808f1f3b1c63c5bead9856147bb2e19cefd8fc33db8fe187bc09d218e2736716

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe
Size 703KB
Sample261113-3rx2wsas3w
SHA256 808f1f3b1c63c5bead9856147bb2e19cefd8fc33db8fe187bc09d218e2736716
MD5 c0b77a23806d47d13a6dd8a9736fccef
SHA1 cf58ec45ed386903f9ca45bc3beb5493baeb3b0a
SHA512 d87c1477e3b442b11ea5568be7c06dd360922d120dd4a7b663aefb5d26fe904a6e18c9c2fcad8cb54a6c1351c65a36aca45a0039a386bdff63326319534b26a1
SSDEEP 12288:d9NsEmHQrjUfJ/m3SpioUTuFa9KNmD5gNWdYU8CI64NfkOGrGAFEHRoopqiDLjj:dvsv/Zp638gDxL4RUrNFMoopqiDLjj
TLSH
T195E40192F29941ECD027C13887121522FA7678490B2066FB47D4D77A6F27AE39F3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90
PID 5692 set thread context of 4764	5692	explorer.exe	90

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Git\aashetsousch.cfg	explorer.exe
File opened for modification	C:\Program Files (x86)\transplanting\groandouth.txt	explorer.exe
File opened for modification	C:\Program Files\egocentricity\oichuofark.pdf	2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
4764	chrome.exe
4764	chrome.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
4764	chrome.exe
4764	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5692	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3980	2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 5692	3980	2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe	81
PID 3980 wrote to memory of 5692	3980	2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe	81
PID 3980 wrote to memory of 5692	3980	2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe	81
PID 4764 wrote to memory of 2816	4764	chrome.exe	91
PID 4764 wrote to memory of 1672	4764	chrome.exe	92
PID 4764 wrote to memory of 1672	4764	chrome.exe	92
PID 4764 wrote to memory of 4740	4764	chrome.exe	93
PID 4764 wrote to memory of 3404	4764	chrome.exe	94
PID 4764 wrote to memory of 3404	4764	chrome.exe	94
PID 4764 wrote to memory of 1544	4764	chrome.exe	96
PID 4764 wrote to memory of 1544	4764	chrome.exe	96
PID 4764 wrote to memory of 2588	4764	chrome.exe	97
PID 4764 wrote to memory of 2588	4764	chrome.exe	97
PID 4764 wrote to memory of 5084	4764	chrome.exe	98
PID 4764 wrote to memory of 5084	4764	chrome.exe	98
PID 4764 wrote to memory of 5476	4764	chrome.exe	99
PID 4764 wrote to memory of 5476	4764	chrome.exe	99
PID 4764 wrote to memory of 1428	4764	chrome.exe	100
PID 4764 wrote to memory of 3976	4764	chrome.exe	101
PID 4764 wrote to memory of 2552	4764	chrome.exe	102
PID 4764 wrote to memory of 3976	4764	chrome.exe	101
PID 4764 wrote to memory of 2552	4764	chrome.exe	102
PID 4764 wrote to memory of 6004	4764	chrome.exe	105
PID 4764 wrote to memory of 3880	4764	chrome.exe	106
PID 4764 wrote to memory of 6004	4764	chrome.exe	105
PID 4764 wrote to memory of 2920	4764	chrome.exe	107
PID 4764 wrote to memory of 3880	4764	chrome.exe	106
PID 4764 wrote to memory of 2920	4764	chrome.exe	107
PID 4764 wrote to memory of 4588	4764	chrome.exe	110
PID 4764 wrote to memory of 4588	4764	chrome.exe	110
PID 4764 wrote to memory of 3128	4764	chrome.exe	109
PID 4764 wrote to memory of 3128	4764	chrome.exe	109
PID 4764 wrote to memory of 5616	4764	chrome.exe	111
PID 4764 wrote to memory of 5616	4764	chrome.exe	111
PID 4764 wrote to memory of 1816	4764	chrome.exe	112
PID 4764 wrote to memory of 1816	4764	chrome.exe	112
PID 4764 wrote to memory of 2788	4764	chrome.exe	113
PID 4764 wrote to memory of 2788	4764	chrome.exe	113
PID 4764 wrote to memory of 2028	4764	chrome.exe	114
PID 4764 wrote to memory of 2028	4764	chrome.exe	114
PID 4764 wrote to memory of 5140	4764	chrome.exe	115
PID 4764 wrote to memory of 5140	4764	chrome.exe	115
PID 4764 wrote to memory of 5476	4764	chrome.exe	117
PID 4764 wrote to memory of 4396	4764	chrome.exe	118
PID 4764 wrote to memory of 4832	4764	chrome.exe	119
PID 4764 wrote to memory of 3384	4764	chrome.exe	120

