36497a58b39dca8f8ad09a62e4eab6a56e07cf5af1bfb8f40fe356da49880071

Resubmissions

22/05/2026, 14:18

260522-rmkefsdx2n7

22/05/2026, 14:00

260522-ra5vmac15p6

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
titellos_1.png
Size 2.5MB
Sample260522-rmkefsdx2n
SHA256 36497a58b39dca8f8ad09a62e4eab6a56e07cf5af1bfb8f40fe356da49880071
MD5 1cd98e18b8dc81ae3579954d415670c0
SHA1 468a16a1059409b76539b79d8e92cd80fefebc88
SHA512 41804de8777f5656442e93d6819d0df2ff718ce0d216b44edec39c5763a082340e7db4e28f2c57d6a3a799168d475a618a3ca5c82e937bdd4bc91396d11b091d
SSDEEP 49152:7L8+irJSb9AUZeA4BOmAy6XFxSzzBhfkGUN8PhWDeR+LwdGle6W0RF5fL62bmE0f:7arJSy4eA44CSx07HUN8Ph0eRa46W0R2
TLSH
T104C53360FC4EC183C596A532C267CB3163316D43BB0A39116329F7B9597BB819B4DFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
8	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
5496	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe

Loads dropped DLL 54 IoCs

pid	Process
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
6024	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe
4704	XGEN_Stealer (1).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
182	api.ipify.org
183	api.ipify.org
184	ip-api.com
191	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000d000000024043-1108.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
612	netsh.exe
4908	cmd.exe
2924	netsh.exe
984	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2232	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2336	WMIC.exe
5388	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239331320841589"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3344	mspaint.exe
3344	mspaint.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
776	chrome.exe
776	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3344	mspaint.exe
3344	mspaint.exe
3344	mspaint.exe
3344	mspaint.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1148	3312	chrome.exe	90
PID 3312 wrote to memory of 2232	3312	chrome.exe	92
PID 3312 wrote to memory of 3300	3312	chrome.exe	93
PID 3312 wrote to memory of 3300	3312	chrome.exe	93
PID 3312 wrote to memory of 908	3312	chrome.exe	94
PID 3312 wrote to memory of 908	3312	chrome.exe	94
PID 3312 wrote to memory of 5004	3312	chrome.exe	95
PID 3312 wrote to memory of 1648	3312	chrome.exe	96
PID 3312 wrote to memory of 5004	3312	chrome.exe	95
PID 3312 wrote to memory of 1648	3312	chrome.exe	96
PID 3312 wrote to memory of 416	3312	chrome.exe	97
PID 3312 wrote to memory of 416	3312	chrome.exe	97
PID 3312 wrote to memory of 344	3312	chrome.exe	98
PID 3312 wrote to memory of 344	3312	chrome.exe	98
PID 3312 wrote to memory of 3284	3312	chrome.exe	108
PID 3312 wrote to memory of 348	3312	chrome.exe	109
PID 3312 wrote to memory of 348	3312	chrome.exe	109
PID 3312 wrote to memory of 1880	3312	chrome.exe	111
PID 3312 wrote to memory of 1880	3312	chrome.exe	111
PID 3312 wrote to memory of 4612	3312	chrome.exe	112
PID 3312 wrote to memory of 4612	3312	chrome.exe	112
PID 3312 wrote to memory of 3876	3312	chrome.exe	113
PID 3312 wrote to memory of 820	3312	chrome.exe	114
PID 3312 wrote to memory of 3876	3312	chrome.exe	113
PID 3312 wrote to memory of 820	3312	chrome.exe	114
PID 3312 wrote to memory of 5632	3312	chrome.exe	118
PID 3312 wrote to memory of 5632	3312	chrome.exe	118
PID 3312 wrote to memory of 5940	3312	chrome.exe	119
PID 3312 wrote to memory of 5940	3312	chrome.exe	119
PID 3312 wrote to memory of 5676	3312	chrome.exe	123
PID 3312 wrote to memory of 8	3312	chrome.exe	124
PID 3312 wrote to memory of 220	3312	chrome.exe	125
PID 3312 wrote to memory of 5396	3312	chrome.exe	130
PID 3312 wrote to memory of 1352	3312	chrome.exe	131
PID 3312 wrote to memory of 8	3312	chrome.exe	132
PID 8 wrote to memory of 6024	8	XGEN_Stealer (1).exe	133
PID 6024 wrote to memory of 772	6024	XGEN_Stealer (1).exe	135
PID 772 wrote to memory of 2336	772	cmd.exe	138
PID 6024 wrote to memory of 3284	6024	XGEN_Stealer (1).exe	139
PID 3284 wrote to memory of 3900	3284	cmd.exe	141
PID 6024 wrote to memory of 4908	6024	XGEN_Stealer (1).exe	142
PID 4908 wrote to memory of 2924	4908	cmd.exe	144
PID 3312 wrote to memory of 5496	3312	chrome.exe	145
