blankgrabber | be715b4e472b9318c553664e569a15125b093821675be26bf3b92f8ba5714ddc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe
Size 46.5MB
Sample260604-n2mxcaex6n
SHA256 be715b4e472b9318c553664e569a15125b093821675be26bf3b92f8ba5714ddc
MD5 84206a820895c3901f2fde477516b72a
SHA1 78b6b13a0f8111aa3247b774589be0882b466655
SHA512 69e1232eca7efc966085dbc180fd47d96bb1e5fd9bf0cd30f8e1d02cc3942c5fcce745ea90b4f787115b8faabc71367022d14e12845059a87de7b32f13d7f4dc
SSDEEP 786432:2DB/19RLVku494TzzFu0kZ0z8opGZQRrk7djdbBAMfQCxALwZOHPwF16krc2AgPJ:2DBrRJO9KzAGzPzryZDQCxAEOYwkrcDi
TLSH
T14CB73341FED743F6C98F08B5102EB33FDB385406852CC697EBE54E15E9BA32049EA259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery blankgrabber stealer trojan

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b3ed-65.dat	blankgrabber_exe

Executes dropped EXE 2 IoCs

pid	Process
1864	RSL-Xtender.exe
1032	RSL-Xtender.exe

Loads dropped DLL 35 IoCs

pid	Process
1864	RSL-Xtender.exe
1864	RSL-Xtender.exe
1864	RSL-Xtender.exe
1864	RSL-Xtender.exe
1864	RSL-Xtender.exe
1864	RSL-Xtender.exe
1864	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RSL-Xtender.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 56 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-hi.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-cy.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250476499785523"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2468	2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe
2468	2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe
1032	RSL-Xtender.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1032	RSL-Xtender.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2148	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	RSL-Xtender.exe
Token: SeDebugPrivilege	1032	RSL-Xtender.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1864	2468	2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe	83
PID 2468 wrote to memory of 1032	2468	2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe	84
PID 1032 wrote to memory of 3668	1032	RSL-Xtender.exe	85
PID 1032 wrote to memory of 4516	1032	RSL-Xtender.exe	86
PID 1032 wrote to memory of 2148	1032	RSL-Xtender.exe	90
PID 2148 wrote to memory of 3448	2148	msedgewebview2.exe	91
PID 2148 wrote to memory of 2492	2148	msedgewebview2.exe	92
PID 2148 wrote to memory of 2492	2148	msedgewebview2.exe	92
PID 2148 wrote to memory of 2492	2148	msedgewebview2.exe	92
PID 2148 wrote to memory of 3144	2148	msedgewebview2.exe	93
PID 2148 wrote to memory of 4508	2148	msedgewebview2.exe	94
PID 2148 wrote to memory of 4508	2148	msedgewebview2.exe	94
PID 2148 wrote to memory of 3768	2148	msedgewebview2.exe	95
PID 2148 wrote to memory of 3768	2148	msedgewebview2.exe	95
PID 2148 wrote to memory of 3768	2148	msedgewebview2.exe	95
PID 2148 wrote to memory of 4460	2148	msedgewebview2.exe	98
PID 2148 wrote to memory of 4460	2148	msedgewebview2.exe	98
PID 2148 wrote to memory of 5200	2148	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_84206a820895c3901f2fde477516b72a_akira_amadey_blankgrabber_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\RSL-Xtender\current\RSL-Xtender.exe
  "C:\Users\Admin\AppData\Local\RSL-Xtender\current\RSL-Xtender.exe" --veloapp-install 1.0.93