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5692
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_c0b77a23806d47d13a6dd8a9736fccef_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffeb2e1c728,0x7ffeb2e1c734,0x7ffeb2e1c740
    3⤵
    PID:2816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,2597787321653866165,10592256857563084660,262144 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    PID:1672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,4109811130550225789,9401650389056566093,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,13621500973174733001,14120658280379640691,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
    3⤵
    PID:3404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,13759770591444981204,12613904260680385966,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,5017560826337301164,13685632607310990535,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,7305542134674296716,7241115636383786670,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,16491940882234358293,9557819258364968242,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,14040488826828774580,6522398289587946422,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5388,i,4266136988632022234,18144099596556709557,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5404,i,12486185395863691040,10251169089715695298,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5724,i,13584076689946814570,7313597726347777292,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5396,i,5798026317122751689,4618683506764978956,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,1535250436517931581,4675904333343128104,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6124,i,4372165661413547383,13428069237694420435,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5628,i,8955647986132826792,16474273150855607819,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5684,i,14564969299019271667,13186473466863078536,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,1356266452102588576,13895082751930126520,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:1816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,2594166911288744846,9287110396389828967,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5288,i,5406663707556916854,2932867776101945483,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4584,i,12883305949330785531,4370870361748873250,2097152 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:9
    3⤵
    PID:5140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,8927710088254408018,6359859655199449475,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,1821710271529033640,3033792566273639582,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:4396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,2807821626274486382,4088583956020925268,524288 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
    3⤵
    PID:4832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6152,i,5091162641276445721,5067621245689509809,262144 --field-trial-handle=1928,i,9975677046871601473,15058440514937726865,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02e61b52-e0a5-4161-a543-8c354de4b594.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\02e61b52-e0a5-4161-a543-8c354de4b594.tmp
Size 151KB
SHA256 34827243bb175ae65cc8838cadefbd1f0e92df79efc5e529d1018215249ff90f
MD5 132c567fd91d105c04eadef317344607
SHA1 38ba6cf96d156735ab8db50b57acd93b1507ab0f
SHA512 92020909e3f145a33b0bcc8bbf763e666b7febf83b4e00c00613e0b556f34254cdac17104ca7763ac19ad43fe961350d2d2efa6fe797fd1f646f47e96e35e2b9
SSDEEP 3072:uejp5u6cxsmCjlvs73ZY1gzJw4ywLMfux/yA2cCT39+97r:uejjoszlvs7pKg9TyGTaAOOr
TLSH
T16CE312B1D9B9AEC48A91879C003F14131DEE61CF519DB26576FDAE9E00AC8DD0E524F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04325f08-1b8e-42aa-acd9-a3c4f209b7b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\04325f08-1b8e-42aa-acd9-a3c4f209b7b8.tmp
Size 150KB
SHA256 1494cfcdf1bfd1687cfe8fcbde60fe9d8202b0769073ddc5d543462fa3c79811
MD5 8a83657389efd8edde236e33b86ed9a2
SHA1 6143e445955663539b16a9c8edc2bcff01d52ec6
SHA512 4e2be0fe993cff1e2822aa075f0bbd9f9100e1d2e18b641b52668a64bf0e5380a5a129c0e40fb9de5728192dd94690dd148fc6447e2037d94a4140702b5adb8e
SSDEEP 3072:ues5u6cxsmCjlvs73ZY1gzJw4ywLMfux/yA2cCT39+97r:ueeoszlvs7pKg9TyGTaAOOr
TLSH
T15FE312B1D9B9AEC49A94839C003F40135EEE60CF51DA636666FD9F9F00E88DD0A525F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a671101-b055-41c6-a7f4-ce120b2adaf4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3a671101-b055-41c6-a7f4-ce120b2adaf4.tmp
Size 4KB
SHA256 d15fd22c2fd1b783472f13cdcd0ba41e72b3b40f954b16a76df3bed9969b66f3
MD5 a4b5fb59f0b54b8cb8278996201a0351
SHA1 8ad90d4d97ca43ded6919860bb4902b0ee472b20
SHA512 20979fd629ad52bc8082c161b3754808754c9131415a9b863890693f4e612d76d7b003ae1f43c922e2af33f1e65b4ce647ebe86e90bc33209d51f690d1df58cb
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5PHDBB6jGyvutFDLbmbYLsv4a:pC0z7q134vtDUDb3f7FDLbmbY6
TLSH
T19DA11A70A87C997788B6D485F5422A43CFB022BFA901AF84D8DD1F1D11EB1EC1312927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0735e944-7df8-42f5-aef9-4ca695931bb5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0735e944-7df8-42f5-aef9-4ca695931bb5.tmp
Size 414B
SHA256 f355ed8aedb661540eb6ee4f8271e8d2aaa19445ecbeed1e0e55a2c6bed0246b
MD5 308629f2f9aed512b385c7e5f178326b
SHA1 457eb364fc246201531700c6b993eafa7d883258
SHA512 501244f114ba32245afdb913f77eb484285d46aa00a3e48546abddc74e141990df26c033b3713506f72ee33153324a8940b20818914f0a6abc1c86c5c642c99d
TLSH
T16CE022AECD74EC2B09FD0B1C6024174AFB5517672A904A4B3A3DC60C8FB562A51AB82C
MD5 SHA1 SHA512 TLSH

