52973e9ea6f83f0ac02606c82259591e1b69e8a04c93eb685c1b0b17d77eadd0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
Size 3.4MB
Sample260601-e7p48act7v
SHA256 52973e9ea6f83f0ac02606c82259591e1b69e8a04c93eb685c1b0b17d77eadd0
MD5 984619a5bc7e25f424a62e204130a3c8
SHA1 f7052989bfd53766867cc743fd2a453ade0dabc9
SHA512 f4f7df28a64b24810c5b4697e06ba0a04c76e626683e94133f0dcb847caedaf19aedcc46e4758b5be5fb61a348d3f1e873968fbdcb98af32341f50d4d46157db
SSDEEP 49152:H1gxn3ar2vWv7S/w2cFUFFgOxUjwrifdysdnpJfjZjFN:W3a8WvOF/KfdyO/fjZj
TLSH
T143F52943E79600E5D5BBC175CE169227BB71385807F1A7A772805AD22FB2FB07A2D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247621213805034"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
3824	chrome.exe
3824	chrome.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
3824	chrome.exe
3824	chrome.exe
1204	chrome.exe
1204	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2232	wmic.exe
Token: SeSecurityPrivilege	2232	wmic.exe
Token: SeTakeOwnershipPrivilege	2232	wmic.exe
Token: SeLoadDriverPrivilege	2232	wmic.exe
Token: SeSystemProfilePrivilege	2232	wmic.exe
Token: SeSystemtimePrivilege	2232	wmic.exe
Token: SeProfSingleProcessPrivilege	2232	wmic.exe
Token: SeIncBasePriorityPrivilege	2232	wmic.exe
Token: SeCreatePagefilePrivilege	2232	wmic.exe
Token: SeBackupPrivilege	2232	wmic.exe
Token: SeRestorePrivilege	2232	wmic.exe
Token: SeShutdownPrivilege	2232	wmic.exe
Token: SeDebugPrivilege	2232	wmic.exe
Token: SeSystemEnvironmentPrivilege	2232	wmic.exe
Token: SeRemoteShutdownPrivilege	2232	wmic.exe
Token: SeUndockPrivilege	2232	wmic.exe
Token: SeManageVolumePrivilege	2232	wmic.exe
Token: 33	2232	wmic.exe
Token: 34	2232	wmic.exe
Token: 35	2232	wmic.exe
Token: 36	2232	wmic.exe
Token: SeIncreaseQuotaPrivilege	2232	wmic.exe
Token: SeSecurityPrivilege	2232	wmic.exe
Token: SeTakeOwnershipPrivilege	2232	wmic.exe
Token: SeLoadDriverPrivilege	2232	wmic.exe
Token: SeSystemProfilePrivilege	2232	wmic.exe
Token: SeSystemtimePrivilege	2232	wmic.exe
Token: SeProfSingleProcessPrivilege	2232	wmic.exe
Token: SeIncBasePriorityPrivilege	2232	wmic.exe
Token: SeCreatePagefilePrivilege	2232	wmic.exe
Token: SeBackupPrivilege	2232	wmic.exe
Token: SeRestorePrivilege	2232	wmic.exe
Token: SeShutdownPrivilege	2232	wmic.exe
Token: SeDebugPrivilege	2232	wmic.exe
Token: SeSystemEnvironmentPrivilege	2232	wmic.exe
Token: SeRemoteShutdownPrivilege	2232	wmic.exe
Token: SeUndockPrivilege	2232	wmic.exe
Token: SeManageVolumePrivilege	2232	wmic.exe
Token: 33	2232	wmic.exe
Token: 34	2232	wmic.exe
Token: 35	2232	wmic.exe
Token: 36	2232	wmic.exe
Token: SeIncreaseQuotaPrivilege	1652	wmic.exe
Token: SeSecurityPrivilege	1652	wmic.exe
Token: SeTakeOwnershipPrivilege	1652	wmic.exe
Token: SeLoadDriverPrivilege	1652	wmic.exe
Token: SeSystemProfilePrivilege	1652	wmic.exe
Token: SeSystemtimePrivilege	1652	wmic.exe
Token: SeProfSingleProcessPrivilege	1652	wmic.exe
Token: SeIncBasePriorityPrivilege	1652	wmic.exe
Token: SeCreatePagefilePrivilege	1652	wmic.exe
Token: SeBackupPrivilege	1652	wmic.exe
Token: SeRestorePrivilege	1652	wmic.exe
Token: SeShutdownPrivilege	1652	wmic.exe
Token: SeDebugPrivilege	1652	wmic.exe
Token: SeSystemEnvironmentPrivilege	1652	wmic.exe
Token: SeRemoteShutdownPrivilege	1652	wmic.exe
Token: SeUndockPrivilege	1652	wmic.exe
Token: SeManageVolumePrivilege	1652	wmic.exe
Token: 33	1652	wmic.exe
Token: 34	1652	wmic.exe
Token: 35	1652	wmic.exe