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1864
- C:\Users\Admin\AppData\Local\RSL-Xtender\current\RSL-Xtender.exe
  "C:\Users\Admin\AppData\Local\RSL-Xtender\current\RSL-Xtender.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=1032.1156.9932701890095614589
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffbbe26b078,0x7ffbbe26b084,0x7ffbbe26b090
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,5249021172930058182,7839277672397581087,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,5249021172930058182,7839277672397581087,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2232,i,5249021172930058182,7839277672397581087,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,5249021172930058182,7839277672397581087,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2204,i,5249021172930058182,7839277672397581087,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView" --webview-exe-name=RSL-Xtender.exe --webview-exe-version=1.0.93.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4436,i,5249021172930058182,7839277672397581087,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:10
      4⤵
      PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\RSL-XT~1\Update.exe
Size 2.6MB
SHA256 4a4240107ece9fb5f21c2ec616e12c5aadf79755441b7a5c8941b2668f61ecaf
MD5 d6df57479ca8c8664250ff232a3b1e0b
SHA1 4bcc4ad3c8c021919c5ca7e5a0b7690aa6a75166
SHA512 7b2aeb7c37fea63812b1b43c207e694ac45a9bd220faf4b007a3186b79bbdd6bfe82e5034e9c1b3a8b3edc8794bea59880e2125227ad0069275b266b2e2f75a2
SSDEEP 49152:ol4gaDleSQ4edhOQpz31sv7ti7CBIQ/ixlQwT4Xiw2x4q/:oWDoSwHFOtwsoCwTw2x
TLSH
T131D59D81FEC382F5D58F08B5202EB33FCF36A5058528DA97EBE45D01ED7632059EA15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\_ctypes.pyd
Size 120KB
SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
MD5 6a9ca97c039d9bbb7abf40b53c851198
SHA1 01bcbd134a76ccd4f3badb5f4056abedcff60734
SHA512 dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d
SSDEEP 3072:QC7Pgg3AwEWwSQJKoPfLSHcn0YJwyncXf9IDQPj6Exv:Qz5IX8jPfLSMJwykfoy
TLSH
T13CC35C1B2394109AEA674078C5736E07DBB1F849175083CF12A4C6AE2F637E36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\_uuid.pyd
Size 23KB
SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
MD5 9a4957bdc2a783ed4ba681cba2c99c5c
SHA1 f73d33677f5c61deb8a736e8dde14e1924e0b0dc
SHA512 027bdcb5b3e0ca911ee3c94c42da7309ea381b4c8ec27cf9a04090fff871db3cf9b7b659fdbcfff8887a058cb9b092b92d7d11f4f934a53be81c29ef8895ac2b
SSDEEP 384:MPfwFpEW56TfQJIDew63IYiSy1pCQIJPxh8E9VF0NyYk:MPqpEbjQJIDew1YiSyvWPxWEW
TLSH
T111B26D46DA604C55EC2746B0A4D54A1AEA30FB919B9183CB331CC1591F613C3BBF63BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle.pak

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\bundle.pak
Size 14.9MB
SHA256 f09aab3745c2697f540fd1859114bad0f3f4f2fabce90ee122546603d61a0593
MD5 2d81cbb8c742392447f099ab0360267f
SHA1 4eb9b1e0dc58f0df360e7448b5d84c9c8212b36d
SHA512 8a5e81a89ed06d0b05039e207a58f1201b2c2cb72f250010587a1c35ba18d582b1d07945b93191677e90ae8ca78b470b9a843309cd4b474f00b4c41034cc20cd
SSDEEP 393216:+E+1QDvXHlrxiUVyJL7Tz1BaTHS527Z9U7ihtkqdKV1P:NDvXFrxi8yj497Z9Mi4HP
TLSH
T183F6332020991707E6490935514E2E8ED7147A7AC1B66BBD46CFCF24F2E4BD7C2E2F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