Submit Download

16623a81-7b30-4070-ad84-ff436f37d705.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\16623a81-7b30-4070-ad84-ff436f37d705.tmp
Size 12KB
SHA256 a4c6318eb15b53ad7ab016d47087b987dd96e5a64585601e20d4317d870f68d0
MD5 fb456e43a7ee7f5bddc40bbd72645141
SHA1 f98f3f7fa9dc97aafbb34f6851156d32e3bd9e09
SHA512 e76dd57d8405a0276a9eff045fee7981fb040b3b379ccd5c22e7301f4856015e2d6ea369b051ebc14aa7576d8565216a818921445c9e0100f1e75c70d5b75714
SSDEEP 192:5R9rjXKv7ZNPRptN9THsb+WNnJu0tWQvzl4kw6AUTVyIsnAUgE:5R9rrGDXT9wU0tW2J4KE
TLSH
T1EC42812EBD10793BACDAD21DF9127B57E7F5203125912E84E6FC896C19E75C8322B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

487daf07-1021-4545-b415-073d3f25c909.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\487daf07-1021-4545-b415-073d3f25c909.tmp
Size 11KB
SHA256 372ea405f9c0aeaf2ceb2b8c927dbc96539962fc9f5c46f62a8dfce65f0554b1
MD5 c5684254baee4b3ab42529dc7fd22588
SHA1 bb19160b8f92d4c49b8b4c060ef7dd7df87333dc
SHA512 9ffc6095b01b8a74b8019eb3b9f142e84ba5a3bae0b6304ed1b935eb3a86672fa3591a2c5b2c044e60d6aa1b6989db4671d3cc8f1cdde8a3f777729840bed444
SSDEEP 192:5R9rjXKv7ZAPRp2N9THsb+WNnJu08Pvzl4kw6AUFVyIsnAUgE:5R9rrGQXO9wU08XJ4uE
TLSH
T11342812DBD10753FACDAD219E9127B53E7F6203125912E84EAFC892C15E75C8322B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d0e1c08-48bb-4f4a-ad65-a7ea214bb8a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4d0e1c08-48bb-4f4a-ad65-a7ea214bb8a4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