PID 5496 wrote to memory of 4704	5496	XGEN_Stealer (1).exe	146
PID 4704 wrote to memory of 4080	4704	XGEN_Stealer (1).exe	147
PID 4080 wrote to memory of 5388	4080	cmd.exe	150
PID 4704 wrote to memory of 5828	4704	XGEN_Stealer (1).exe	151
PID 5828 wrote to memory of 5900	5828	cmd.exe	153
PID 4704 wrote to memory of 984	4704	XGEN_Stealer (1).exe	156
PID 984 wrote to memory of 612	984	cmd.exe	158
PID 3312 wrote to memory of 776	3312	chrome.exe	160

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\titellos_1.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa84dac728,0x7ffa84dac734,0x7ffa84dac740
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,17596275902433948325,4421305249350170024,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,13570104935611516430,13992765317861265775,262144 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,5398367597296375909,14123613601071882742,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,16090077122561980113,13147979483942645638,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,647449811322709046,7752326850898979663,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,1578894605483108239,9796554974842374866,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,12318958117475428832,12558566964664827183,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,15627936534392750904,2948405961951010317,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,12366048664386011228,2278618659588861201,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,14997397764828332764,5841161661886923365,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,7581840364838152462,9327065938681802056,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5584,i,3507709184857003723,7742971729790514856,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5840,i,2155484689025341219,7326163078208972731,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:2
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5976,i,6609221360267896139,8105812891813865937,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5676,i,4067981176410957470,7193962520565529241,2097152 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,15041195582746430783,2493508250261764596,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,15344873358817081098,9852186072814930870,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,1564743320704429253,23496140079049293,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,7618732753864740662,6584910093961786788,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,6980197764202246848,3063536313365667488,524288 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:1352
- C:\Users\Admin\Downloads\XGEN_Stealer (1).exe
  "C:\Users\Admin\Downloads\XGEN_Stealer (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\Downloads\XGEN_Stealer (1).exe
    "C:\Users\Admin\Downloads\XGEN_Stealer (1).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:772
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:3900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2924
- C:\Users\Admin\Downloads\XGEN_Stealer (1).exe
  "C:\Users\Admin\Downloads\XGEN_Stealer (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Users\Admin\Downloads\XGEN_Stealer (1).exe
    "C:\Users\Admin\Downloads\XGEN_Stealer (1).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:5388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5828
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3460,i,10492802216997022546,17852792438974394125,262144 --field-trial-handle=2064,i,2356283062500322087,12841027210306891132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 262199ec7a391e6b9b5ccaed117f2b58b11a9d2724c5ad4c0aef88ee5d052840
MD5 d059f7eac547213906341ae7d224cbdf
SHA1 652920dfce68d4b6267edcd012c7a3f1f968b958
SHA512 045b1e88aecf6b689767ec00491f7d48ea8d3a8168a7cea5ea613c743209569db5b7bb3a37dc0f102aa790faac2eb4b05ac5d0ec2964d42c2570379bcfb35360
TLSH
T1C9F02DBACD21EC3B28FE17687095474AF754137B2B40899B3A3C420C8FB1A3F464581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 112KB