offsets.json

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\offsets\offsets.json
Size 38KB
SHA256 dd7c095df81b3c5d8f42f470dcec9960bb9024d1d2064431efa7e84bf7bc5b64
MD5 f78bad5334d84e31d294dc1969fc566f
SHA1 b84ff98ed0b3736fc64877093acbd0d63646657e
SHA512 7d04da4867f0a87bd3a0f2df287936c5ebe7db454d66afa69b288505f132edc40e939afd1d78ea7ed2c4d96977ff5d742d8cfecf1a2e23db7b6971d136a2c61f
SSDEEP 768:NXJYqBWmVteIFrzRRdwlac8BK3QerKkKrpac3a9qZTW4pRrxHuWemy5Fs1NIbM:NXJlBWifdwlac8B26kKlac3a9qZTW4pt
TLSH
T1E803D66AF5A00C1B5A7913692D3A8682F741837F01800DBF78FE141D5FFAD03A695E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reward-list.json

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\reward-list.json
Size 8KB
SHA256 b58431c3bc981a42942b57ac0bb397b8c8db0f0d6757f8d1d5d8962246976567
MD5 faaff94491d70fe3c7b18a0224bfbae0
SHA1 5acb67a98a2369eac12a8ba19bbddc7c0a90686f
SHA512 8510c0ecb643b4ae3790746bf419a79a68a466c3afa7cbefb107ee839d83688f03f59eaa5d27a62f5768dec7046786f1893ad7187e783bfe492d0cdd20473a56
SSDEEP 192:O6TmJM0c40/3fbe3jE8bBCk+fhf3fIfUjpiPzpZPYpJPapPPlMqIqwC3nndQP:uvbBAelhEROn9s
TLSH
T127025EEBEDFB46B30A692692B6CB218AB12463D3552AEF6E5490040D11DFC13507FB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsl_forge_core.pyd

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\rsl_forge_core\rsl_forge_core.pyd
Size 696KB
SHA256 aad645c67c30b7a6aa57204558276531112af4c113fb7312856427b7f292ba65
MD5 feafdff7911727c7eb39765727e93542
SHA1 2c88630e9869a9fb9983be9897f13771c728d97f
SHA512 8aca28615e301433a444cb3ab3bd1ac02f61e57bb791048d3c7454126e4565d5f4ebff543c3a8a6aed6a5d35b4cbd2699d52828f14bd47d69e827daf3aea4bdb
SSDEEP 6144:D8bAiFCJcZsH1yKgIJjgAueNXJ5EqYmC2TQejtXFw0IuHcOpnAXEgOrvKnEzPOm:D4CloKgMuQXJmmCTyFlIqpnI
TLSH
T13BE41A11BA6BA97CD45AC470835749732E3134CB1B2AB9FB01C096393FA9BF46B39315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\RSL-XT~1\current\sq.version
Size 492B
SHA256 447f3f04be6fb60fc29b2e42cb08ccdeeafe1cc25d45ea741216f0bf96e17569
MD5 6d1fcc31c007c0d967c90507f727a172
SHA1 2472de50602aa5f6873262d1ff3aa5101c810161
SHA512 1900253a567cb457c65b51254672070990d5e69f8c0768507e5bee952c96bbef795aa020b4952ad41692b83c28c230e1bedc9f82ae21660851ee71c1040be365
TLSH
T1C8F09E65D898FF034F45C344D580450493FB696E30CD4854E4C48C9E11497EE882EB80
MD5 SHA1 SHA512 TLSH

