429fe680853996171a63e223af299b998025cdf1e5652e2e518c408258017d67

Analysis

max time kernel
300s
max time network
303s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13/09/2024, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OpenGlass.dll
Size

453KB
MD5

e657815f5474ba89531df68962658abe
SHA1

47e5bc72f76657e6c057ca0dcb5b00d81c179fc5
SHA256

429fe680853996171a63e223af299b998025cdf1e5652e2e518c408258017d67
SHA512

1e630663999efe8c99bba2166fe5296bfc95357fc35839c6069b23da9b6bb8530739f34ac60ad50f52bf8d4c24b0706bdc037f2fd4f6adb8aaa0a9d8568e4800
SSDEEP

12288:986oQhAZxa1vCGolwyqZmlIAZNCPrwSp:qgCZxiCGKwyqZmOAmPrw

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
2420	7z2408-x64.exe
2496	7zG.exe

Loads dropped DLL 34 IoCs

pid	Process
3292	Process not Found
2496	7zG.exe
420	rundll32.exe
420	rundll32.exe
3764	rundll32.exe
3764	rundll32.exe
1756	Rundll32.EXE
1756	Rundll32.EXE
1572	rundll32.exe
1572	rundll32.exe
400	Rundll32.EXE
400	Rundll32.EXE
2308	rundll32.exe
2308	rundll32.exe
3476	Rundll32.EXE
3476	Rundll32.EXE
3960	rundll32.exe
3960	rundll32.exe
1608	Rundll32.EXE
1608	Rundll32.EXE
4816	rundll32.exe
4816	rundll32.exe
2276	Rundll32.EXE
2276	Rundll32.EXE
3548	rundll32.exe
3548	rundll32.exe
724	Rundll32.EXE
724	Rundll32.EXE
5708	rundll32.exe
5708	rundll32.exe
5860	rundll32.exe
5860	rundll32.exe
5876	Rundll32.EXE
5876	Rundll32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
63	raw.githubusercontent.com
25	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2408-x64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133706881324277474"	chrome.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OpenGlass.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
1756	Rundll32.EXE
1756	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE
1756	Rundll32.EXE
1756	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE
1756	Rundll32.EXE
1756	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE
3476	Rundll32.EXE
3476	Rundll32.EXE
1756	Rundll32.EXE
1756	Rundll32.EXE
1608	Rundll32.EXE
1608	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE
2276	Rundll32.EXE
2276	Rundll32.EXE
3476	Rundll32.EXE
3476	Rundll32.EXE
1756	Rundll32.EXE
1756	Rundll32.EXE
1608	Rundll32.EXE
1608	Rundll32.EXE
724	Rundll32.EXE
724	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE
2276	Rundll32.EXE
2276	Rundll32.EXE
3476	Rundll32.EXE
3476	Rundll32.EXE
1756	Rundll32.EXE
1756	Rundll32.EXE
1608	Rundll32.EXE
1608	Rundll32.EXE
724	Rundll32.EXE
724	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE
2276	Rundll32.EXE
2276	Rundll32.EXE
3476	Rundll32.EXE
3476	Rundll32.EXE
1756	Rundll32.EXE
1756	Rundll32.EXE
1608	Rundll32.EXE
1608	Rundll32.EXE
724	Rundll32.EXE
724	Rundll32.EXE
400	Rundll32.EXE
400	Rundll32.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe
Token: SeShutdownPrivilege	1056	chrome.exe
Token: SeCreatePagefilePrivilege	1056	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
2496	7zG.exe
1976	helppane.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
1056	chrome.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4972	MiniSearchHost.exe
4856	OpenWith.exe
2420	7z2408-x64.exe
1976	helppane.exe
1976	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1456	1056	chrome.exe	86
PID 1056 wrote to memory of 1456	1056	chrome.exe	86
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 2676	1056	chrome.exe	87
PID 1056 wrote to memory of 4884	1056	chrome.exe	88
PID 1056 wrote to memory of 4884	1056	chrome.exe	88
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89
PID 1056 wrote to memory of 4680	1056	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:556