SHA256 3cf2fdc02c0f788af4059d832479e6878758fef5a8ce030e4aa5d3f37ab50083
MD5 c1ee2f239ce8731f34287cafe998e89d
SHA1 8400ee0badc9d5764d5442da22564302105aa678
SHA512 fb6425930bcc59f1a3aacb877b1903935d8173a8208889a9f021250872f6cb041e78a8be3ec417cc73312726f04f4e4570252e0efe942dc37cb76d75afe3d96c
SSDEEP 3072:7av8o3sCKA0WbUsB1YeowH0LbYThuQmZmN:7+N35YfA1XowH0MuEN
TLSH
T159B312B1446AA12B9943F0C036310EDD9C5F553357A572F88EDC65C88D7A7E21AAFEC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 cfe1dfc70fcfd3d2d5b333e176a48d92b958718415e1d4eb90f6df03990887a9
MD5 543c23fdc9cf73fc85ba361e93e747af
SHA1 56c045944648242a9f2c891c2412ca3915d94bba
SHA512 33b9c867d15a4ccb1ea29e0eae3a38dc74a36961db346fd2295ed94fc1d15985434332feeb3b4d8a808b6628bd599bbe11d565258e6ed2a11bb90661453536ac
TLSH
T10201F4080D9E057CCB35B6752CE26223BBF0291A21930E5EB7A8B07D758671D1F74B06
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 682580b25b979cdcf803aa6ff85b0609db3f5a8f8dc8a5dfa3d4441029c99f4a
MD5 cb02b97762f17ddd1e221ee6ae415b17
SHA1 c7bce66998e3b0cc7ab2aed376ab1b23eacafdb8
SHA512 9f8d28a0bba6a5338dfad58d62feac7c891a17863e1c35b1cc7a93cb9bc83f9980768961b22f7937481d632c46f50939a8e8d60b4400b78e4bae7478c47499f7
TLSH
T19321A6040D8D043DCF30A6780CE92623BAF22C0A94832E5DB368F0BC3196B4E5BB4F06
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_web.telegram.org_0.indexeddb.leveldb\000003.log
Size 87KB
SHA256 c5f5f28f345227f749226f919b5ec1bbdddbccb29fc8264b6e1f0f3367e542e0
MD5 1d8a557f8fe7af7d864d8b87d0370ec8
SHA1 98656736f2d8bc624a94e33d3f917d2230a1b733
SHA512 fcf443d735fd396bb78609781e2967585604cbf6a08a41464630afccea1c65a439d6590d25a421c30ef77f98e24df9d50c5929318e1266583389bb254ad3d15d
SSDEEP 768:Ay4iUKwKER/t/5/9ik2UScuMIdHJjZfZD7mU+g+sGyN75DF7pY7gAYpAtGqFa2B+:8rpDHnSopqI9w03fGWHLXs/uW5
TLSH
T17E93DB0F5A948E27D8AD0A795EB64FE81B777E66FCC5D10ED1C4F2BCC975A408831A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_web.telegram.org_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_web.telegram.org_0.indexeddb.leveldb\LOG
Size 516B
SHA256 b209c3f187e907a8cf7411a61d29767740c519c4bb81d85cd39573893ae2cf00
MD5 e98c970fa4f46fd3cbdcbbd82819b1f9
SHA1 a2acba7fa353a8819b956fe3e53241bc5c7e2bda
SHA512 88ea631c6e2dffced6479bf78354790d9bf87b0c0e10d048bcbf9ecce666425e534fe60f7e6d25aa4e0a7e6261a73ccd26f2a025548f0e06fea2892008e81b0d
TLSH
T114F02B8B87CEC55F20C0C0B2A538774ACEE65404A6CC3B054F05E58571D6409959D370
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_web.telegram.org_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c2ef0064ffbd10efc15aa6cd1de45e3729683b0b2099c22b9e17063c2a04caca
MD5 e87da0236c513459f5f805f4928af20a
SHA1 e953ec023451a1e5a405103c83ecad89dd3c9a46
SHA512 122b142e879601158da772a0da88770988e19a1ad403a450a1590bfda65ef3eaf834d8c4896424da2cfc19585a25f9e95ca744dc1b679bd6a82de877271a7a9a
SSDEEP 96:DCBJDRCrf3yS888G3NDINSDINiD1wDB+9S6jhnDs:DCBJ1Crf3yS888G3NmSgixwV+c6jhnw
TLSH
T12EB18CF7C3E8853D895156F4AB256F1FCE290A24532C3C67C8D8AF1B97E2871D25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d08a525dc8a6230de18e2a661f378e1fd4184c6310d2cd4368117e890cbf4334
MD5 4737e6261e1a511fecb7fb2530918e25
SHA1 aec725d1c10db420e0058a7e574c60c6d475e563
SHA512 7e77d2ca1b50a7b30000e0a510929a2cd0b6b4aa7fe0bbe2ac7f34bd6ae5cf5dca6e69c18add862aefafbe2640186fd5c132929b030b15e0903bbaabc9e914eb
SSDEEP 48:YALlhwqkhWsrCXLsKffoKsUKswRspfsBtsXcsAFs1PsyNDIqDINiD15sUV+sf+J4:DCBHCrf3yS888G3NDIqDINiD15ASDIDw
TLSH
T118918AF7C3E8853D895156F4AB256F1FCE290A24532C3C67C8D8AE1B97E2871E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ae0d739d82d6c928717b9bcf5aa2d85fce5ac22f79464200b2472cf2f29b6897
MD5 6d0f3b33936d2893dac2cd1d9dccba53
SHA1 f925e90b51b1de5ec32ddd35f6d14cd3cffa7cb0
SHA512 de0ec4010024500190ab326a869a678642406d4a5bc6e96564195d2b61223d85ff959fef0c653a3c3417087af769ec528730c373dc1950d39d6c566610907632
SSDEEP 192:NRVIHBPv72vAPRp299THsb+WNnu10gZL2yYkwnLVyIsnAUge:NRVIhHC6XuFwU0M2Lte
TLSH
T14F32C66FAD20653B5DDAC21AFA617727D7F5103136D42E80EAFC8A2C14E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a0eac097e5577e26811edc48632aa304e66a47c965c12996f9a0a422c9af3c2f
MD5 71066145d57ade8886ffb96e994fb61d
SHA1 4a8db8f94064eeaa61279467ce8abce754fbd2e7