Submit Download

RSL-Xtender.exe

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\RSL-Xtender.exe
Size 30.3MB
SHA256 8bd3463ac6380e66f126a1f0a01fb0dfc46e3df2dfe83f92dacffdb44da924d2
MD5 7855d07a41c5770fc821dd39bd9dd7c3
SHA1 d151cf1f9c2630c490cc2c322007125a65f479c6
SHA512 184a1f1a964c508991855d704ed41eb0c2157f3f68fc5c6cd652889490e20fcc6c29b78b7f1c12ee3c070bd20c55a5784807aff4b3b8e553f989cf09c0eb1224
SSDEEP 196608:r83+0G00HJ8ORWa0c83Y32+wRCCV7ajgZmqPD4Hhm2eE2NOv:ro+NJ8OsbE8l7lPD4HI2eEN
TLSH
T19A67394051985096EAA1DB7CBD219BCBEFB1B849331727D708A5C48DBB43DB51ABF08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_bz2.pyd
Size 81KB
SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
MD5 4101128e19134a4733028cfaafc2f3bb
SHA1 66c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA512 4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca
SSDEEP 1536:douLz7p5Tcayt0KpkKWVa5cNRT8+smUxJIDtVH7SyD8Px:2uLz9meVamQ+sLxJIDtVHVsx
TLSH
T171839E53F6A096B9E45BA27655B14393E330FE49039093EFF684835A2F03B913D6532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_cffi_backend.pyd
Size 174KB
SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
MD5 d73e60e5ddd70625fd0092677cff5628
SHA1 fa4523365562acfe7fe1cedadf2c5ed6d4c5af38
SHA512 8a85e38e48cdc313d81604f062c45c19fe6a1cfd8d1a7b9dbe5653b812bed2bde953ce717a0adf91653ff783f6b5e2e04ed086d3cd91fcfd0da75c59d4598b1e
SSDEEP 3072:c/FLhm/LAJQtHoOqXX0BRrWflvNjmfdur4SaLSD3BrS7ERSTL7KqShZ73oH7Q:c/2ptHKEBRrWflljmfxg3xlRSTLORboH
TLSH
T1EE046C5B329C11B2D6A651388A579B43E3B3B460174197CF01A0C7B52F1BBE67A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_elementtree.pyd
Size 123KB
SHA256 df71d64818cfecd61ad0122bea23b685d01bd241f1b06879a2999917818b0787
MD5 63629a705bffca85ce6a4539bfbdd760
SHA1 c5bf5f263e4284766cfb27d4b7417e62cce88d12
SHA512 c9191b97fa40661fc5b85fc40f51a7177f7dc9e23acfc5842921631ebb7cd253736af748108c5afc03683f94fbf9c2f02fca7415303f7226f1d30c18e2dddb10
SSDEEP 3072:chG7Ny/dPxvpewUjYk2f2/4YkWQNxkUVrxJ54h45ID1fzlx:n4/dPxvpTFk2fNKQ/LX4h4
TLSH
T1CEC34A6B72A5C0BFE462407C92664F46D7B2FC600A4187CF6248F6AC5F333923EA9355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_hashlib.pyd
Size 62KB
SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
MD5 de4d104ea13b70c093b07219d2eff6cb
SHA1 83daf591c049f977879e5114c5fea9bbbfa0ad7b
SHA512 567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692
SSDEEP 1536:18njpHxGkYjEEEJkn8cw6ThID5IJt7SyiPx:GnjpHxRJ8w6ThID5IJtEx
TLSH
T19B536B09A69544EDD96780B9C9A35F57E9B1F0010B1067EF4328C28D2F233D3A6FAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_lzma.pyd
Size 154KB
SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
MD5 337b0e65a856568778e25660f77bc80a
SHA1 4d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA512 19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e
SSDEEP 3072:5mGf4k8d79MwyHiRr7tznf49mNoaGjQJplJIDe10Yhx:5Pf4FhMwyMAYOao6P
TLSH
T178F32982A394F4E5F7628C78DA624F13D7F67849031092DA12CCC36E2B1FB755A2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_socket.pyd
Size 76KB
SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
MD5 8140bdc5803a4893509f0e39b67158ce