Token: 36	1652	wmic.exe
Token: SeIncreaseQuotaPrivilege	1652	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2232	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	93
PID 1068 wrote to memory of 1652	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	95
PID 1068 wrote to memory of 1348	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	97
PID 1068 wrote to memory of 3380	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	99
PID 1068 wrote to memory of 3404	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	101
PID 1068 wrote to memory of 3824	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	103
PID 3824 wrote to memory of 3360	3824	chrome.exe	104
PID 3824 wrote to memory of 3428	3824	chrome.exe	108
PID 3824 wrote to memory of 3220	3824	chrome.exe	109
PID 3824 wrote to memory of 3220	3824	chrome.exe	109
PID 3824 wrote to memory of 1572	3824	chrome.exe	110
PID 3824 wrote to memory of 1572	3824	chrome.exe	110
PID 3824 wrote to memory of 3896	3824	chrome.exe	113
PID 3824 wrote to memory of 3896	3824	chrome.exe	113
PID 3824 wrote to memory of 4264	3824	chrome.exe	112
PID 3824 wrote to memory of 4264	3824	chrome.exe	112
PID 3824 wrote to memory of 2524	3824	chrome.exe	114
PID 3824 wrote to memory of 2524	3824	chrome.exe	114
PID 3824 wrote to memory of 3928	3824	chrome.exe	115
PID 3824 wrote to memory of 3928	3824	chrome.exe	115
PID 1068 wrote to memory of 3824	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	103
PID 3824 wrote to memory of 220	3824	chrome.exe	116
PID 1068 wrote to memory of 3360	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	104
PID 1068 wrote to memory of 3428	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	108
PID 1068 wrote to memory of 3220	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	109
PID 1068 wrote to memory of 1572	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	110
PID 1068 wrote to memory of 4264	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	112
PID 1068 wrote to memory of 3896	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	113
PID 1068 wrote to memory of 2524	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	114
PID 1068 wrote to memory of 3928	1068	2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe	115
PID 3824 wrote to memory of 4192	3824	chrome.exe	129
PID 3824 wrote to memory of 4620	3824	chrome.exe	130
PID 3824 wrote to memory of 1120	3824	chrome.exe	131
PID 3824 wrote to memory of 1204	3824	chrome.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_984619a5bc7e25f424a62e204130a3c8_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" nic where (NetConnectionStatus=2) get MACAddress
  2⤵
  PID:1348
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get ProcessorId
  2⤵
  PID:3380
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get UUID
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff810c7c728,0x7ff810c7c734,0x7ff810c7c740
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3980785914788747383,1012238317193450152,524288 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,13803867691273049498,6291009019258490723,262144 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,10777323700947690589,12937290498268610406,524288 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,17750716555736150648,3644201466293016937,2097152 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,11021577826479966958,1018839770594916621,2097152 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4140,i,11011436702728433072,5466888023411758668,2097152 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4148 /prefetch:2