SHA512 dd7898064ee6b763ab28ca34e0a4d66a78150bb1f82c8260cc32acc3baafd9867f44cb3126fe1f6fe3b63d6c22cfe705353611e1d9b5c193639f3c0fb17984a5
SSDEEP 192:NRJcBzIH7oPv72vAPRp2+b239THsb+WNz3u14uN2UZL2yYkwnLVyIsnAUge:NRJmzIboHC6XoFwgv2Q2Lte
TLSH
T15642A56FAD20657B5DDAC25AF961772BE7F510313AD42E80EAFC8A2C14D79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 011b7dd3b92747029d80475d153904cde05a0d3aa1c64ebcf4066c9c01a6bcf8
MD5 d2406b700b0a5dae9245c2c45d550338
SHA1 2fd72a46bb2787fb5a1571a50072015365711bc0
SHA512 73be73bd357a5ebba5363fb38559f5170cf11eaadcad0af47927f30b33e53c8ac823994853b6584ef8e67461d130b02e7995e033d7cfde68222ba4b485dcbee9
SSDEEP 192:NRJcBz8H7ovv72v1PRp1VAb2C9THsb+WNz3u1UN1MuN2eZL2yYkwnjVyIsnAUgE:NRJmz8bonCVXSFwg8b2a2LlE
TLSH
T1B952B76FAD20297B9DD6C25AF961772AE7F1203276D42E44EBFC8A2C10D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee92714a54cd7bbfd1099f65dac0a50825b30be3bf4885c08ae3c78b056d93d6
MD5 377905b24752f52b253a458fb32c9cab
SHA1 a53518c435942a1a9a9e8e36a507c548d4a44edd
SHA512 150cc768a14589e2f57e8e45ac67b47ec36f504c5653141d552845fd7225a254f4b380b7d5d7562665d9f2f94354b69643716399481b7699d3a27f3927dbb137
SSDEEP 192:NRJcBzIH7oXv72vAPRp2VAb2C9THsb+WNz3u14uN2CZL2yYkwnlVyIsnAUgE:NRJmzIbo/C6X1Fwgv2e2LzE
TLSH
T16642C76FAD20297B9DDAC25AF961772AE7F1103276D42E40EBFC8A2C11D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cf40fb676ee5b4fbecbc8d4ec685eb93506c76f89c8a8c83d96e81e9c61a2686
MD5 77fc2103fca5d93a6348610c91dd6a13
SHA1 1329c5f523f11d0c83b4f749eb8f31406d098991
SHA512 25adf316f2c576f0e7c292bf906380ed38d517ef1ec70b87e98acf6d0008c95e21358a6449278274d6cf18924133abd94532bd8316249b3d9bd605cc1e0ec411
SSDEEP 192:NRJcBzIH7oyv72v1PRp1VAb2C9THsb+WNz3u1UNi+uN2OZL2yYkwnjVyIsnAUgE:NRJmzIboeCVXSFwgzF2q2LlE
TLSH
T16352B5AFAD20297B9DD6C25AF961772AE7F1103276D42E40EBFC8A2C14D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ae76d6e4f089b1a22f00d48d451e12197ec51e232d95b3cf03e70e191f2dd0f4
MD5 ae57c4dc9b413a5999bb7daab0d6ba26
SHA1 fdf5cb75cd9578e9b03983532b629100bc3ce546
SHA512 9be7042fb41fcaa351f3cfa9da27ea8ca8d842e9c78435f09a3b307ca83b90cf29cc78fbe3636ecbee7a8388ad982a1f549c96035018bb4f65fdc4eb72f181c7
SSDEEP 192:NRJcBz8t7otv72v1PRp1VAb2C9THsb+WNz3u1UwIc/uN2DZL2yYkwnjVyIsnAUgE:NRJmz8JoNCVXSFwgcH2t2LlE
TLSH
T12052C8AFAD20297B9DD6C25AF961772AE7F1203176D02E44EBFC8A2C10D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 92655758857629f8735557cff26ba1ddb2db1047941269db2a474d3fb2327669
MD5 f21eb3145a84fe4b2f0b4e073e51aee0
SHA1 a56574ca353dcb340a78cd255299b4abc2e29cc6
SHA512 f6f9706c93664e1198ede921834bbc31a29975e04b40518e57b8c9aeb1ca634ea0a9c6f214dd063bb8d186b9df257c22d76a9686d6f85656a4c267202201ee86
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3HkHGwIB3WhmWKoU4:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHQ
TLSH
T11B52E867688D963F0FD8C68CDC567F4FADB1016666740C2897FA9C0803AA7CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c6d83a70a3663b3_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\79672e0c-392b-4205-9139-75221a57de76\9c6d83a70a3663b3_0
Size 310KB
SHA256 6ade23795657af29348b6b094364b241d762ccd1c8faf1fdf1180f0c5f689ff1
MD5 a6633bc8965342f2369d8e82145a2969
SHA1 595ce0004dafc6effe61953bb4f78a221fb5b0c3
SHA512 c6f923a01719075a908f65830ddb558951aab05eeddc84341becd6769cddd44277b635a1fbae0f88bd21da7620ab74938fcfa9e9d112af919f2735c7c9bde19a
SSDEEP 6144:AkMe/HUtjAy9pQFJSEH7mrqSiCaLCA5O9io/fAi7BPqk1b/2c:Ar00t9QFJSRrzd1V
TLSH
T19664F927F21A9C65F4006937060D9937233B9890729970A6E78D38FB7CFB90DB55B7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\79672e0c-392b-4205-9139-75221a57de76\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\79672e0c-392b-4205-9139-75221a57de76\index-dir\the-real-index
Size 5KB
SHA256 9cb377e03c744077df45327d2eabbb9c0169864bd44d3f49a8425ccd271d9475
MD5 dc60b2f003bbef57b4053c29082b7b12
SHA1 56632c3d72c280fcbaffb187d427bf0e48a8a240
SHA512 c7e51b9e911a8137e9c80bd3b0e82f062f4a79c6d9585c940588f2ca6264c83b781aa2cbafb2297874588e8331f9e06a005515cde0413884be62e625ddc54e69
SSDEEP 96:6+ljBlLOC/5MRI0K9Y64jhtPSlqjJBSfUls7/JvqERg56HOTOg:PtlZyRILJ4jrPSgjClNvqERg5a4
TLSH