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenGlass.dll,#1
1⤵
PID:1900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93181cc40,0x7ff93181cc4c,0x7ff93181cc58
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2116,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4444,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4448,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3772,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3776,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4988,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4972,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3412,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4344,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4412,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=872,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5620,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3192,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3476
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5448,i,11597705362413475776,3300477347448307036,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4816

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\OpenGlass\" -spe -an -ai#7zMap29422:80:7zEvent25545
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenGlass\install.bat" "
1⤵
PID:1556
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /install
  2⤵
  - Loads dropped DLL
  PID:420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenGlass\startup.bat" "
1⤵
PID:4704
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:3764

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenGlass\startup.bat" "
1⤵
PID:856
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:1572

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenGlass\startup.bat" "
1⤵
PID:2928
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:2308

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenGlass\startup.bat" "
1⤵
PID:4384
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:3960

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenGlass\startup.bat" "
1⤵
PID:2852
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:4816

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\OpenGlass\startup.bat"
1⤵
PID:2400
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:3548

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:724

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff931c03cb8,0x7ff931c03cc8,0x7ff931c03cd8
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9876754893546182726,4329622320569926548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\OpenGlass\install.bat"
1⤵
PID:5656
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /install
  2⤵
  - Loads dropped DLL
  PID:5708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\OpenGlass\startup.bat"
1⤵
PID:5808
- C:\Windows\system32\rundll32.exe
  Rundll32 "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
  2⤵
  - Loads dropped DLL
  PID:5860

C:\Windows\system32\Rundll32.EXE
C:\Windows\system32\Rundll32.EXE "C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll",Main /startup
1⤵
- Loads dropped DLL
PID:5876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
085bdbbed9983153b65f3d56e2d5810a

SHA1
8de7bbe3d0c9f4f859a772b6883fcf86c5243ba8

SHA256
07bec91f3aafa214958e80ee2007176ccbe98edb17dc1be442fe0fbf5a9142bc

SHA512
aa92f8d3076ff576ad218b351fb3f0a23d4782ef55c380cfa4435e5992969bd8e7d62ba2fda72312936620607997120c067f14199d955a06dbf8123341e9e333

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
db8a604b012abafccf28f9abb818b2a5

SHA1
5531d70c3b819ddb5cafbe9c60662b4b65fc6b90

SHA256
2dd85a47bbf5237a9aaeb6dbba997266390f8ddede90f7024da4c96199444f65

SHA512
4414d2330d3ae40a0147907b9dd3515e26cfd29e76b3fa1cb0005236da30611a8ef07621231c2df5c2ffe3b73e2592d4c40f74206655d7026176fcb075216508

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e76a9471164ebd6090d347db8792c5d8

SHA1
4630a0d0f567016e2d0c00709bbc4884216ab8ce

SHA256
dc29d224850491baabcdaff16494b919f83002349e5be74557f062be14d8ba1c

SHA512
8de8eafc5b3645b45160dc3b354b2bedc12d4709c9dcb9cda7127433f1901a9cd578521f03a8ac4486d701cfa441874fa09f5f4718e538b21abacc4ef586f97e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
e046c5547e514534876dca95942f4f4d

SHA1
42148f38e815063da245aa58a0da9621fd469e0b

SHA256
b410151f6c212d3e1b3d5a740c994446680a51de56542ebe6017b69b94e0ed88

SHA512
aea9915a31753f3ccf30baa5b130605624d2682a3152dd9605c352c5447d3ba5edec0fc76261911485272f35f1aa5f1c2977200009fe3e67bc6004b9411c9eec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
94c330f6733db1164beae3c8c5d383b1