    3⤵
    PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,1393856835905760102,5199947449153606382,2097152 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,14620777563635412926,8511066331189747794,524288 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,7490880889440535869,7682982518557368377,524288 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5660 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,14633754367166588764,14806322759007930054,524288 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,8963483347414701539,6206848881097544092,524288 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:1120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4160,i,17217063635476778372,476625486486132477,262144 --field-trial-handle=2096,i,17488718876182267818,6325465256701982783,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9fe33bc46e0b18f5b042a5492581c7edfc847a135511b491caa287eb3d521df3
MD5 478dd4b701a5dcd61db8cf3315376ada
SHA1 92666aef038f2404bdf87db84862716d38a34c90
SHA512 66f980bfbd6ec8605ece2c8a9dcb1f0e7d56e5394017f5ecba066566bf7c6b1c930b78e2c572e5a13e07f7a3f327460685c7c5d11c05b8012b9cca581f26f9c5
TLSH
T18EF0F4B5C922AC3718FC172874A5470AEB9123673781985F7B3D920C4FB463B868685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f3990043d16a72d517f6ccc4a61144ff66a354ad52ce188d74f4ee2f8312d846
MD5 6860fbdf3bcff73372116e1ea5057b61
SHA1 f37bd0417c1b68dc6f93d279c76606c81c327506
SHA512 9b0ffe87a921aea310a7318be9477e40de9a1c790c5d20c7d6910bc1c3d2062dcc372b3b663225c3a669298e86274704f567ecdc5fdec6ed277f052732b887dd
TLSH
T19F5169B7D3D8CA7DC91592E4AB216E1BCD290A14532C3C56C8D8AF4B53E28B2D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 42f84dc34cb6a00e84ca118f0c14d6f33b6d0b9c6ae75c80ad6b772903ec5d10
MD5 6ffb635831721904ee528f6318452c03
SHA1 ac5abdfc183cd81e3b0595f16343427d2e97a09a
SHA512 da4888277b3fa2ed75f6928f4dd7938d01a3e12eca1288bd9f9d1dce4b24abef118b36b850409b3b1c0d19eb01f78bc93174e77fb9400495765c48f000e6fd33
SSDEEP 192:XR7ZjG623nYVu0ucv7MF+pAPRp2S9HHsb+WNn2d0xtlkwAAVyIsnAUgtaJ:XR7ZhVSIgoUX91wg0Rx8
TLSH
T17C42C52EBD15697B6CCBD229FE267B13D3F5102121D42E84EAFD8A1C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3570494bc804cafc291193ec250d6c27cd1cbc855e774e33cf93320155c31065
MD5 c4b5a85c23c9b20fd6e4c42c8ee47359
SHA1 d28b161161b4ea6c555e6dda406cf737972287ce
SHA512 150bece3ff603a8d2c41084a9868d044f2be6b15c1b6e943d54a69016b5dbe590b3e021334049c3481bf077b3191e9f36963b6d5f4ba96f2f8791f37a1a47a63
SSDEEP 192:XR7ZVG623nYVu0ucv7MF+pQPRpyS9HHsb+WNn2d0ptlkwAWVyIsnAUgraJ:XR7ZbVSIgo0Xx1wg0pxe
TLSH
T19042B52EAD15697B6CDBE229FA167F53D3F5202121D02E84EAFC8A1C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e9e65a36229a8762776ff6ace6eb91a2313786a26df180192232d458a9fed3d9
MD5 4f643f36add7c7ea893558dd6994d961
SHA1 6d9e49a5d79913bf80a8121c3aa8db86bdfc9702
SHA512 0a93768b59f840f0ef9a44201d18c552f0c83d10d30c355def63eff573e3879cbf7d12922ca9a48f1b43d29fa8c5cb175376d83699fe4914bbb88983ab87c53d
TLSH
T17EB01241C0029111C45203F012421488F1547F10A70B270143F06923D8291739118090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f2e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f2e.TMP
Size 120B
SHA256 ac234a533815a108d2c4c712078e34a43f80c2e640a9daf65e67ad58bc258e8f