T1B7C161CB61C3C535CECF623EC56718AF160B4250EEC56627856C8B69058320D6A7BF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\79672e0c-392b-4205-9139-75221a57de76\index-dir\the-real-index
Size 6KB
SHA256 3819cdd0ab75476d3d5774ccbb00314a575e7cad7b5678947f96cf948e47d909
MD5 273b2a225f3db3046221125803759355
SHA1 f8378fc30ca24d8fb0c5df4887d16ba2a524ef65
SHA512 9facc2b7f46e2f594e85b0ce8d3f8a2788ead83f5eded0c77afb9b5c4160b9499e5734de44ea5b1d4580628fea7fb0b412f4efd95f7a38a86574b2f86c1936a3
SSDEEP 96:FtljBlAnC/0MRQUK9Y64jPu0tLSjqjABSfUlazz/JvqEqg5LHH68Hl:ZtaQHRQrJ4jPu8LSGj/flvqEqg5jTF
TLSH
T1F0E185CF61C2C536CECF263ED92718AF17074690EEC4272785688BB5058324D6A7BB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d954.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\79672e0c-392b-4205-9139-75221a57de76\index-dir\the-real-index~RFe58d954.TMP
Size 48B
SHA256 5c4d3c2cff8696a58ef85a99e65cd78474d33389057abbe926082f18a5486f0a
MD5 a95045e0db087fa97b0f2763dd289aab
SHA1 6600e3bbeae623b8f7952aa32459f141ab1f0f76
SHA512 d43f2acf890d761c751f5ca744b4b70e39bba910b4fe1f846b7b02f34aa0af58ca86537bef4a85bf5da4595ab318fdfd5ca6a675bc2e3607ee337fc88c3e01e9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\eafede16-4b60-433b-a44c-c1a6fc888186\index-dir\the-real-index
Size 1KB
SHA256 bcad7bfac4c76830ba4fe57f3f771b952c9ea9b57a039bd9a7ba20da9ef0774a
MD5 e913c97810bc9890220ef54bceed2d11
SHA1 dc381212b40be6172738df90b81257e433d59160
SHA512 28e639e0846f96d8ff1c07b4346534934821bb82d28213414542c3e9071c68803d62c10094e35981ee400579f86606917e4f498e976e9e8d3a2d6779cb098e7e
TLSH
T16D41954F74004B0FD7CB1D7942654130A728D244359A93AB3817521BEC859E90FD615C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c0b6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\eafede16-4b60-433b-a44c-c1a6fc888186\index-dir\the-real-index~RFe59c0b6.TMP
Size 48B
SHA256 7ddd94fc64339ae3c51ca8d1b42acabae4799acf4dad52474fe5b709908a87a1
MD5 4a4e30dda664ad13d7952b9623e37518
SHA1 9afc223ef2aef2700f07d2942b161f109b991def
SHA512 6bb5ecd26a69387c4cbcd4316eb6a16989391a5ac4d2b988b3a6319846409a97bb83911a86bb207b2a26b934f47c7a6314fcd14258a382b65c72a349b65e3211
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 282B
SHA256 7e5cc91e2b39225f62f4dea51f168172ef65f64e54cd5c1003f7962fda97094d
MD5 88f983da5fbb333c73a37bb989453e4f
SHA1 f593a354f459635533f82e38917e65c50a4fac56
SHA512 91e955ec28406aae0b33f07b2047c5f9c12bfe60d21e0fc1272dfabfe32f13cb656bc29ada2c06c106c9c8a8221595c0e22e544b37eee99625cf30f6712c7e71
TLSH
T148D072A2622D8000737286952020269C8D83F822A6A9602E18041022DBB0848CC0B823
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 395B
SHA256 19090f6b62c477fdbc0b8978b48ebb2ab1cac250a67d899803626125a2f2cbb8
MD5 2d787ea0adc2464dac67d0e29ca528e5
SHA1 2a95c69932ee6dfc7fb6644ac2df262ec95e43ad
SHA512 ce0118cb9a2a081af887e80665631a5d8d413754e787121aae6a8b8bec98509b341b7ab7e23b2d4846aaa49ccce46f966ee8adc7fe28f2f63070cee0e81709d8
TLSH
T1EBE0F1A2114CD50136B38B957022269CCD43F833F7F5506E040148338BB084CCC0BC33
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 496B
SHA256 7f719f898eaf5f591a8ed6f13d8f6751b51d324689e37e2b36111e26c527129a
MD5 36a244647fc0932d9527a27fa947aa98
SHA1 b6cbb1c30e89748a2e285ed89cf815f4046c2102
SHA512 2cc88ca1404766fd56c9a2ba5278dc1d810c9a0d923d6032ddadaf4ff2e6d2170eec371b1253089cc41bebc9082e6bbd60b38baf8357b5c3026e228b1ff6707c
TLSH
T118F09E92515C941036B38B96A066256DCC53F833E6E5516D040059339FB4E49CD0BD37
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 665B
SHA256 20bb0f068d7f36dd188cbc857d4369427e59dbb1804566868f4d92e0e3ffecad
MD5 6b1e549123259ec4ec8ad1a469c4ef3b
SHA1 c4813a1c6a8a8835c7d8f3f8c26945d72cbb24bb
SHA512 ac3033e5d45d28ad4c35bf6c38f9e0031c18eab496651a871aa235167ad0008e80d140103ee2b91a972395ce6a7d3623cbfb544a3e5e68060b81c0bc42b8f6b4
TLSH
T1320102925298C0107673CF9A602E697D9C9BF823EBE9906C0C0425336FE0E48CC07933
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 582B
SHA256 4ef0de4618943cd6f5a9b13c1c8bd69c32739142e596084c31dd3490818daa2f
MD5 3b3c3f1afca22477234120e30748ca67
SHA1 d3e51ca89846dfdc9be5cc46d60aa38e88c40430
SHA512 c7107912beff1ae1351a5ee6eaa97b82fa752c31f4fbecf8dc5276fa212a21e1f8a8a30fa8c1a5bc0cc1cdce0dae89399a3f4be2494576960cc3ed5630168642