76497e65-1def-4b20-97dc-af6da25d5ae0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\76497e65-1def-4b20-97dc-af6da25d5ae0.tmp
Size 11KB
SHA256 8af0ce7b9380e8701ee3e229b10df239493e3b4319e80a1c5f9ab41898338dc2
MD5 ca19c5afbb287308a7f4b3de838d89d0
SHA1 e6d12bfc082c42785f8de517955cec63d62a38bb
SHA512 cf9d52d2f08591900eb8c8382019483f213b8a1f0b154d3a396c45cd7b77d5b9b20abb4138eecd5ca63af98c4651a9dd5c09790ef5138a93147dc929b6c528c1
SSDEEP 192:5R9rnXKv7ZAPRp2N9THsb+WNnJu0uvzl4kw6AURVyIsnAUge:5R9rXGQXO9wU0cJ46e
TLSH
T1FA32812EBE20753F9CDAD219E9217B53D7F6103125952E84EAFC886C15E75CC322B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4b012da7-cae5-4eea-ae06-59699d933e12.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4b012da7-cae5-4eea-ae06-59699d933e12.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4b50cae9-3a10-4992-aa1b-13cd6a56a21d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4b50cae9-3a10-4992-aa1b-13cd6a56a21d.tmp
Size 2KB
SHA256 ad0d80176744bd078bb2e39975452aa6987aa0eecd437e9435cb0d05cf78b7cc
MD5 566e874c2df061c21b8b38bec7f5abe4
SHA1 6fc715df1f72b36865baec1856e374ce1add2e59
SHA512 3ab268eccd902eb4a0134aba974417463a62442ba7c496a8723e469f6d324c0954e08de30bd7e2376e380504ce1859f395041763acfa491edee6cf2b04b8eaab
TLSH
T11F51ADF3D3D4897E851156F4AB217E1FDE2A1A14532D3C26C8D4AE4B53F2872D21038E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c04a22ded6f41a2225d94b00f8b5cf3c6c360acf4849642c129d81ec309d4541
MD5 7db3143ee7fc3cf4541cbf06e48addd8
SHA1 62214c309c73106c0b540ea2950b55de9c1c47ea
SHA512 e6d4d1a992b867af996de2b9fe87c01ab17d54b510d109a394d8445953f75799bd6b4ca67bce0a917e81a75ec2dd808ae3310adc790fb5e062d287bea64956a9
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU3SXHG47vmu:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7a
TLSH
T10B520927688C9A3F0FD8D64CCC127F8FACB5016666B8496452FB5C1803E9BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 0e3a620c4b526fd05ea95477337705d6fbfe49292b956d02e6f8676b01855d93
MD5 073ce9e941ce0b82778971432dd6836a
SHA1 a06138f93c1651a0c52c7a4421cdef15577f255e
SHA512 4e04a1d8504da034204d57d236341053548c865f864e72c5e94c6a29945a33c7f8a371dc743efcb96153bcc468a57015802ee1d24ca16171b8af89aa56ee7fa6
TLSH
T118A0021549C92D6ACD104375606546E16351CD643651C70355F144449D5F2C1C942244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 141d98bbf9291ee62ceba8dae535ed21ceaa95e93aa13cb938c7e615fd61d2c9
MD5 b921207fa8b8aa0b0310d8b29c77d805
SHA1 f7a915d6bfd7ae0ed969a93b45c9c34f5dcfef0f
SHA512 be2dc757ec31b0cffe39e2c58241fa711c3b3c4781586639d6508a8d0f996ccf943f50913b8151e0890edf50c10e1a597e30cb47ce21e85745d089dad9f12788
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\128.png
Size 8KB
SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
MD5 0de22373525e2f8219958621a66ba3d0
SHA1 130e89d9409eda3bf4c24c45e8a7d50086134c2d
SHA512 ce3bbc18af6a84da5859f639ed0e8b578e0a4534ca16fac254e757aa06bf19bba00c0d4e922831a682e1d7ec5456af0635cc01c0a0885394dd6faf5565404767
SSDEEP 192:CKwpZjVWBmHOxZMDkfoy89zziiGjQH56E6vXmU1z:CTp3hOZMEj8J5IQDM
TLSH
T16502AEB2D08CAFA12ECD11D7D7111631F809B384481E9B047A3B789D6DC67696BF0963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\192.png
Size 5KB
SHA256 cca43d465fed69867dfec3ee1faa43fe3cfc4fb118e3762f9f4f318856f2664e
MD5 da90d05a60eeeedea5d4c35c31413459
SHA1 591f0235e70c22d309271e9c81c9816e8a86f3e6
SHA512 95ea4002a0658583c34e92cce03d86e42fb73688373c7b11ccd9f94e21bb178cf32aa7dce89b1d2d297018f592d0702a64e6981b335da5da26f2b9362c559e73
SSDEEP 96:I1rvCO2A0aHOTRwC1kUof3cFpC3bbM2B/un+vT2+MMjCJhS8Jf:mrvC7L++wskcFwPM2B4+vTljCJ8Yf
TLSH
T1E8B16C5BEA450EA1D688A8AE5E036C0FDC830436A8236F0B6BD1CC399D9754DD775D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\256.png
Size 20KB