MD5 b5b21112fabac239e9c4f2c6176e9107
SHA1 84c7d727fc2727cb61d39724bf35650500d8ac2d
SHA512 9be5f2cf84e2a1248b9aa55c502be43d366e8cc133c2320bdd5ea9e6bb08377772e1ee7928e6750fc7295cf177ae41b12dee142cbcad7bf52ab421b64c27d66e
TLSH
T171B01227C081A161C06103721940848C3014FF21CA03030371F0072398393A00114140
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 9052babd8a1ff0385682ec50954f15d4ee8f7334d2ef89bee7c64c924dd0c488
MD5 25b6a7e746fa659bc08cc87426e0c5ee
SHA1 224a14beb1b8a3c80cda9e76dbfe8a33f16f1d02
SHA512 2c4a47a4afa6a9e23b0c59def66d9dcadf113d9931c15a3902269b487f67e4b8704e610d96f8c81bfd4b2bf8711ea82aa0181688a5234d67d5937ad4543b0b8a
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkGmVumB3na:1nbZeMrv/hGtkGIna
TLSH
T16BD3884B3A747002DDE59A722CE050BB5D3CB16D4F51A5D438B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 c7281e62aaa540ad09eaeafd599a0f9dd9b88f9a6f46f5fc9df9577e8d448c78
MD5 196fdabb37fcdb43e94c990982f1f3a2
SHA1 57965f67ab57dc9bdacd006146de49a8d44927c2
SHA512 dd783f42ba7c9f46bf75f45907e68e9afd3a8175640be0185664618b4c567484a3a04b28f690e7062e33a96ee163b36cbea0b966bcf8b6e1d7e74dec822d2242
SSDEEP 6144:xaVFm4vCuuwbzIUqSs1qKlm7Rkm1tYpBeh2BAot:xa2zwbzIUfIM9oBGcAot
TLSH
T16734233BEEEFDDB655B82569604E054B2DE083838A216E46C8C65F057BFA7C84E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 d20bef302bd00d991b6b99bd275931392506b71de4c037fb310a40d06d0c53be
MD5 ee12e1bb4dece328fc0ba44aeb11aa7c
SHA1 7cfed4f009c0652f21b10b57039a352e7c245f6e
SHA512 a66ba96d7a3407c657a7c62088f35cd6612a1564169a04cb8abd2537a3088e0d6e189533d99cdbc2c9912f91ffe6ba69cc34c58babd0a589c601d2413cc48a95
SSDEEP 6144:xfbVFm4vCuuwbzIUqSs1qKlm7Rkm1tYpBeh2BAot:xz2zwbzIUfIM9oBGcAot
TLSH
T1CE34233BEEEF9CB555B46569604E150A2DE0D783CA20AD4AC8C61F057BFF6888E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 db2fc8923c36069f0e3415810b7793bde508db8721511905873d7bacd6845bbe
MD5 c868e7f6830b14a6b647d414c1847e1f
SHA1 680494e3f14b843726a2b97dcb902f5ba3926cbe
SHA512 8bc93c9549442f2c1e7947845b792bf7db19307f5dbbf5417cf4136e9c60c57caa493fee7f1820f68172e9e8d84d80912e70df639d73dc23f6526df428f1c143
SSDEEP 3072:/7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/im7Rkm1tYpBeh2BAoM
TLSH
T195C312275E75A83758B9BB4EB08E0B1F1EF14AA6C830DA92C8D85B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 7e32b5868a1f0cdfab655ff74d0311b2331d28136e570432473acd23f26c4109
MD5 cd40ca8144c76fe68a4b1fec022439cf
SHA1 14f03d1864fb26b47dcdbf3722fce9d11c13a977
SHA512 d4ea86f7e1c780bba7720ce66642026f4afabe5f5dd870ecb6b0d2d389c3741197951c5fe508f30f23e3d45839d2bfdbe388705957b3ee1142198d6d5cc617b7
SSDEEP 6144:saVFm4vCuuwbzIUqSs1qKlm7Rkm1tYpBeh2BAot:sa2zwbzIUfIM9oBGcAot
TLSH
T15534233BEEEFDDB555B82569604E054B2DE083838A216E46C8C65F057BFA7C84E4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_downloads

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\temp_downloads
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_downloads

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\temp_downloads
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddGrant.txt

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\AddGrant.txt
Size 207KB
SHA256 cb48b78af6aa4f60d36f1cf5ba7e2b2fc69b8914532fcc063046f3eaa3adbba2
MD5 d1682e2389bcb99c6fa98c2388a281c9
SHA1 24a99ce1df832382f32e1fd310bca1a2e84fb12b
SHA512 91d929b5f2b12a61669d680ebc32e8b53802b516254b1d58c229136f980edaa30f3c07ca0ba49667ee914e376c88236d2e7f277b8bd1257fc66d0c884b17219b