SHA1 653cc1c82ba6240b0186623724aec3287e9bc232
SHA512 d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826
SSDEEP 1536:HJlcAdpEVuju9/s+S+pJGQRivVia3i9IDQw17Sy+Px3sxi:H7ce+uju9/sT+pJGdvVp3i9IDQw1kxZ
TLSH
T1BD735B12A69021A9D277C179C1631E23FB74F4C117D5A7CF5260CA6E1F23782EE79B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\_ssl.pyd
Size 155KB
SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
MD5 069bccc9f31f57616e88c92650589bdd
SHA1 050fc5ccd92af4fbb3047be40202d062f9958e57
SHA512 0e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc
SSDEEP 3072:qFrIQQey4VWR98w/PQQcXo8uOVrGxn+SQOXLkd1ItS+Q8YuAfxJIDt75EHx:eEeRV29//4QcJuOynyvxX
TLSH
T143F37C43F28419B7E823E4B9C6234912E7B5F055231187CE49D6D68E0F13B46AF7AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClrLoader.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\clr_loader\ffi\dlls\amd64\ClrLoader.dll
Size 10KB
SHA256 e6cb8b51dbd5d5b5548696e6ddf17875af73b8abd99ca1572d32b1df98028591
MD5 14a6409dc09a3ae3308227b51b52a8ad
SHA1 bb00449c403ba3b7ccf7e70ae1d4488b7f25ed57
SHA512 e5dad09f77ea7ee29fdd20230a79a1d82780937e4ec0e93b1f619622b86afc8fbf2ba4d26376269d1eab082e5836ae80964d780e6d4fbc4018ee921a37e053a1
SSDEEP 192:aLXcamRL8lC78IxvWacR8Lsfs08RRaHmO4O6:gOL883t3cRAJ5J5
TLSH
T1B8220A16EBE8C726C9BE4B79957390040676E3596962DB8F1CCCE40FEC427441FB2B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\cryptography\hazmat\bindings\_rust.pyd
Size 9.3MB
SHA256 c7a4f62a13e23b6eb4a36c42002313bd6b343dd602ac05cbc1c1767033315064
MD5 10efd9378073ce7df7727fb9bb45fc99
SHA1 1559b33e93f7188644cafd091a4cc5a2dc511fd7
SHA512 68b267c0e12cd30f3e8fe55ff6e75f2dbffd8d77e51e7aa2026864e349b3c2546c01f18698d667f512535e45f773cd08d78f1511bdec5404df1072e26ac6a547
SSDEEP 98304:u9IWM/WXrOLpIywf2yNGEqTxDpI4u+YGYf8T9xft:u9gpIywf2yNGzTxDmjX
TLSH
T103A66C25BAA950A8D86AC4B8C34752339B7174DA0B747AFF49D486B52F37BE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\libffi-8.dll
Size 34KB
SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
MD5 32d36d2b0719db2b739af803c5e1c2f5
SHA1 023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA512 a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1
SSDEEP 384:SB8J4ihYfwYiXGPc9orPji8i4DDQWvGaRQsTeCXS/Fzc7jsFruRXYV1ZE9DRCXjQ:rGHs4vpegQsTT0uj82S7Fp2DG4yshH
TLSH
T1BFF25B07554418E4E7A3D43CA3A68E1AC73579341751F2DB02E5C2BA5F5ABE2F63C318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\libssl-1_1.dll
Size 686KB
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
TLSH
T1ADE44B95ABB51498D9E6C17C86534A33E37AF4141330AFCF06A5853E0F17BD82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\pyexpat.pyd
Size 193KB
SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
MD5 1c0a578249b658f5dcd4b539eea9a329
SHA1 efe6fa11a09dedac8964735f87877ba477bec341
SHA512 7b21dcd7b64eeba13ba8a618960190d1a272fa4805dedcf8f9e1168aebfe890b0ced991435ecbd353467a046fc0e8307f9a9be1021742d7d93aa124c52cc49e6
SSDEEP 3072:6SD0qUuvSsbk1ztMxTfyxh591VisxskpZFkjEVE/qCOeU19IDQhHVxB:6g0pJzmyxh59142WEG/u1Z
TLSH
T190146C5B71A6C0EBD8838038D6D64B07DBB1B865038097CF12D4E77D9F277923A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\python3.dll
