a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 2.6MB
Sample260705-3ebywsb15n
SHA256 a941df5a9a05edc5a6bf28fc731b9f60665dbc06ccf842ea896bb0a945021ab8
MD5 56beef19d493fb2af19d97f841aaa880
SHA1 b98fd74312d616cb442f648a4dd1a4082d0441e2
SHA512 7d4fa1f4f4c107cebcde145e1857877060c574988a496c1a5bddf127ec8996e913940df1d07e4c5a0741fb98335d2c2010e7b285130b5e4b6122494b7f1645e2
SSDEEP 49152:n5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUe9KTnUVz:MTrVI4dGOgGpYHCL
TLSH
T124C59D62F782D0B2E4D201B151BEABF74D787635537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5464	chrome.exe
2400	msedge.exe
1792	chrome.exe
4260	chrome.exe
1008	chrome.exe
1336	chrome.exe
4504	chrome.exe
2456	chrome.exe
3016	msedge.exe
1932	msedge.exe
3032	chrome.exe
1932	chrome.exe
3696	chrome.exe
1192	chrome.exe
3700	msedge.exe
1108	msedge.exe
3240	chrome.exe
5568	chrome.exe
1148	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
7	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6040	chrome.exe
4860	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277675224305117"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
1792	chrome.exe
1792	chrome.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeDebugPrivilege	4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1792	chrome.exe
2400	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1792	4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe	90
PID 1792 wrote to memory of 1744	1792	chrome.exe	91
PID 1792 wrote to memory of 1296	1792	chrome.exe	92
PID 1792 wrote to memory of 1296	1792	chrome.exe	92
PID 1792 wrote to memory of 6040	1792	chrome.exe	93
PID 1792 wrote to memory of 4868	1792	chrome.exe	94
PID 1792 wrote to memory of 4868	1792	chrome.exe	94
PID 1792 wrote to memory of 5568	1792	chrome.exe	96
PID 1792 wrote to memory of 5568	1792	chrome.exe	96
PID 1792 wrote to memory of 4260	1792	chrome.exe	97
PID 1792 wrote to memory of 4260	1792	chrome.exe	97
PID 1792 wrote to memory of 3032	1792	chrome.exe	98
PID 1792 wrote to memory of 4304	1792	chrome.exe	99
PID 1792 wrote to memory of 3032	1792	chrome.exe	98
PID 1792 wrote to memory of 4304	1792	chrome.exe	99
PID 1792 wrote to memory of 1236	1792	chrome.exe	100
PID 1792 wrote to memory of 1932	1792	chrome.exe	101
PID 1792 wrote to memory of 1932	1792	chrome.exe	101
PID 1792 wrote to memory of 1008	1792	chrome.exe	102
PID 1792 wrote to memory of 1008	1792	chrome.exe	102
PID 1792 wrote to memory of 3240	1792	chrome.exe	106
PID 1792 wrote to memory of 2664	1792	chrome.exe	107
PID 1792 wrote to memory of 3240	1792	chrome.exe	106
PID 1792 wrote to memory of 2664	1792	chrome.exe	107
PID 1792 wrote to memory of 3696	1792	chrome.exe	108
PID 1792 wrote to memory of 3696	1792	chrome.exe	108
PID 1792 wrote to memory of 1192	1792	chrome.exe	109
PID 1792 wrote to memory of 1148	1792	chrome.exe	110
PID 1792 wrote to memory of 1192	1792	chrome.exe	109
PID 1792 wrote to memory of 1148	1792	chrome.exe	110
PID 1792 wrote to memory of 5464	1792	chrome.exe	112
PID 1792 wrote to memory of 1336	1792	chrome.exe	111
PID 1792 wrote to memory of 5464	1792	chrome.exe	112
PID 1792 wrote to memory of 1336	1792	chrome.exe	111