SHA1
aa9bcbd000e2d88968d9f429fbfec010a71a9f78

SHA256
97c8b1c53838c404a0fe44a3aea307d076364884fbcb691702f37c36bcf0e9b5

SHA512
2f69d663374c8c818d78efecdbd8ae1bdf1f75f0879a91fa444083226fcb58f9d46d6426a04da6899afc39e66c28517b463541d608b07a5cfc2cedf3d4dea8a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
78d76847bcee0f3bdd7a5055363fac35

SHA1
d8e64dbb768557ad377b2b1a27ea4b95873c8ab3

SHA256
e49862cff7f19ce62303767c5a01550e58b360d097094507928c65ff4f5cb939

SHA512
013685b06660f90d8efdd0f380cd2d3f09e471119ac4a785b86ad264ce79b45862af4e3e2b81866de73e63dafc5589cf09bcf9e95b1b0a513c5532eadba5cf18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4cb02bc670444203675b80eeb0c43df7

SHA1
722c2f0bde6673145947ebc8bde51546e1ae081b

SHA256
1e1bfda118ada432f56bc4f132cbdeee2414c94bb1f2c3ff3d4851b39d6c3684

SHA512
da3067822f6ba4641625129e96ce512d5396406a9380dadca994a9c6fb442362dbc808599e06587957727576f0b79efa9f26df748bbbad32f185a4ca765d646d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
105cfab08cffac15e8e6eb6216dba4fd

SHA1
4ef61fe433d3e61430b01f221bb10ae57f90ea01

SHA256
40f4f3d04fb466588a3fe47a4880c17f0d4e9402064691ce66bee5d68ce3fe21

SHA512
d86529ac9af576258b0aa735be0a96cf3c945d2fbc0c45f73e579b60a2b7f5a21f7879463163c1b9725df71de20acfade2a7cc4e0e0eedb6f772580e44fb482e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5ab043d3e16ff45bea44f1f4efbc7e1d

SHA1
628f1c53367eafb82104398ada8fe84cfa639f52

SHA256
ffa6d1b5d1f5680a6c44dbd94dd3e4bcdb67883ea62f104baae7a5af623801ae

SHA512
87e22e80882d5e6a4280a53053813592350c232c03042a529b8ff2da09f1218e7107f6f6adc2fa1213cdb4e2e753490a03ff5343b8f3916f881e4dd42f7fc4ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1c081d83783523ecf7f1ae1b485acd84

SHA1
5caf674a762fbc92f404b3e1a3f46c131352dd1a

SHA256
32d3f6137b34379d4d468d9561cf7331067c5236347a29eac655b93963e758b8

SHA512
9555b168d0b03cc3dfbbbb1a476b7e50bf633e1ab79204538e7eb214054e50ddb56fe4a017a55ef016ba5eacd791f2ff05ed91b8118a9a2c7f34c33b734e7aa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b3f8c2f96bc44375c0f32e3508aa4ebd

SHA1
d49700cf92307cf9b6e96101318b2c2cab2940bb

SHA256
b03c7ef4e0ed73da3148548fc7443498b97117ee1f8a532b25fcf935b94a5903

SHA512
f72dcc8df8d60453be08400179057d0c295ea125f07439aaf8ac9101ba1e89538f0a37541ba7e762cdbfe6669ed6e2fb5267d7a81e578db4b375431bcaecf4a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
30ac48d0db51c5c69ed5f00f4ca4695e

SHA1
3de8baf56545446716dff46fb4d8255fdac978dc

SHA256
273c6b34e0261e88b3278b573e7673fce5172c67a492305afd357dc623e99699

SHA512
d1df8db043c71a3718f18d689f2d10a01bcc375fb0a094239e2aadfa6f5c3107a3f1d853f209231972f70ef868b5ea5aa2d8191fbeb6f6a183fd3ba5468da2da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c33e06fcd2a3a4fa4d9512559a97c813