Size 64KB
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856
SSDEEP 768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
TLSH
T114536E529B58F8A6DAF665FC38D29DCE143B12CC83ED84DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\python311.dll
Size 5.5MB
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
SSDEEP 98304:JdHwQkq3AAtsPv3XXTVEspHBMp4SsPxQpe2bx:JdHwQkq3AMsPvHXSpAxQpe2V
TLSH
T1F2466B22726584A0C97B8076EA2F864BD7B27C505F20CB0B61A4B7992F33B531EDF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\select.pyd
Size 28KB
SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
MD5 97ee623f1217a7b4b7de5769b7b665d6
SHA1 95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA512 20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f
SSDEEP 384:5oR1ecReJKwHqUuI7A70RUZ9ID7GvIYiSy1pCQlIJNPxh8E9VF0NyUT2:ezeUeJlHqybG9ID7GQYiSyvCPxWEC
TLSH
T174D29F5B6B501889E8338571A8E74E12EE35B6A14B5083CF3319C16D1F327C277B77A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\RSL-Xtender\current\unicodedata.pyd
Size 1.1MB
SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
MD5 bc58eb17a9c2e48e97a12174818d969d
SHA1 11949ebc05d24ab39d86193b6b6fcff3e4733cfd
SHA512 4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c
SSDEEP 12288:JbYefjwR6nbJonRiPDjRrO518BEPYPx++ZiLKGZ5KXyVH4eDS0E:tYeMQ0IDJc+EwPgPOG6Xyd46S0E
TLSH
T1DC355BC9BB828D66D87B317944D2212F1361C272476B233BB65513285C8B3B74EE69FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 09584b87ac7f92d1753a88d17eed320ae017c7e50d87dcbbdc4889c8b76e5823
MD5 ecd656e379b367a60857298f4ca3e2f9
SHA1 c20e48f75175d846eeca4786d2d30301c7dbc857
SHA512 70dfd4c69470cd84f4be5b318392b15ffba97312c5e3eb47f51621f8e335c2aadfe5810f80704b8970ad9d5f48d2aec858e9f8e55b32ba79e56e9e1b5089eea0
TLSH
T1DED0122332424134C41024B3044363083800D51F80068141942CC95E7A04454191A481
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1b0412bd7aa13c134626827baf6cf93e730a351e1b659bc36d32481e8a7ac894
MD5 2e0cda3fcda0abc05bd3a7646a2ae239
SHA1 dd84b483b0e2a153dff859f35c86697e4ac6c89c
SHA512 a2a2143978b24c19264ab9ae1fa4f57eba4664552f10058d0261c2046886d5d2e4488fde09ab860880e561a1767cda083813a41e213433d592e9ace15dad7cbf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9e58c77f56a56e76b6bfa13a5d629a4aa69c8b46bc03aa9fe63a7682d4938bdf
MD5 38e3945454f964f66489362621151250
SHA1 ce0ab0ca86dec12e229305a5bf045a0f99693e41
SHA512 cc97f0ba893c6a9f2b712ddc5186352bac7615873bba0312cf4947c454a7354fcf24c40a79033fd8da9561144e2aca5ada5e44a5c7a24287e1662e871ac7e2ab
TLSH
T13BB022EB2C32000FFA300BF0E8CAC0E232308EC0E3030C0B00B0AA30A3203C08082C03
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Network\Network Persistent State
Size 785B
SHA256 0c410596cff96b5681b38181e8efc148fa91105e2aafb932f209396d883fdfef
MD5 c00877125585c762c8dfae7821f4c6e9
SHA1 eb04834a6de1c255299c045fbc0d946bb7be81b4
SHA512 48eb8b22258ac3311049c7d8a2ba62562bfcfd98befed669ce4ca797a07447b7b296b174f0dc8434c323868c009c3e5e7d34a811351c828573accbd1c2616882
TLSH
T11301BDB3C3D881AD495102F47638B917CD3E052A13283E1AC8D4EBCEA3E1474E210D4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5938aa.TMP