PID 1792 wrote to memory of 5992	1792	chrome.exe	113
PID 1792 wrote to memory of 5992	1792	chrome.exe	113
PID 1792 wrote to memory of 5376	1792	chrome.exe	114
PID 1792 wrote to memory of 5376	1792	chrome.exe	114
PID 1792 wrote to memory of 2456	1792	chrome.exe	115
PID 1792 wrote to memory of 2456	1792	chrome.exe	115
PID 1792 wrote to memory of 4504	1792	chrome.exe	116
PID 1792 wrote to memory of 4504	1792	chrome.exe	116
PID 4912 wrote to memory of 2400	4912	2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe	117
PID 2400 wrote to memory of 4516	2400	msedge.exe	118
PID 2400 wrote to memory of 4860	2400	msedge.exe	120
PID 2400 wrote to memory of 4564	2400	msedge.exe	122
PID 2400 wrote to memory of 4564	2400	msedge.exe	122
PID 2400 wrote to memory of 4300	2400	msedge.exe	121
PID 2400 wrote to memory of 4300	2400	msedge.exe	121
PID 2400 wrote to memory of 4300	2400	msedge.exe	121
PID 2400 wrote to memory of 3016	2400	msedge.exe	123
PID 2400 wrote to memory of 3700	2400	msedge.exe	124
PID 2400 wrote to memory of 3016	2400	msedge.exe	123
PID 2400 wrote to memory of 3016	2400	msedge.exe	123
PID 2400 wrote to memory of 3700	2400	msedge.exe	124
PID 2400 wrote to memory of 3700	2400	msedge.exe	124
PID 2400 wrote to memory of 1108	2400	msedge.exe	125
PID 2400 wrote to memory of 1932	2400	msedge.exe	126
PID 2400 wrote to memory of 1108	2400	msedge.exe	125
PID 2400 wrote to memory of 1108	2400	msedge.exe	125
PID 2400 wrote to memory of 1932	2400	msedge.exe	126
PID 2400 wrote to memory of 1932	2400	msedge.exe	126
PID 2400 wrote to memory of 1568	2400	msedge.exe	127
PID 2400 wrote to memory of 1568	2400	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa1398c728,0x7ffa1398c734,0x7ffa1398c740
    3⤵
    PID:1744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
    3⤵
    PID:1296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:13
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:1236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:2664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:5992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    PID:936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,4855643122324301106,3725896889427790116,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff9fcf9c188,0x7ff9fcf9c194,0x7ff9fcf9c1a0
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2196,i,6165997403029139711,15176441172442505392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:1568

C:\Users\Admin\AppData\Local\Temp\2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-05_56beef19d493fb2af19d97f841aaa880_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d390e06252b1f4fd65dd9e26d037a1c04bf87b5d8fdcd37d3ac43badec5c259c
MD5 08a211567589113ba01a24619f939bd5
SHA1 e64104288a4d3645a4414c47961b140555e4920c
SHA512 4db2627dc4383180ca3b6ba3ad2077d4c85ccdb50abac187bf038c29102c3d7d616a61985d5190d6206e3ed01db1ba8ee8a73c414fcbaf4d6341c034102ac481
TLSH
T182518CF7D3D8C66DC81556F49B216A2FCD2E1A28422C3C66C8D8AE5B53E2472D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0cb4212be094e45e80f2fb7be3166230dbcb2c5e422bcebf09c25b502ac22c9b
MD5 2837f44bdab3895be385856312639bab
SHA1 05f8c7d75bd9af585e06af3dd3226682e0c085ce