SHA256 ba50637a9a54c98264373add3ad0514b06e6ae59524a3f7a4552f556d1afb78f
MD5 7758b421c1ae0478425085df0fa43fe6
SHA1 7d7fbc301e0a25088f6226d38c4501b74c4fe338
SHA512 04c11d539944866aa7b63cd4606220e28a1938fabd8d3e60640f16857f61d823fd4d1e4cc50c96d840a7bded35d7230445e732050c657bac32b22e749fb0783d
SSDEEP 384:pEns51DuCwd79NHTa69gMWaGY/HgtO9az/h5I+/paoKvrYCEF9lzyL:pYs51uL7q2/HgO9apaoKhOWL
TLSH
T11692CF6AF0BD09744E49AD7892DD82B735027322B25503AB12C647384ECD98BB71DF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4764_866184769\Icons\96.png
Size 5KB
SHA256 a5c76c56766d79ac0e66fbbf57806501919a63913fb224b0965041ec3645f9e0
MD5 52f979b0f8eb5e71105a106aeb669fbc
SHA1 d07100bf7c92275c1ac532a26a716f1e7b571122
SHA512 be82e2d6303989d27ea16c4c4fb22ab8d10f6a383ad7eacdaf00948431127dc43fbea2c9003832a081f42b2756ed4be6b1beeb4947e09eae7785640e89919fc2
SSDEEP 96:kSJ396EccyvubO7098NnZZVbEOSDV5wcZue0cyqi9yQt+nyYKutZ0MRP:Qcyx0YTV9SDREe0chi4Q8n1jZLRP
TLSH
T1CCC19E245B029EA9E4E0DFF34A97C45FF7A1429651A3C120E164F2D1EE9F3E019C64B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d00015be-53d0-42fa-8f43-a53c3851c34f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d00015be-53d0-42fa-8f43-a53c3851c34f.tmp
Size 150KB
SHA256 2737678d659a28d05db92e0a4ebfd2808146fbc3cdb3237bd12ce8067503619b
MD5 221c07d8061928d7460319a6d040e691
SHA1 9e6dc20f6ed5c2b53100286a857bcd07a766793a
SHA512 8391741a9e91f58a5520c496d781f51a187561badc0d3a5d03cd1cde1ee54365448bd378135825435a5ad6692e2d04c3e132af7e9c3325bc546ea3db191ef03f
SSDEEP 3072:1es5u6cxsmCjlvs73ZY1gzJw4ywLMfux/yA2cCT39+97r:1eeoszlvs7pKg9TyGTaAOOr
TLSH
T126E312B1D9B9AEC49A90839C003F40135EEE60CF51D9636666FD9F9F00E88DD0A525F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

410138fe-380c-4810-98b1-8ac60bd83c54.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4764_158734735\410138fe-380c-4810-98b1-8ac60bd83c54.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4764_158734735\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5692-18-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-439-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-21-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-22-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-23-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-9-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-10-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-31-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-11-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-12-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-14-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-30-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-15-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-17-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-16-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-6-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-27-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-26-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-20-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-28-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-29-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-25-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-24-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-8-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-7-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-2-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-3-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-1-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-4-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-5-0x0000000003860000-0x0000000003903000-memory.dmp

Download

memory/5692-0-0x0000000003860000-0x0000000003903000-memory.dmp

Download