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Network\Network Persistent State~RFe5938aa.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Preferences
Size 6KB
SHA256 9e5833c49e7256588a4082289daa28cd5a5d88f0925a4df880c13a390942b1f2
MD5 26927016827e974c1c324bb1dbcd07ac
SHA1 9158d9573a78c2a7a71965204ee910f782bc5b37
SHA512 80ec8b65acb45a085ffa65b16049ef2d7535ac5852e3ab2b9920acbaf739c446ab2037c63fcbfffdcfebdd495603797926cef87b2d7dfec2880791b842399c3e
SSDEEP 96:stl05p8vjb9HffqmhZ8i0vhE+kQRm/7qx+WVHMSm+uec+oYW1iY7Qj2+g1EMOB:stl0vifzZ8pao0/S+WiXYWwY7fjEMC
TLSH
T119E1B6035E6869B74CC7F3197E35BB12E2F6502226D40E98ABFC860C05E66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58b33e.TMP

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Preferences~RFe58b33e.TMP
Size 6KB
SHA256 6aec67103e97b8b49ec7ed4f144d07907d76e938002419ebcae68a215099f302
MD5 7dcc4dd758f8cae8e007bba7aaa03479
SHA1 9804d7df4a1ffa7c147a6e88719682fc19d4d649
SHA512 5ca5fd6d6f2e14cfe4571ede3c968f89ab6c8668a5721e98ec84ced457d2be32b29474b2ceeefd6372f8f6bc846ee2dd4f9f64985baafde72ef6341f384e6159
SSDEEP 96:stl05p8vjb9WffqmhZ8i0vhE+kQRm/7qx+WVHMSm+uec+oYW1iY7Qj2+g3/EMEB:stl0vHfzZ8pao0/S+WiXYWwY7fZ/EM8
TLSH
T129D196035E68A9B74CC7E3197E35BB16E2F6102166D40E98EBFC861C09E66CD620794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Local State
Size 3KB
SHA256 78d3dda3699431f409387c64a62140a8476f19c85e110ddabb1d6d431d2f165e
MD5 e88cae3be985124c4881770456cd6c71
SHA1 009f3ef87c69589cd645d8b69d0a010a4a5e0a47
SHA512 596fffd72be3c8782048e524daf88f0e0af7ad7e549ab9178692ee13b04d1b9ccaff7fd911c308d22dfdd8de8f5585a85611136687ed46b61adc3e8b9719a064
TLSH
T129719573A564A9774EE39A04B88A2B1677B25123D1953F9CD9ED0F0C02DB3D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Local State
Size 1KB
SHA256 d19de01dc1599d3990c40490fff5a9d20e6209837fb69009ee8009b8d09572d4
MD5 ab232d37811368be5147663425828eb3
SHA1 fd2c3268603619a565c606c10de22fc5d532dacb
SHA512 73a9335fea95a7ac3f7ca43031a2556569056bd1fe26993a1a091f4eaea71275f712921ba0ad7f7d7162d7c8808b711e563273aefbf55384ff847b1f814b3892
TLSH
T15431A4B3E0942FB24D93A654B556AE5B2F711062C2254F8C75EE0B0C43DB6CCE63AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Local State
Size 2KB
SHA256 0e1efaa3a7a5ebe4620ca76be34792ae726120ca951b96b9b65c88915c5f70cb
MD5 b09db3e9859e66f2df5adb27d57c8a85
SHA1 2f142c86ff7c81f43916ce1fdda53f1a3603c66c
SHA512 59f2fac09a69ec8a43dbac754404965b5bae1ecfd1c61c513b92d456fd8f871e6ba3ae27bea45fd0534229b2dce7eb0d2527aeed7bd3343ccb687a7a9618b713
TLSH
T14451D873B404AAB74AE39A04BD4A3F135B76516187621F9869ED0B0C03DB69C2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Local State
Size 16KB
SHA256 071ed7b8ad32af804fe840ef0168a58a7de4fd286d446e19ae264b11c1199b38
MD5 332c6d5622bf12cfd22cbbdb4b8c596c
SHA1 769bbd879c07fd3d7535c97336d3f46f822c76e2
SHA512 61bb51d29feee06cbcfca6451233e6d90a50106deb1fc3b52eb49f5961c0580614ecb96a98d58ff4bcc5e4e16f82241ecf4f7d8b13e759ca63f4b4d61d43853c
SSDEEP 384:zZsr8vAVy7dG5UI6limIfB8vNbOPMwKR1I+P:ir84y74GVMP+1IM
TLSH
T1BC72AF36A1346EBA4DE2DD01FC0A5B062DB58189C5861FBDE8DC6F08439F1D61352E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe581335.TMP