SHA1
6773b083119f84c385697d01db4bc3f4c3483511

SHA256
b69aeb249e7204b9646834ca8650c58eef205ad0b7ee84b8adb81e5e38403bc8

SHA512
3bc86d413c60b8236d52c448c1f78f94d14ad2eece9eb9f6806b61c3eec4918aeb1ede7484aeee7682475d7d8ca2d9e81ac71f18ed9ca76661f8a8da4b43e4c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
81c16e7a888ea4e62861a05cdcd8e45e

SHA1
699db1ad7609048b912e010029a489c7dacc3d42

SHA256
ed7ceebdeaaeb68c8ba999644e0a3ffc28a858234a5b3282f38ee669ffe164fb

SHA512
0a1e18689cae7685684acbedea2696fa8ad666034a063fd44481f6872d149a36fff50d8be59004d27e000eefd613b4625ced5404fd02794c7f151793f64d5792

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2944fec3fe31f447197257d6f625ae88

SHA1
28a94fd12dc922961f7801d14baefc11484ba033

SHA256
bb075b5427db8a2ba1c1890b3c222813c41ac588829056e713747add78700534

SHA512
78f4decef382b5b449d2447fdd605746f87ac8d3025cb5a00491321f865c25d8a13e36c9855a087e0d8999c4fee6de6f5342736bcc4d396ca5d5d454fdd5bd42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
47b08a4a336c8ebf11dccc92f1600b09

SHA1
db10dff1ac886aa3351ea5dffb9c5b4b8faf6833

SHA256
61d220cbbaa730f76d9cfb5104dc3d0fb7d3709368e1dfd523da244eb1cedfa7

SHA512
2ba54e4144a83e7e7e176d9c439fec5b586d132bf575fe3f0c89e705bd089ead6528f8b5d31ffabce9aa4d2f2190e0b06c9489ee3e18b875bf8f1ae5f50050d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2fdd8791a9a7c7163ebff80cd7cbcbab

SHA1
d31aec88950278ed147bf1e4abbb8d860183e3cc

SHA256
dd556bb1fa481b93a90cf761576623b4c210b2b37cb12f09d5c47e6651d4b32a

SHA512
4a79e39b7bf17d5f29775cca8dab1341b8785004efbfeb21ddec321c1eab9b313c7626965c029fd3b0f37e4764a4d054d3e3f9ccb088e05abb1cdce91d175058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0419af322135311eb66f842b89cd6e70

SHA1
f9b5326b832160e2d599a9501bde98eb1f4c42c9

SHA256
1a57ec04b9859be49b1b8527c9d6ee88916b40cbf825575fdc0b3d8fda984098

SHA512
03ffbf2efbfd3c30f720b42b50fb90b00aa5ebd8c971152986069bd6ecd6d0aaca4d74a77f40b97a515b83b51235d98eb0aebd8c5fcfaa1fe64e68ad8b468e58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d003ed4708014bc2184ead66711f4192

SHA1
9858a95a17cbae9f2b40bc663dcdfb6f04fc077d

SHA256
842de77e00ad21f1b321515a9e183fd589c9b3a7f88831c5261c08c776d2e0a6

SHA512
5ea73c774ab5849ee988267fd974b934467bd5c2e80054ef3d0e76712a9a4d4d2266f3c2ef2e03b673f1018e1282b3ee0ad55c0718771e2cd7ce0cfb4e27176d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
85365d913d1cffaec45cc78fb0deef81

SHA1
95dccef8d5358b296b9d06e1cc93baad588e4ed2

SHA256
30f4dc7c34b996256039b751de4e2e232cf48e809582eb0fb81e43bb101ce747

SHA512
edef6e257acbf6280bb38e3d2a18c586701e90c7968b053d459374b638e1451cbdecfbb1a4bafb5f89f27d107a757dd9ed4192f7830d4983bb535e5b881c1439

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9db347cb8d234e7cd6ae9060db05516a