TLSH
T1F9F0E182929CC0103A73CF96602E24BD9C93F433EAE5505C080015335F60E08CC07937
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 664B
SHA256 6c2099fe7fb7ba2ded83551e0ee8ff8aab933df8047f9d7771d65be95eb83448
MD5 b7c01ec9a87d897632b7d480477e1566
SHA1 d2bc975145d81feb2bb40803e6bcf2e0754c6c46
SHA512 f69f20c55b74db346e4cc13664305782bcd17c18567c83bbb8651476e2640b4d210a3666ec2ccb18da2c997e18b4f24e857c90df9a2e9138f8002a618dd824cd
TLSH
T19C010CE292ACC0107AB3CF9A602E29BD9C97F463EAE9902C0C0406335FC5E48CC47933
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 660B
SHA256 63e69b5a7268929fb632ffaebd16457031e1393898ec3e230aa50eb57d0e62fe
MD5 b75deacf3e21f20ed1569ca32a25fb71
SHA1 50ad4a8c346a36edcae92af5dcf593e03fb2e447
SHA512 97d5f0fba4ac8b4d94b6aad86dda787ab0f1a04d40f5941717dfccf39c8da23b33536208b565bd2a7d66c0e199efd4a1a6d263ddbf109b8af69b744a2a945542
TLSH
T13301A2925298C4107673CF9A742E257D9C97F063EAFA506C1C0845335FC4E55CC57937
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587c40.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt~RFe587c40.TMP
Size 169B
SHA256 495cd0d8edd263bad2bfe63f4c8f3788043c7f5accb11b33cfe1e0cbea7d12c9
MD5 5b71e87caff0b661c4c2c5b49970e9bb
SHA1 b32382b29d5c275c9495cfcd8c959f5c497dc93b
SHA512 02d66a9d967988630411c39f4e14948bc34c2c882bfddc66e18ca11c0fbc057c51f215bd38fdcccf0597ced3578dee673a1a139ff73d2a64ea2878cfcfecd9d0
TLSH
T151C08CB7932D80103B6206B2A0A1BBCEDE17FC75E7E1A50A18122023E2708495D6AA37
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 213KB
SHA256 5e843cf9628be773dded3c3f0f5520ce62a8f8479cd71653eb70d3cf390f4158
MD5 b7fb2177024150075c0f94ee8ebcea1c
SHA1 7b81da1d62b37010ecf33852fb0890e9b078c192
SHA512 d9d92b507fac1bdf3e6e8e4b1138ab388684aabe4f12be7330101fb30be5c8e0d86ff68e487caf21f3d57be1a258c4b770c62e2c0150501c7d226b7d5fc86457
SSDEEP 6144:yWNACh1l26lysf3Fj2UQqR90ltu0nzalCCd8kdTFtyQkJC:yWNACh1l9Rultu6zaQCdh7kQ
TLSH
T1B8246B817261223243D161F460360907A339A96C764A84BCFA7CDEDF2CAE944767FF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 927352dfc6072fa1a056ca31144f21e74730c77077457720b12fc5c049ac1707
MD5 2955fd43779763aa029dac76e7adebbc
SHA1 c78aa84bb4d870c75039122d9296f7defa291771
SHA512 d55e7c48930ad5ef7d189c3b3e14447ab65660db023b2bfb52c28ec85fd93b41c1cf73c3e22bbc499599c6dfc4d34582a6105861fa11b46a6c30900243e31b71
TLSH
T18DB0120080C66D2ACC4046B41148604922814E268400F20792E0E68588430F18110101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 d472b27ca80d2dc66b0d22426f124746bacc258f142fa4e74f9cf7e66b7ddefe
MD5 6b7937cf7495a3b6219cfb20cc2e4d6d
SHA1 cd6f29b2aba3f46180fe992c089f0d5b6e5f361b
SHA512 f64733afd60d75a547e0acea210ec56e827175f566493fba32559beb5d42ffd11d0ae52de8712985ffc23151b1e222c97e73b0b28af5c77a245a38a81299df34
TLSH
T12FA0021D69C05D1DC9984274178311C633AC49206341A34764A000449D6EE468A52281
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2fc532ffbfb93d94995cf22833ec94714584ded4f24af6431c64df0052401b44
MD5 a03b3ebc56c0de85bbacd3faf1449daf
SHA1 4ebe675372cafd59326ae29d82e464fb1e49b064
SHA512 cd9d8da84315d3c8509796358c72eca7ae9f1caaac222630218c6cabb106678163c5656915e1b78c5a1e8e745160cf036cd65347a89702a5ee01c0123d3afafd
TLSH
T1C1A0023143C0982ACD04427466AF068267D349782791630355D314D5DC7B6D04107661
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 cccd182aaf546f5035a1b224daf5cea04d59dbdd1cee891f32e0ca3b856907a0
MD5 070c3de9e03f1a98e836c2dfacd7e61d
SHA1 7a958e06dd766b3290b823e888d1dbdabb9d6aa3
SHA512 d4bf5f1be0a26afd2f51c4899cdee362bbb0c4594e3676806f2562b07f0bf70a447c78fa7077ce4b560c755db4e7971d318c91a158b9fcae4aadf774b7f152ea
SSDEEP 6144:AjbG6/vkx6N4WXiyF0iWx8Gm7Rkm1tYpBeh2BAoB:Ukxsre8x9oBGcAoB
TLSH
T17D34233B8D6674FA2895B72F61CF1E1B2FB15F228594D942C0D09F443BDB5C86609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b6655659e57c16f58a649d1191591083956bbd0ac75204811ccac73b971e067a
MD5 5fc3e11bec7da7c3d6b61e1937c5dac8
SHA1 e8beeb6ce94905200c66f2beeb0e6e7f36c9d72e
SHA512 fc04d10db155bdda410b9783c255c19acb6e636e3a6517963ce1959cd9a0e1672fb9f678f72b05b566b13bfc540138dc028935a3852b387558d5d7929799d757
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:qm7Rkm1tYpBeh2BAom