SHA512 704b7b44e18355c535ef5c44575a0c84c5c1e09565c714603a1566e52b8f67182a315d53bc0a516ba40627289ca1e4eaf3744f7be9f04298cb239ef4bf9387b8
SSDEEP 192:NuR1BM/s3FwGv7WAPRp2O9PHsb+WNnLjdiweWVyIsnAUge:UR12CrzXh1wPdBe
TLSH
T16832C62EBE58653F5DCBD229FA257B53E7F5102131942E84EAFC8A2C16D76CC2213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 53409a3f08d008ed9bd09906adf0d6a9813bb13c8a996f953de96f1f6b1378ac
MD5 342269afe0758e5d3a937b246d3de1d1
SHA1 f83cf8d766119d3fb98764bef51d03f53e3593cd
SHA512 64d45f22ebdae0ae68c7f8b0589b11df6dd63c20e92b643c0d2ab8bceae353d37a6de7a84724b5f4f77f3a7e2a45e9c60a7dd23845354873dcbc86d8a041cd22
SSDEEP 192:NuR1BM/s3FwGv7WOtPRp38O9PHsb+WNnLjdpweRVyIsnAUgE:UR12CrbVX3r1wPdHE
TLSH
T12632D72EBD58693F6DCBD269F9257B53E7F5102131942E44EAFC8A2C16D76CC2213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3b31e9c3e72540364606383082a9a9bf92647ec96f0b1fef195645c80812be0c
MD5 53a546c92a21d2cbb5f428be4a7c52b0
SHA1 c8b62aec78fb7481af1c1e4cca9d0bc873d85b93
SHA512 0605923c3261608f26a05b9d0fdd27e1bcf32ac2133cc19dc08b81d0ec73b36b06bed193340c9e154c12932c7974adc4278fd128dc9b31cc43fb07ee8502cc5b
SSDEEP 384:HEJcj7EJ97KxkXqKf/pUZNCgVLH2HfgslrEJ1XOD7EJd+ErU3wKHGC7aalifAujv:HEJw7EJ97KxkXqKf/pUZNCgVLH2Hfgsg
TLSH
T1BC520A67648C9A7F4FD8D68CDC136B8FACB502576668092853FB5C0903A67CF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b7581e4e406d1221ebeff564dfd365940d1f6372c2e1d596776e9c914a1b8d55
MD5 6f67ef0a238be0322a4b15d758d69aa6
SHA1 b59565f625018846fb2a3d4a1f3bc64365b39939
SHA512 17c6e3bc13eeecd3cf93ce80d63973f88fe7db0890843234bd7f9c77991fae86f96bd3a37b954096e2c9611de327bd4e5d725e0072ade3c83e633cf647408c81
TLSH
T15DA00234CDC01922DD0143706FF1394566529C1419924743A4D1244DCD7B2C09211522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f64e1fff2755fb5a8690d8accda52934f63f009189504edb0f6e6d1c46738ce5
MD5 9364518c1248fb4e09163d64b317b78e
SHA1 31186a60df210a213e59269cdb75471c68665455
SHA512 26d808cb89e7851403814f238a1011a43a78674747982ee0281b9dbccc97e6e67616787ff771afba65f6bd4b07a4e065a3778d2158fd1d7a1a200395bb4638ca
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 9041e0214d28d946e0bf12be2120277698634ab4470cc038ae4d1d7fc9f93fe1
MD5 14fc8c594f28f10fc7efc17597a7b347
SHA1 9c1499c8c33f7972b446717a4cd57595023fa86f
SHA512 de61e3d6311b7ed4b21a24a582080cb4d9b9255adef37a78a32385db5169ca657a93ea977a7c9318dbea11b0a9118789af0cafd34c9798153a29d87a66237abc
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OxYwVum/RpnO3:1nbZeMrv/hGtxYopnO3
TLSH
T1BFD3974B3A743002EDE59A721CE050BB5D3CB16D8F55A5D438B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 ab02a18d539b21671307097782aa3449a76a05c2f70c28d51bac86471eebf833
MD5 bb26abbf564462cb0163a61913565bdf
SHA1 69ee7c49300c2d70dc4e47a46160e41e96640778
SHA512 e551d6810f14f4952b75c7a2e1cfce362ec0ead3bf461593c5f0ee8a52c91dc96122eda569a789575599d4922c065f919eb332c9d4376568a256556789692992
SSDEEP 3072:Mp9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRY:wP8pYw80nubFS/sBNxm
TLSH
T18AC312723C810BBBF6B5AC187C022A5FCE159C5BCA11FF9D9EC46F8D641420A67489F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 453c63f54260012d58088ac8d2eee04d1f6439ef9d7912f31fbf8e249f0fdbaa