SSDEEP 3072:PozD3Qkh1uJ9u8eUX+S78DYeimq052Jv0/DiVcYrPWWHflVis5G+Y6WMSj35HRY:gzkJ9Ru82YePU07iV3WWXW55H2
TLSH
T1F424235B8194345B5A809DF1BA5C54A21EE748ECDD1D4A24EED3ED2FF58839C08E0BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockSubmit.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\BlockSubmit.xlsx
Size 10KB
SHA256 dd5f81a1c2e15b5a36a81240b265bcb4bcf4bc16c041886e3e15615ee761553c
MD5 08565f8e36889e90818114264eae35ca
SHA1 6543c62346f6322ef8d5a03e9c8b635827927702
SHA512 7e322ab380ead2d561021656351d05b758909addeac909240bc8d33435f431b404c5ddd843ccfb85b415b51ceca80b628a158cfaf3e29e3efe7284a9ad520143
SSDEEP 192:wc8mVed8lHgCb3UydW/qIfaFUlbVvevUqzQXpS0UqqSHPf/ao11:wc3j13zd0UUlM9z6p51vf/ao11
TLSH
T114228E59E5778569C23B8CBCC51A40EAB58D20540B5B728A7855F02F17813D723AF3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToInstall.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\ConvertToInstall.docx
Size 15KB
SHA256 07c814768112769a8a75b5cd461d9a0f06d4790732d92061f3d7603f8a190534
MD5 a461b36feb7d2f1478a29e188c2da3ea
SHA1 1c13d5c36d3d2ae81b6d744582a5e3966ca58610
SHA512 5f72c394df5aa95880f7a6331fbc2339561a693aa9d382e48000e74361cc28073201bb671f3846f4ffc2bb6d3cda60349907a191d0464dfe55c1b5e372497c6e
SSDEEP 384:ahEWxmO80D6dx91dNxt/ZtNNvz0IFHRRMIt:ADE30U3xllNvwItReY
TLSH
T16E62BF78D649A820C643433D705A63F7F50C5B83AB07D1CF718BA59EC323697231A496
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenySkip.pdf

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\DenySkip.pdf
Size 2.8MB
SHA256 8508ff9ca5a2faa6a3557bc7384a3ebfaf3251efa00975cf531dc037f9124038
MD5 a2fd7e9491a3607698a014561ad22456
SHA1 a5cd9a8affe81ca5b66023437eb1be4214d54c4f
SHA512 e25511aba460f00f2a497909947185346eb116c668c28ee1741cabfe2ef512cab506f303253475ae8fd3cef7771b07d9b3a5c1800f23104a6f4a1246ce3529f5
SSDEEP 49152:koeVB71w4wBaXctVJCZSjKUMoH/JhWfLCLBOlI9xQ7vAcOoZqtcmalpO0+mX0:kosRw5aXctVJ4YK8H/PSLKOloxEAwZDS
TLSH
T19BD533E4108A68869031FA52C99CF2D93E3DFC33BF8EF51A9B0751C2C8472B575A4697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatConvertTo.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\FormatConvertTo.docx
Size 13KB
SHA256 e751f5040232c759a62a3a37b37e0d475794b78ee8ae89cf201ad94f171c485d
MD5 ff65c5adca19f033677a08fa416eb401
SHA1 c6e3181322f108830323f9911fdc7e26e034eef9
SHA512 e2e78eb61845e40c5237bc525780c10a36b27b06be1357452f17cb0faf2454fa7261a48176d439627b909dcdb2b98148776d29770ffaf9513f98034d5f58769c
SSDEEP 384:aJiPWdaHtdNxt/ZtNNRpWkSsIFHRgA1zm:DPWktxllNykSsItR5q
TLSH
T1BD52A078DA429424EA73C778B06E23FBD20812427756A047614E79DF4751FD6131398F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportDismount.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\ImportDismount.xlsx
Size 12KB
SHA256 cd153a256c637a78bcef49d2394ce2d018913e3a3f846a1882aa1df528ff3016
MD5 c2e571be04666a99f8020585f22fb5b9
SHA1 5e3c90533d9a64c4b7036dc9c35c1f94d01c4f67
SHA512 0227d80e7444c77c9fd03c9bc022ded731c4081a726d780f693575a70f8b85a4a59d928dd59af42291e25e3b7325e540db23b86b4e0dc6a27dfbe17db0896ed8
SSDEEP 192:wc8mVqL0ANb3UXtbp3FPss3sr1u5WKaFUlbVvevUqzQXpS0gsPBdC4WT1o/+clAT:wc3ox93a5MUlM9z6pTZg447cO8F6Raod
TLSH
T17E429E166232E178D167CD7FC15F01F5AB6D138057176805EC21FC1A968B0A70B9F2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingTest.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\PingTest.xlsx
Size 1.3MB