TLSH
T1FFC3123B5E70E9765979A74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 cf8f74190b1dfde28e1a7fe2ceb90002f67b8ef5c74b158ac0b23fb062e3b850
MD5 d51ec4d5893af0f84d1cbcf767aa9240
SHA1 580a72b67ddb47f8d4bf09145ff6faeb64e109f8
SHA512 e44590fa8f6ea852c543df11ef6fb3c31021570476eeed986ca4d70f2e6c0065891e957fb352d671c5888e8a173b0c5b4dfeea7f1527ddf3b2baa154752ede0d
SSDEEP 6144:E7bG6/vkx6N4WXiyF0iWx8Gm7Rkm1tYpBeh2BAoB:ukxsre8x9oBGcAoB
TLSH
T18A34123B4D66B4F728A6B72E718B1F1A2EB15F23C954CD41C4D09E047BDE5C8AA09E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 416900402af5db2e25bb682245410dd1c64d8458118a57a1a6a0d345308d83e6
MD5 cb50e445c867dd567172686fd89c778f
SHA1 62dbfb74828ac674915e0b27fba607353a7d0519
SHA512 d490f8060a7af4666ddc4f4d82e021d09ccd618cfc3d171262b336d01e0e3f29860de444dbaab12b44755d815ac15c049ad28b94974186ea48314ac2697388d6
SSDEEP 6144:VjbG6/vkx6N4WXiyF0iWx8Gm7Rkm1tYpBeh2BAoB:Pkxsre8x9oBGcAoB
TLSH
T1A034233B8D66B4FA2895B72F61CF1E1B2FB15F228594D942C0D09F443BDB5C86609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XGEN_FULL_REPORT_20260522_152026.txt

Path C:\Users\Admin\AppData\Local\Temp\XGEN\XGEN_FULL_REPORT_20260522_152026.txt
Size 4KB
SHA256 41f4d1edfdb717b5c055d59ff8c98d3248acd401a844d6238f06320b9733ebcb
MD5 c321471c62e3ba424fab06a57b481a4b
SHA1 062d36ff8506b859763a74bf293aad696d095a05
SHA512 21d5d12d8e18bbcfae27e281748ae68ae674c3a331ddaf01934138f76d9ac1b82f36884dbda7975134bf688f45af754743f4f84bc76cd46234b00fca6e78637a
SSDEEP 48:7WR1+AUBT8bXbgvyxRxxEaxEx5hvYjsMEmCs:6v+D2bLsyx3xEaxEx5+/
TLSH
T110A1DE3346994C4A3384EC6E88302EB88596F829F1865251741C39DA3FFD978FE5863B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XGEN_FULL_REPORT_20260522_152029.txt

Path C:\Users\Admin\AppData\Local\Temp\XGEN\XGEN_FULL_REPORT_20260522_152029.txt
Size 4KB
SHA256 c740a04a8423c53a6f6e0c16f94fbf40ddef9106b6e470a7f332c5ca2c778c73
MD5 c64b5ee214547fe30fa3743173b8df81
SHA1 8bebbe209010b3562118a6c8c22ae9ebfb2f80a3
SHA512 c6bbe6c5538d45a2fdaaa3ceea2b2123df3799212aef4926d3304a00bfbd64b1291f32fc9a7b722554100217d63d9904078276154b14af7ef1e510639b65ff50
SSDEEP 48:7WR6+AUBT8FXbgvyxRxxEaxEx5hvYjsMEmCs:6Y+D2FLsyx3xEaxEx5+/
TLSH
T1EDA1DC3346994C4A3384EC6EC8302EB88696F829F1865251741C34DA3FFD978FE5863B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_asyncio.pyd
Size 76KB
SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
MD5 c2a29938ef6730c1418140a15e0cea86
SHA1 e137c778526eb34068c0d85fd37d30b81773013b
SHA512 3f5b212f005b944d872fd3e84a68d1de11809143312571d6540db9cb219c4e9f62137f90af77a81b7b342d8d1665c819b6738dce7a5be1e0d6a135564ae69043
SSDEEP 768:J3yo/J0GKLIsPwpVnU+C4qMiOU1OnzM8nV6JQIjDnSSyYTegc2Ip4YTxf1ml6Z+o:VJyyUoCgQ8nVYQIjDnSSyYiS9kfILpm
TLSH
T1B5737C87A2A44186EEB79174CA536FC3FBB1F1859901935F51A4C18F1F533A18FBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_multiprocessing.pyd
Size 37KB
SHA256 a8c15ee29f60536e00fd7c26c0315e062c4f018e2e46e7f6eb65c1fed0d886a4
MD5 547b59dc1f6caef6706ca1129b5f9618
SHA1 b990f779204ddebcc00ab926be6c17b462fb3a63
SHA512 00f49b94a31b8dca6790845e0185b7f7cecb52fa99472bac523cc8ee4efb679585e3476c727e55b43f2b434ed12af51c41364113db89f0f98113be24ab2ab2a6
SSDEEP 768:HFMV/fpXybycUlgIj7teyYTegc2Ip4u+Txf1mlIJ5pC/:HWpXybycKgIj7teyYiS9uefIk5S
TLSH
T1BD038C86A6684053E9639670C5A3EE87F935F7871F22865F3195C2CE0E373C1736A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_overlapped.pyd
Size 56KB
SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
MD5 c96e86f3868d0323c88700f0671d9f20
SHA1 c8b9561fb80af89a67fbac11e103ef120dca4ce4
SHA512 d6953e6e566236f2bd01e40de751e545b680607ad07c8c7f7b8ac621f4c1ed3a227ac14cc45e66e15a0a1f18083ee4aebbacb24b784ced35bd227173b6b41d16
SSDEEP 1536:/sjKfS6rBgq/Wtg4urMp8IjCtDyYiS9ZfIklp:0tgxrMp8IjCtOK
TLSH
T1D6437B4A6B9401DBEE73D179D1A38E03FB74B2D34601931F61A8D28A1F23791A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_sqlite3.pyd
Size 129KB
SHA256 e33fd2ccfd0bd878d50f5c093a56e324ad146e03ebd47e4dc81d6c833badedbe
MD5 496bcb38dfab712fb80cac66c6887ccc
SHA1 7e397c4ab43494d0c31c90ed083003b3e8879229