MD5 893271ed954aed5e78687b8137de1c1b
SHA1 7d1eee9ef4af2e8717a78172811558485a3c4ab4
SHA512 fe5b1a462b5c174f1bdaf8553bf95302fabfc8d7c91eb5e0d5cc1301de17a226c905aed8ea7cf63275b866b5ae212964b523c79ae3f34585bf9bb7cd13446988
SSDEEP 96:FC6Ld+DG/K++E0kDf8r6VsvERDotok51zDkwB6IdGyvJnv53iFPEnv4a:FC48TV1sFDUDBk0rwqv53iFsj
TLSH
T1ABA10972A07D4E7752B6D885B8562F03CF6D605BB6116E88DCE85B0C1AFB1ED1386223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 a0bc4a28b21bcff5f245f7c983c8c1e69e550236375f8ac31d640df38e7d029a
MD5 415c2cc97a89e4d35f9d2ba659792545
SHA1 79b3c1f9f718a9ce67b71742245277edc91daaa8
SHA512 cb8e656de485cdeb4ec88d008aaff3e45ee1c100d30b9f84da5940c99ddccc89db60279857fc73e71a7a64e87a3575eeb8d3979e24ccb8a1b751f7bb45b230d4
SSDEEP 3072:jp9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRY:NP8pYw80nubFS/sBNxm
TLSH
T1A2C312513C854F7FF6A9AD28BC032D5FCE194C19D611FADA9EC49FCDA06420E23885A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 7dce8cb181a2ab8876538f2d9e3ca32c2b54d07a98260c2e77bed2e45ad72288
MD5 15046fb7d4bca5fb40b553c5cd8734b5
SHA1 4739fd4b12dccaa64c1441b5256203a69efb1881
SHA512 b62d58ec7801fdb0d449294c00762d2c10530e96040c60111e07acae6b9808bbedbd5590b9898cb19aa8bb905049255974a826eb0fd48dcfa47373d0cae191d6
SSDEEP 3072:4p9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRY:EP8pYw80nubFS/sBNxm
TLSH
T1A5C312513C854F7FF6A9AD28BC032D5FCE194C19D611FADA9EC49FCDA06420E23885A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\822dacf0-b49e-4522-9d9a-235676080107\index-dir\the-real-index
Size 528B
SHA256 653bb1fa0eb4881f335916d33c286ed6ac16ce0817fb9d989c4e23727509d46b
MD5 69dfc9a197d95003e1dbc352968f232d
SHA1 39912091019b40f668417bffb11d4547d05ac6ea
SHA512 edf47da3105ba4ffbb3a9be02958c7018cc44254e93ee35097b1a45ecb77f07f04ca247ed1377def3d1097ba1f6c44507cfad31a7abd4bf399c69e31d8621629
TLSH
T19AF068B6AD812986FE2292BA5A31740D23A710FE31406A5B205E737D8F2356D5510B86
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593500.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\822dacf0-b49e-4522-9d9a-235676080107\index-dir\the-real-index~RFe593500.TMP
Size 528B
SHA256 8482f6ea4ecc06862ad1c46b360e1f5dc9255c5bbaecc231053dbe2e1c76e83a
MD5 bce06b359558cc8989e6441ce1cd1361
SHA1 ec22d44b8261196fa852715bb62c1a38f3e25866
SHA512 2b798864d0b1584d69ba12031b93fb0805158e7bdcebbd52afb0e6dc43af8b1f1829a17a6bcee788f725d45b55adc2b475ef3888d50ce908eadfea7b59580ca2
TLSH
T1F2F0C0A668E11EC2EF0096FA4F01280D33FB18317200AA0730EBB07E4933B1D6651395
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a6db2dd7a38fc10c6fec307b15761ba4cc7eedbc1ccea5878192371723bdcb10
MD5 f0e250ec8fc6baf0c7107d6051081410
SHA1 6809ae344854ebd4b43682393d934edf1b4e0a17
SHA512 033ff931a1fe19ec074020087247ee429659a49feea50619c31358af879f26199344649ec0719f0860b4fd8ba99a3349f945cb594f308ace284b0e19da83b6bf
SSDEEP 768:Jrv+4UNbdr3Tf/jy6iAwq2dlcnSl0bCTwZi1V+8rEnk:Jbsbl37ia2dynSl6bYDrEk
TLSH
T10603BF31ED189A739CE2C685B1473A13BEF841A356C50BD48DDE2F0D428B59E131B963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_283766518\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_283766518\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download