cc0bdc0f8aa62319d6bf9d7c9921c3f3198ffd6887b276e6f0770aa33dc2c865d9b3aff339ea21793ef0bd8c3a56db2fe1ba1c9d0
SSDEEP 3072:FqYzR052CzebCgy+J22sk17FyGI3sqPf3C/UOAZrrl:FtNw8CH+0JcBksmKc3l
TLSH
T17AE31221DC2F443BFBAAB7AF9348F60FDB804DD762744D8095D55F4603AE2A2575380A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

effddb93-dc7f-49d0-8348-2e03fea6b981.tmp

Path C:\Users\Admin\AppData\Local\Temp\effddb93-dc7f-49d0-8348-2e03fea6b981.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_918935_0Sr-O7ek-Hg\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_918935_0Sr-O7ek-Hg\_sqlite3.pyd
Size 121KB
SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
MD5 cee93c920951c1169b615cb6330cedda
SHA1 ef2abf9f760db2de0bd92afe8766a0b798cf8167
SHA512 999d324448bb39793e4807432c697f01f8922b0aba4519a21d5dc4f4fc8e9e4737d7e104b205b931af753eda65f61d0c744f12be84446f9c6cb3c2a5b35b773c
SSDEEP 3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
TLSH
T140C34A67635400AAE9F751B9C4630A17DB75F822537083DF4290C68A1F337C7AE3AB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_918935_0Sr-O7ek-Hg\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_918935_0Sr-O7ek-Hg\sqlite3.dll
Size 1.4MB
SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
MD5 82ea0259009ff75bba817bd8c15c7588
SHA1 04c49687d8241b43ae61a6c59299255ef09a7b39
SHA512 1f8b3343898462e385d25e1820a3d7d971d633933e482ea9ffc596e7e1f902f5657a9f2c104cf320eeef34cce814261304e2e1c063be4c6a807adc9b75f3e670
SSDEEP 24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
TLSH
T12D658D4BB2B800ADC0ABD179C61B571BEBB2740517709BDB55D4CA692F13FE216BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_obf.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_918935_0Sr-O7ek-Hg\stealer_obf.dll
Size 9.3MB
SHA256 58e90e02049a1377030e369bcc00ee879cb6feaf44ed76a4c7d7211450df3fbc
MD5 037b1cbd34b63bffe3ba6163d61dab89
SHA1 e739144f5d1c8789b488a62b6530b3c0691cf24a
SHA512 4922f10570963e2aec3f0b77643268c11e067624f12e9dac38dfeffebd02f4c9d0b307251b9f563c9eef1591edc4e377abd431dfdd7aafe851f33d8baea41f92
SSDEEP 98304:qLGPoe6r/VOVVDaAy5QOhQ/wOOlq+lp6KgGlH95:lo77VOVVDazd
TLSH
T1F8A6174227B492A2F845F2BD44220607D231B42CF716B3A73ABEC52E6F46751CB697DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4576_681638967\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-28-0x0000021A1A0B0000-0x0000021A1AA0E000-memory.dmp

Download