SHA512 451bd1c463ad2df3f79c17c65783cd4bc12942cb34b8eea4e2e49074de98cb2bcfcc62f9f469f31eb6e9547b0b2b9421e3b752a62fd94a743614929e9f7b6ea9
SSDEEP 3072:A03Q9hZQUVCIZZTPIzCNcC56+VWyZTPhAS6zQIjDQV3d:A03iTTzD5dtT+S6z4
TLSH
T1D6D37C6B631800A6F9B782B8C5B34613EB74F4615B2053DF51A0C24A1F377D66F3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_uuid.pyd
Size 27KB
SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
MD5 ba74524f8ff1494fa556dbdaa23f2f80
SHA1 173ae2ea0790d959b89d5ced201c6656ed5df3f6
SHA512 3c4b5621c97549b9df454970199b14948b4354fb934b5a0ee85d2d475eaece03c575c13548fca052e3b1cfad7c95e4cb8d4cacbf9d7fd09c64e0a3fa6f420c19
SSDEEP 768:vfi15c4IjIwyyYTegc2Ip4dftTxf1ml6Z+7EWNg7c:ni15c4IjIwyyYiS9NHfILlj
TLSH
T148D25C869A788047FA5396B0D1F2DE83F939BBD35A11875B2179C2850E533C1B32B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_wmi.pyd
Size 39KB
SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
MD5 bca71458b37ab9784290593636006405
SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
TLSH
T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\base_library.zip
Size 1.3MB
SHA256 77b380a908adc8436971c8e2c2e5b024618adefefed4a568aaa9849ae348b4a6
MD5 85bc50b80d17441bbd04b9bef52f9ce8
SHA1 3687522bc8e6f1e6b8376ec024aa701482546294
SHA512 88a625f7963a7a7019e7b461ad8993b8dc3f450d46f1283c52fde5e4df473d69c567a145453c255fefd3b7eb66e0a64d7a855796a9c0014519a49330b6795962
SSDEEP 24576:5lbeRpVdl39ALOQeOdP2m2dfepPEPuUF4u:+R/dl3D/2iuUFf
TLSH
T1A3552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\pyexpat.pyd
Size 214KB
SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
MD5 d6e692eacc35a0195bda97cef2345c18
SHA1 f010bc356b81149c390dea898eef59e6600de198
SHA512 ef2c9a33a0cb15f7673af716099b0735550a111d056422102ba6102618f1e9aa8c2d91a6cf0fd9eca03c3b6d0f0855a7807144585fc58ef08d13a6b27f6ace42
SSDEEP 3072:O3qcWGiB96M+1+XyXu1w2wiMuUL4blSA+gq9qUSGAoP4lSTmyBt3cBFN2X1JcGGz:lGiBK1+XyXu1GL4blSA+gqLt6yz3GnWs
TLSH
T17B247D9BB261C1E7D853803CE5968B17DAB1F86603909ACF12C4E77C9F2B7513B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\sqlite3.dll
Size 1.5MB
SHA256 cb9676d3b9aeae83a63da5903add3fe4f17ed2e26e7e01a4f1877c4fcdeee99d
MD5 1b9052f68ad1fe512e34712690656b4b
SHA1 78d92fe4315f95fbde335c43f36954cc08bb5b95
SHA512 933ad9b361663bd8ecbc357d3aae5eed6cb815dc2dc4ece88283f9259269d200b397fa9f5b5510cea2cd90bdc77ce7d7e1dbc43a3c25efe5603bec7114641072
SSDEEP 24576:vDKX0pwDaOrROsxNkJPcG/ZBZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fnX3k:b8pOsxNkJPcGxDQuWRP+bZ6Icf4vC1fk
TLSH
T1A5759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7CF1594CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI82\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7095af26-b971-4e40-86da-f39e5a878263.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3312_1727993043\7095af26-b971-4e40-86da-f39e5a878263.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3312_1727993043\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

XGEN_Stealer (1).exe

Path C:\Users\Admin\Downloads\XGEN_Stealer (1).exe
Size 13.7MB
SHA256 397c3e63a61b75b8dc9ec21024aec1de55f254e7d8d58e0c6f19903e60288a36
MD5 1381bcee7205fa2cce86f54b84fb471d
SHA1 1acd68419dd950040fa2109e29bd7918a53e447a
SHA512 3dcc7384249a4364055b10856e7629141ca6362e5719a0adbf0f5ca33d3b06ccfd494c2c3599e9a365673d691992be3e95d48154e8175585d42b52f677717d4a
SSDEEP 393216:kKCrSLKRHrNtZq5XN86A+7EHsxtEDweBQM1lt9:GrS0rNtZq593AOWwt7eWO
TLSH
T145E6335596C10C97E8D3A13D9DB2C162E2E2B6602B718DFF1B85133A3F77590483EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5ca1148-a843-4ccc-9b31-d90252aeaf01.tmp

Path C:\Users\Admin\Downloads\b5ca1148-a843-4ccc-9b31-d90252aeaf01.tmp
Size 64KB
SHA256 a1e41d92f413bb9a0d8706c40537cffdf80962e9e248da48c6101c919c336eb4
MD5 696a4427675c7357e4b7554853c74c77
SHA1 19e4ede41811ecd64c7c9306e4f358c0cdd41ea6
SHA512 9dd6140d04db64f760163f7a28540e612964f7d9dd812a554dab80ec3c70e94ae0e6531060a1ce0f6f2521ec9863be0683eb41e50145af3421a5eb6e75274470
SSDEEP 768:jhJGRJAVTf56fS5oun4OVeWXwrWbQMY169vUFmJ/XC5sy09EBfDpaaF1vVKbbhhm:jhJGRJA1aJun9Ve9uvusyDZpaKwTnUj
TLSH
T18B535B4D67E511B8F667D23CC983E16BF7A1B063572489EB5B708AA10F33BE16030369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download