Path C:\Users\Admin\AppData\Roaming\RSL-Xtender\webview2\EBWebView\Local State~RFe581335.TMP
Size 1KB
SHA256 1e687e3f31eb0596ec8f8086bf54cc858a1fc9a74a00029a89c9f89b24fdb9c4
MD5 4b6de8922230a662fee8ecc21dbd1588
SHA1 db4ef016d9419fa03e8de75dfe749299770265bf
SHA512 5a8c8e6296b6000b120179101aa3d8f702ff1d15b3d37c40dd6d87719e9770efee079cfa849a998b7f1dd60df242eb87d70fcbdf5f80c0a55ecda427c72ffed0
TLSH
T1E22187B3D0986EF659925914B557BE4B2EB0506182244F4CB5DE071943DF5CCD63BC32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-af.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1998857993\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-147-0x0000026ECD7A0000-0x0000026ECD7AE000-memory.dmp

Download

memory/1032-140-0x0000026ECD860000-0x0000026ECD882000-memory.dmp

Download

memory/1032-134-0x0000026ECD1B0000-0x0000026ECD1BA000-memory.dmp

Download

memory/1032-142-0x0000026ECD7B0000-0x0000026ECD7B8000-memory.dmp

Download

memory/1032-143-0x0000026ECD7A0000-0x0000026ECD7A8000-memory.dmp

Download

memory/1032-358-0x0000026ECC210000-0x0000026ECCB63000-memory.dmp

Download

memory/1032-141-0x0000026ECEA10000-0x0000026ECEFB6000-memory.dmp

Download

memory/1032-137-0x0000026ECD280000-0x0000026ECD29A000-memory.dmp

Download

memory/1032-135-0x00007FFBD8240000-0x00007FFBD824A000-memory.dmp

Download

memory/1032-145-0x0000026ECD7A0000-0x0000026ECD7A8000-memory.dmp

Download

memory/1032-148-0x0000026ECD8C0000-0x0000026ECD8C8000-memory.dmp

Download

memory/1032-146-0x0000026ECD940000-0x0000026ECD9D8000-memory.dmp

Download

memory/1032-144-0x0000026ECD7A0000-0x0000026ECD7A8000-memory.dmp

Download

memory/1032-136-0x0000026ECD7E0000-0x0000026ECD854000-memory.dmp

Download

memory/1032-139-0x0000026ECD3C0000-0x0000026ECD3C8000-memory.dmp

Download

memory/1032-138-0x0000026ECD270000-0x0000026ECD278000-memory.dmp

Download

memory/2492-172-0x00007FFBE6300000-0x00007FFBE6301000-memory.dmp

Download

memory/3768-266-0x00007FFBE6300000-0x00007FFBE6301000-memory.dmp

Download

memory/5200-682-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-681-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-680-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-686-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-692-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-691-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-690-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-689-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-688-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download

memory/5200-687-0x00000203B1270000-0x00000203B1271000-memory.dmp

Download