SHA1
3d21e7c180a635c49f0b144f14811a48324d929a

SHA256
8d5e4094a15b8b983bcd6bc1f84faf039ff19c18a059cc202437fd1e5b32c95f

SHA512
8c08b53fdb951805c71d2c27615023f865a1a4a6393241d9232caadcf7089b02d43515ce66ebb5d66750593792bf194bc35a1b7f67d40660f33d05b8a4a7831e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ae6f75b80ba34e508a7b6644948c93a3

SHA1
02454f6ecf8b34c45a6c3b1c7313e334c6e90f2d

SHA256
cc8eb926e6ee16d60ca8d11d8d176de73694777cfafe40b4f0ae1039bcd408a5

SHA512
9cfa4421a59a0cd0388e2d0fe50398376cff0b302602909cc893fa940661c650350ebba276f17bc407a0bead7274595898f3860049c5b79d18f55746d302436b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a081a9edb1b538ba1a1de237e55f0c92

SHA1
0100be2e7806576a6b66bd870b72ab734e3606df

SHA256
be849423f99f227aa41ae8ba494a4176dc51ea50f39337091332c509da1c9cd9

SHA512
1d0e4ed5907f894aa12358da139cb1684dd043c0e07007f4aa3446ae56caaf5e9cf9442cbb7edaea58372f00bb7412defa5508520dbb87d4796ff63a1ff8bd4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7df401f8ecf6bec767e996b34b5c0a4e

SHA1
1eddc14f9d776587a3cd5fc5c30277810914ccd6

SHA256
cfcdd8372bc2669e89935ecdc1a1d5a6b09494d9888aee0dc892f7bf96c1cbcf

SHA512
1b64323defcadea6c8de50d30e82594b8ea8f559ae4b057e35737397d0a9b373d73be00f38ab2dcf2decc68be16fc7958a03e044d3465c82c4d3ea76b2508f5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
442cefebad3ea5195fb177ee3a0afd59

SHA1
487ac1528df2830f2ad43887669c95c94cf29a59

SHA256
11f54a9db01300b97acf708adb3c7d16838811405a1fba50e2611a6a0050c764

SHA512
064a03238de0eb0f836f6789c4b1fdac2c1df7c27bd4654c6d15ecee2da8cdd681227d133806d7a98423d98e870b39872f7e1e4a960e67cc198f548adbfc984b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
2527e86e19acae76344e64e95fe8bce0

SHA1
760970c4ff56f9dedab348a5319548e49ac54731

SHA256
368539357591047e34e1b0385d71ad88bb1a1a9813213505d24047461d699d93

SHA512
b9ee7c301c7483b76308ae30c9c8eda0e42c31f2d3d33001cda40e4e379dbf52b875aa003e0620c7e30705ec413f141af1ebfe7639b46340ad3c12370c8dbfcf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
209KB

MD5
eeb2171ee1b2cace7703e555fec688a7

SHA1
aafb810e9c59e7be6b3d0eb8dcad5099716c61e0

SHA256
b62c70f00b67deb3be042fa59d5cd071cbb943d512911b01732871093e5f7307

SHA512
590ca149fb95e5376f0c490ef0681a5bd1e25a32d6da98679c6246100ceaf9f8150a171e9e3e3a1bf1d6153cd4a91319fecc7e87da56a8176342a3a8a66d5ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
209KB

MD5
141b3a08e262efb00916c1bf612d8925

SHA1
916fe1daaa8daae1f26fb02d62c08ba1a8e2c9ac

SHA256
ae782f652cfee5ee20fa2a7c62a80c4c5e7fc1d95eff3e4e599f107f90075f69

SHA512
c792b775a0621342ca8b07979797257d88fc63d173efc44cd1e30d77ca250a6015e39e2c63d6bd7f2382a258b22e49460528bcb968af5706b9aaec1b3785d32c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
c7f1e09d89fab44ec005ec477ea2f30b