SHA256 e6f4ed1531e5530dc07a093d0816df5e363d980333f9eb0023c22f25d731e345
MD5 c420cfbd94e47d57fe1add0b577afc8d
SHA1 d664ca5e5a8760f1a5a338d8c5e9f7a5ff5e5d95
SHA512 6085eb3594348db846c2f5e2bdac2a6d93f129fbff95f02f6404cc7b2293774771dc9fcebcd70de47d82d801f4efd736205a9edfd986ada36d2d2d2f0cdad477
SSDEEP 24576:zcySRLv7qLa1FG86KnIYjTBBxvfpi1ZK6tmMEDiQL2mpsMVeb69WDgdEEcj0Ozh:zkLv7qLa1Fp6+t3lwW6QzDin0eb65dfO
TLSH
T19F55339B0E147452D6EB0D9727BC972A22CE0F9C602DA3513656B11B4CA5FFFE680E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveGet.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\RemoveGet.xlsx
Size 9KB
SHA256 57fcab92d32971faea8b50f41f0b71bcd8d1448771e52dee7188e0c1b1931cb3
MD5 779d8deb2f39293f8b842343acc19878
SHA1 4d51e3abb079441205f91a0d117fd89ecc897df2
SHA512 e43c40a6bc813bc8bc4fa286ec0ab7132ff0b2ac2582fa3f238c2123727b9f64586e619a4de5ae100bc55a35b77eea34456e9072f7a89aafe88d21c1d26ca80e
SSDEEP 192:wc8mVErYhob3UTYAGUeiaFUlbVvevUqzQXpS0oontAFaop:wc31+36YAMzUlM9z6pwontAFaop
TLSH
T14F127BA5E0B5E97EC277883E819E01D1BA5D10806B417D4D7861FA2F674229702AF3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchAdd.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\SearchAdd.docx
Size 15KB
SHA256 0dc9c94bd525a5b7250bb4ddf7ec0c3310f7e80c4ed8098c242838d79ea2e06e
MD5 21a10e081056be80877433738ab619bd
SHA1 bb8eca4d820ac705da4adc143f91881a3b8f2a3c
SHA512 dc74b2aabd0d1fec024afe6b0febb435a18e417aa2053d140ec3bc484edc794bdaa2e27392fb4e7168269728bf0f7cdc0ae4449fc598a45064a8702d8b2733a3
SSDEEP 384:acJb+fAl/OoHJdNxt/ZtNNZA7TIFHRQjK9IS:gILHRxllNZsTItR39D
TLSH
T12772BF39FA461860E653C63C716976F9D02D4306B642D08B3148F9DEF777B532317A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishOptimize.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\CommonFiles\UnpublishOptimize.docx
Size 20KB
SHA256 6677f0348dab062c8e095905cff579112bcac29017c9b392c766cdcead5fadf2
MD5 7f7a3ba9428ea095bed562cf7c5db5cf
SHA1 6fc1c998f7725757195dade263d67789dab5dd38
SHA512 1961e835c1562e0a14ea8e0b0c7811f9a66fccbc9e6e4fe0e7624a08968c2a61e9e91498ad622458395a89ad73c8103989883424f353b65cc892f619b4f20bcc
SSDEEP 384:a8OYN9p/MMicyK0jvxJ6W32dNxt/ZtNNpLeIFHRmgIKIn:Dzp/M/cyX7xJ13yxllNgItRqHn
TLSH
T1D792CF3CDA545932F5A383BC991352FAD40E4282B71AD0DA741D378D53F2AD31307A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot_20260601_043518.jpg

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\screenshot_20260601_043518.jpg
Size 156KB
SHA256 a5f252b05cb2dbd50e4d8d4eef430ea4a9be24d27b98e8f060d9d99654343dd7
MD5 375bc037239948ce62bf9bcc45845b8e
SHA1 c0c5e88a59f2e1881cdba7558b04aa78db546f23
SHA512 212ef2b76585ed1d935ce31df2fa9a986cb15d024489bb1276fc4b5202db6d72f557ee418c255e7b107bd4d011e061386809bd2bc3f69503d8c915fd46392349
SSDEEP 3072:m1a2uggKN9GFXVBw2jzLvNqot7mAUQx+6hp2wS29:wgKN9GFX7drNJb5A6HhSC
TLSH
T189F3E85BBB94FC4F003B92B758FF934676267763E43676A4D04F4E88271A1C2167ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.json

Path C:\Users\Admin\AppData\Local\Temp\[GB]YmoWccBljjgU8cEttTjAFsKF4g\system_info.json
Size 3KB
SHA256 970e14e2f0aa06564d374b6966da4cdcf6bbee64d5a40c440ca9c7eee0a0b97b
MD5 d80fd267e373f7e4f90b8a1aaecab903
SHA1 6b03a7a9bd50949cd8846dc9817a3129a77fc3bb
SHA512 f5c3f4a0ae6ea253497397fdfef8ecf8fa255fc4d564ca0d1dac26747ecf949f4bc608b0f0f5ed18f03e1fdf61fbe8719760961bbd8ce7c36e40de5653a7fbb6
TLSH
T151810E3CE8B04D539489A174B87D1A063370A2974EE43C08BFCDD14D1F8E51E5A79AAF
MD5 SHA1 SHA512 TLSH

Submit Download