SHA1
dfeacca4ab01aa2d7eab338eb398926fe5106323

SHA256
e9df96d77f7588350aa05450b639d434d798b2f4eafbf03d465eb53b2535d616

SHA512
78c517f5ec8f011f314e831fc3715ec9ffae9aee140ff245b57857584586a1df5949f0854482b13593b53df1f0813b1d3d321b642677ed8127291335e8dcb96a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
209KB

MD5
0dc82727c9704336d70d290098ed3ba7

SHA1
8263165035aa789d7bc95999805db1a75ce76a23

SHA256
7846c93893a15669ed66dc6eb404a37e784ded49c5ff3b76944d4a3de8edb4cb

SHA512
880890405895bb3052d82418e30db677d424b60b5299dcbdc1a187acb4c2d542500006f3c057d4fd880596a7b398cca4b1eb4c010f22876410d912ad7289ebef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
239KB

MD5
b73a23094683de91e26547f10ed7074c

SHA1
1de2952490f33ecb529423cdb2f0d342d071b193

SHA256
931329ca444b05eca2e3d08aa36c74fc02f152a2f5f6c8ccf31ff935125f1bdc

SHA512
2e47de5ee268240e1818332959f23f510fb16ca1ed666b36ba6a12ca31278511f8081732cb7e510221a4a9819e3c94281b96ec102082ab1a83a145a701af1340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
2d9b07bed4e9f7acb227ce249e5e3857

SHA1
5bf52915978c4f621951d9ceed205d31d94ab46c

SHA256
fbb7cc1eee3eedb1f0c215076f6e3c9e7762902afc0668f87816132b0c8d752f

SHA512
68eb16f53de912805a407d9a2c5bf71df6a7ee54b9cc551318d51d3e9bb1fa5cdb2a5033b1d949e37927fc8ef2ebdfdb9362cd6cd10de275df00da01543064e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
593B

MD5
c640ecb2f5fc02845a346b613fd78fef

SHA1
debdcfb9f0dff36b60857c9346305612018057b5

SHA256
cec697d10f0665e285e2992494c0a12cb11bef587fa605f627bb26fb3acbc3f7

SHA512
ac91926759d72d1d91a63401bc46385773bcabba358ac126f414437400ec91ef498ef4ebb8290e0b04b794b941942e9785575f860499b8c6945c3fc66f1c7629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2932d9abfaf03605e87668ebd9dc7991

SHA1
aaf0654093affbd005359d6af97bbc30fc051cd4

SHA256
0e7e35ac2e8a867387f7004bc5ec3c8d65f6f86084d9680afbd3dacad08724e1

SHA512
da88cc1098386d174f306518d3c46dfcba8140f538314304841855a1a4ac8b06f1b546f1924c49a17eddc3a40c4cabb75773f4ba8eedf9c86ad586916798d571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f6467f1cc0dea1805e2571aee190b9f

SHA1
87d2c42988d6d2a1954eb173dfd7822a622bbcb4

SHA256
91b6fe70b42c8353785ffd93e0143ac25c63dc2fa4afc1414a1610b7f669aa61

SHA512
62af85974f68110c67d4cb8c06bd88c3fab7cc1a669bd5feb013b2a8dc0b95a69c4923b27e0a17474e91f9115ea5ee5f07984a52750eeca67aba954bd9442505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3bdc7a61a8f4a792eb2b0f9dbdfb1b73

SHA1
348424270e95fdd9077909fdbebc84e52dec306d

SHA256
e2fb79d980e18fd45e79c9a970a5f8d975d497a2111dfdc4793691915f07a58d

SHA512
8a3074c2c9eeeffbdfc6ddd707f2595d926f66331f4e0129b933d7845b54fc4b392f4be495cad16907b90b3b0b8250cd1ed93d672fe07b795bc0804988c31cce

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
d12e797f18cb79137ad12b5e5139e1b8

SHA1
f15fb437b1be86b714e278ce927b315fa0e16ea3

SHA256
afb0f4a0229174f8118ab512b569fdb9eb3ebb0389cb11c9f4a0a2aa88ec258b

SHA512
f6e8f99bcd0ecff7683c8e56fa2ffa3fdff16d6c17a2066b36bc3d78e2838130b5b23059a239b29a7ebdd0b5ca36b3f9cf388945bf1aad50a3f91cb8091223cd

Download Submit
C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier

Filesize
58B

MD5
37da88b521d433509b41a4f658730dbe

SHA1
2ea39c5e0b87a0717eac738f9ae92be8771fd576

SHA256
62ba564e8b8b6fba4ae004166cddac5e232f0b2d06dd97c0e4656571adfe7d84

SHA512
98a00650022e0e36e748714b92b6beaebc3afa3c7a5baab8cecd155091d7acac94dbec0fb9c7c2c24c07e0ac7068058926de85bf10ed4e7a3b634d47119ea832

Download Submit
C:\Users\Admin\Downloads\OpenGlass.rar.crdownload

Filesize
4.8MB

MD5
fcba0241c70bcc009be18bb22ef29e38

SHA1
260d1e3f7f2771b9a1cfb3bfcc1182357fe45aef

SHA256
415b5b134a45239a6320ff09153814289fb02183717eeef2b7485e1abe5b5d08

SHA512
2799ea0479593bb58546c33ffb5f81b20b8d84fde66afb19f861292e6c404f729876ae21416e912b4ffbd3b86fcac759eef25bd50f061f6c52ee17b932369d4b

Download Submit
C:\Users\Admin\Downloads\OpenGlass.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\OpenGlass\OpenGlass.dll

Filesize
453KB

MD5
e657815f5474ba89531df68962658abe

SHA1
47e5bc72f76657e6c057ca0dcb5b00d81c179fc5

SHA256
429fe680853996171a63e223af299b998025cdf1e5652e2e518c408258017d67

SHA512
1e630663999efe8c99bba2166fe5296bfc95357fc35839c6069b23da9b6bb8530739f34ac60ad50f52bf8d4c24b0706bdc037f2fd4f6adb8aaa0a9d8568e4800

Download Submit
C:\Users\Admin\Downloads\OpenGlass\dbghelp.dll

Filesize
2.1MB

MD5
68e66b04c1d3289b0cc96391060c922a

SHA1
4176b12cc308f697ee49430c27f351c46f41e7eb

SHA256
131493d48eeec95099053066c90fa2a56adaede68aadf81c2f0201316598ca8a

SHA512
611e0f416e8ccd39bd61a25e290c09596e8f33999af608f77461d57b33cc13753614d72f2f57800a715a5eed1414338095004c09eba9a8be9bb6d29ddb4de7a1

Download Submit
C:\Users\Admin\Downloads\OpenGlass\install.bat

Filesize
49B

MD5
965e3f1293a47f2da21fb3891e793577

SHA1
7bfe7e6ccab4eefc99bce9f0d82d6dfef242ec34

SHA256
f841f77aa2fc56496dac8bc160f94ec2c1e0cf225334be515af53f93762a4b9f

SHA512
a20d350aeb6650035e83a6811c5a3a0fafbc1eafb3bf1998581aa228a319588165649f429275493002e9fab45de2f091d1aaac47907ee9d38734a7d9119c6ddb

Download Submit
C:\Users\Admin\Downloads\OpenGlass\startup.bat

Filesize
49B

MD5
32d7ce99781820f6bc9c2a5a9dc0b22e

SHA1
c8678434de4089dc3377fca1cbf178b6a8a922ee

SHA256
672ec7876fcea5333e936eb0669c3fcb83056958863bfb8336eb152b1b721035

SHA512
401f8dba0db71ad45e81a242a36fb07d125c79c69542331e1afa0740cb383700fe838449d4be4b272a66f5f6ef03e4b5f1455cd13949683a3af8a2708975ecef

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 773527.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit