pipemagic | dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a

max time kernel
149s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
Size 4.6MB
Sample260712-p5a8dsas8k
SHA256 dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a
MD5 7e6bf818519be0a20dbc9bcb9e5728c6
SHA1 73f9469507d6162303821fc97d4809a2968f4ba3
SHA512 8824d15eefea3718b81c86134e078b5c1dbb49f9063ca636f76dba8c88e7aa7dc435a8ebf64e38528b6124e423e82f7e9ff8d40e538c78876b773db2048d4346
SSDEEP 98304:XK/cNYG9+pS2QyplZlUiQdt9fRWfWT6XQSUtaVkq9mVZR9Zw38Er6+0:tj6XlU6uZ08D+
TLSH
T1C3366C43F69585E9C06DC1B5831BA333FA33B8894524B3AB2BD44B213E55F906F5D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery pipemagic trojan

Malware Config

Extracted

Family

pipemagic

aaaaabbbbbbb.eastus.cloudapp.azure.com:443

Signatures

Family: PipeMagic
PipeMagic is a modular backdoor written in C++.
backdoor pipemagic

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1784079240\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_620450047\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1784079240\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_8247622\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_8247622\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_8247622\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1121342288\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1121342288\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1121342288\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_620450047\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2628_620450047\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283349054153887"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	msedgewebview2.exe
3332	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe
2628	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4704	dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2628	4704	dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe	88
PID 2628 wrote to memory of 4180	2628	msedgewebview2.exe	89
PID 2628 wrote to memory of 4456	2628	msedgewebview2.exe	91
PID 2628 wrote to memory of 4456	2628	msedgewebview2.exe	91
PID 2628 wrote to memory of 4456	2628	msedgewebview2.exe	91
PID 2628 wrote to memory of 4404	2628	msedgewebview2.exe	92
PID 2628 wrote to memory of 3724	2628	msedgewebview2.exe	93
PID 2628 wrote to memory of 3724	2628	msedgewebview2.exe	93
PID 2628 wrote to memory of 420	2628	msedgewebview2.exe	94
PID 2628 wrote to memory of 420	2628	msedgewebview2.exe	94
PID 2628 wrote to memory of 420	2628	msedgewebview2.exe	94
PID 2628 wrote to memory of 3148	2628	msedgewebview2.exe	95
PID 2628 wrote to memory of 3148	2628	msedgewebview2.exe	95
PID 2628 wrote to memory of 3148	2628	msedgewebview2.exe	95
PID 2628 wrote to memory of 1048	2628	msedgewebview2.exe	96
PID 2628 wrote to memory of 1048	2628	msedgewebview2.exe	96
PID 2628 wrote to memory of 1048	2628	msedgewebview2.exe	96
PID 2628 wrote to memory of 2256	2628	msedgewebview2.exe	98
PID 2628 wrote to memory of 2256	2628	msedgewebview2.exe	98
PID 2628 wrote to memory of 2256	2628	msedgewebview2.exe	98
PID 2628 wrote to memory of 4488	2628	msedgewebview2.exe	99
PID 2628 wrote to memory of 4488	2628	msedgewebview2.exe	99
PID 2628 wrote to memory of 4488	2628	msedgewebview2.exe	99
PID 2628 wrote to memory of 1728	2628	msedgewebview2.exe	100
PID 2628 wrote to memory of 1728	2628	msedgewebview2.exe	100
PID 2628 wrote to memory of 1728	2628	msedgewebview2.exe	100
PID 2628 wrote to memory of 4304	2628	msedgewebview2.exe	105
PID 2628 wrote to memory of 4304	2628	msedgewebview2.exe	105
PID 2628 wrote to memory of 4304	2628	msedgewebview2.exe	105
PID 2628 wrote to memory of 1876	2628	msedgewebview2.exe	107
PID 2628 wrote to memory of 1876	2628	msedgewebview2.exe	107
PID 2628 wrote to memory of 1876	2628	msedgewebview2.exe	107
PID 2628 wrote to memory of 5108	2628	msedgewebview2.exe	110
PID 2628 wrote to memory of 5108	2628	msedgewebview2.exe	110
PID 2628 wrote to memory of 3540	2628	msedgewebview2.exe	111
PID 2628 wrote to memory of 3540	2628	msedgewebview2.exe	111
PID 2628 wrote to memory of 3164	2628	msedgewebview2.exe	112
PID 2628 wrote to memory of 3164	2628	msedgewebview2.exe	112
PID 2628 wrote to memory of 3164	2628	msedgewebview2.exe	112
PID 2628 wrote to memory of 3312	2628	msedgewebview2.exe	113
PID 2628 wrote to memory of 3312	2628	msedgewebview2.exe	113
PID 2628 wrote to memory of 3332	2628	msedgewebview2.exe	114
PID 2628 wrote to memory of 652	2628	msedgewebview2.exe	115
PID 2628 wrote to memory of 652	2628	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4704.1460.16320591962228833462
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff4099b078,0x7fff4099b084,0x7fff4099b090
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2392,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4104,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4308,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4448,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4404,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3916,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3764,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=2320,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4972,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4160,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3888,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4968,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1208,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,12068809981361074583,5746600590255823442,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
    3⤵
    PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1121342288\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1784079240\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2628_1784079240\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2628_8247622\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

272a76bf-4819-4d07-8332-fbc825869199.tmp

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\272a76bf-4819-4d07-8332-fbc825869199.tmp
Size 2KB
SHA256 2b4a0eb1de2c8bf251ee54ba7e9c74c77524b0a8518fc09dcf0c048f63d0adcd
MD5 f19fbe307ee156c4cfc85d803b6ca327
SHA1 018147d3af8ff3c2530f4ef69121de89a8102575
SHA512 51349dd08ae1aa29eee0d1cf80624948479ba6d1fd70043d2728a763ebbb23ab3e965ab94bda0e253a5772e6d5ea024231cb3e830d798f12c8cd5c4cccbf1e71
TLSH
T12D51C573B8089B7759D34B88F84D7F07AD354162A6E12FA456DD0B0C01EB67C2342C36
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e6e30240a21e2bd0ad90622778aa52b50e349c77180e52194a932bec63d9f10
MD5 0a84f578cd5e94761a78bf83f5ab527c
SHA1 ab3720dcf80e3a5e312ea4eb0823d8bf1fa3a535
SHA512 4758445d53305368f59862a219c23ec9aa262ce07b3e9ad58d84648d32e24a091718d712f27d5a37a71ffaca87e3c5cad39e8fd8ee13bd4a565497b171fa28c4
TLSH
T1BCD0122632030A74C01024730C56A2080800C20B620540806539C91E5B440542D1A843
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4c7a6c7b75c27c484f17afbd613a3b5201fdbcdac5f4e648b5a7c6d40a3b9900
MD5 50c9ffc02a403d3b47b8c7249c922b08
SHA1 f24cdc375e23f07b9e3aa25e100cf1fb1aa5f178
SHA512 a1d4e47d1c2a24d0d60c6059310846f1d8bc50f1a7d19f4b8d09e3c65103cf6759ac64d3794a35a7905850ee9605a876acb7570e5c5c32d8194a5e275f8598bf
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Cache\Cache_Data\f_000001
Size 193KB
SHA256 bdc8261b6743386ac1b5e4bee7d9f693e18567f44f39ab97fa75897401864298
MD5 33909a8cdb4bcf1d64329cf9387e516b
SHA1 84d32bb2fef5ae2251be235452827943a6acb888
SHA512 7ada32bba922b2950925a250097051a1fc1cd2b6aa169ff3415f255fe484989e211b244f730c1e20b89c30a6e7414e289674fc21b975aa862887e4c165b47cad
SSDEEP 3072:PSLlexsFGGOkvi8d9rrxqYZgipNDC6sPgSli8xoKh1vFsJuF5:PUeWkSZ9rrRgiNChPgKxoAII
TLSH
T1A51412E25570472EC00825FFB3A5A60FC88B1F658D65F6702E1F73F97A888460E38E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 76825f689a7da91cd940df4dc7ac068cffd1e161c96e799f9df59823fcb939e3
MD5 a40a30cae675efe6405eff43abf46168
SHA1 928237c6dde0b83c67dae5b4f7d3d9ac32c20771
SHA512 0cdb9ebfc8f88c03e5bd94db4c3efa33ed4b47f7b1421a6909529aa05cd6abb3b6e903c314b61a11c41a900017981ffeeebcb8227c52ae491d86c8573a809587
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 577d62fe6defff2f365eb8b90711524ed69ee800e305c1216b15fff44afaefd0
MD5 3abbd2b34f13cd4c2a13b351b402acf5
SHA1 6d678c08a46fc5945f073f3e941f3fa16c48cb32
SHA512 38a099454bee4828476fa972bd39d566a1b5d2cb76581ecb6f86639ea856024b046e5263dc1a652e0f9986f4bd44d233a59b231aed36b512adab532f12867c9b
TLSH
T12871F5D5934470F3E3B5BFFCB4DC48C0B6F1544869134CD932D5917A0922780B2E22C9
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 1551aad227a8cefb4f9dda0d7d0b081d7507042a88f6af038b77e364ef62e5db
MD5 0965989875d45c5d5dd1bc769f289705
SHA1 f3ac13be9a5a3e5affc4102d6ab7974af837048f
SHA512 0318ac12a5ddef354dd7b49f31002cf2721c26a0e6eb36fd08d8e94481029e0ba4d702ab47ce3826f51e0a45850e8393f3b87f8495a85fdfe4bbb4049eb4c236
SSDEEP 3:LstlNllkll/lE/:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 51edb3aa182b1ad2166ecdfd16878233bf7456382b3b02ea126cf98e9966d8ee
MD5 8e3bea2c4aec0fba97bd1a0b64d069df
SHA1 6d7344f31676167e52e3631faccf902fcb5f6eec
SHA512 fea720e05b6b071618841eadae26a8f03d7159f6d14574d325c5e41cdad49bd914e4e496ae8b059aed7129d873e24fce3938ad33b83e79eb9399c27e31e3a3c9
TLSH
T1CF216DE7C7E8426EDB6102F82A342E2FCD7E182843183939C9D5EB5B97E0575E10065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State
Size 810B
SHA256 c6b330bc9fb94267e3d9a012518e7469bc8a56d6f412128acb0187a3c0252d90
MD5 2cdf74afebe9b2de118e9f8c14af24c8
SHA1 b8540e3f5bfaef757b74ac4890c626be79119ca0
SHA512 f06f4bc207e231aabf241979f5dc64de00fc500c2d9002648f2ec0536dc27953f8b6c67d78515e256907dccd07561b46b7a9cdeb17d75446f3fd33c3887dcb25
TLSH
T184014EF7C3E4066EDB6102F42A342E2FCE7E1428075C3939C9D1AB5797E0576E10495B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State
Size 810B
SHA256 cc7d925d410e75544adbaad01542cfce2f795de5493495a02e1d6426a65f72dd
MD5 67600b0b3eedc356e1ebe1f7d5aa79b6
SHA1 748b4c3aa45a2353fc0006a8ac0f304f41a1d551
SHA512 8f21d41a6d9ce8254d3b4f3c0dece28938d2ed3e3498d93558f436856a93982a4095d27ad3561f75f2152be6d50ebec87ffdb12c788df47e440a9188a531beec
TLSH
T11B014EF7C3E4066EDB6102F42A342E2FCE7E1428075C3939C9D1AB5797E0575E10495B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1d2e.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State~RFe5a1d2e.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 b3087de1acd555923100bfb314b13e1a2a4cd898cbd12b63e4d4c4eca121a925
MD5 817a3ea44b3f4cfdfde3aa873f04550b
SHA1 f005d84df57db349fa1292832d5e7c293d0fbca9
SHA512 bc9d781c8cf96df8efb156475300c7faa76db7cbd99bc5b9c0f4256b4174e2b773f73941e678203d935b7e9e60bb89701096857ac16baec51f2020cba56687b2
TLSH
T12CE0D8E2417AF0365079099A0ED9B9092E3DF835018258F5E586566CE1600FB91030A3
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 3c45b8790c8ce08d7c4a25aa15bb7fd75b8a1264d4077bc6999e4d62a9be26d6
MD5 a1952430c55258fa67f05cd24becbd70
SHA1 73071ce3166a884d1321d76bc4ceae0baad87922
SHA512 a5cbd53b27e928c2123e68fd48fcbbeaf8c88681096ae541ccae2667d569fe4030922f956c4e906837059fe505b3e7a0b9ee6184aa471639cee20a97949eee8c
TLSH
T174E0DFE3857EF82A543B4AAA0FD5BD052E7AB839418198E6E657966CE0504BA46020A2
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59afaf.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity~RFe59afaf.TMP
Size 355B
SHA256 7b151647337061b077de74470315ce20f25c37e0232093c6a1dbcbfb7d8844cf
MD5 398db7929f64a7abdabcd1654696bd72
SHA1 ac515c0b5113f4e01a5f35596f9513bb10f8470d
SHA512 782927911e69c6e85e5f67372da635682ff3237138fe67d78e43eed6668cc8f54e7f4abf77890eb533f24e14b2721b2ccb51f8bfdffa0ad1c3797b805fbb0901
TLSH
T140E020E3457EF47A543D45E70EC47D051F79F83942919CE5E556967CF0704BA5103053
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Preferences
Size 6KB
SHA256 30f57db8f3e46410160a5e488a99741b517e34028be86d12cebcd074bcf00054
MD5 83f10d14639c0ca53cfd85358dcd0b96
SHA1 bd08fb0a2133aea5c237d32510c7614e364b7b38
SHA512 27c1673bc2029b3aaadc3b3950b8a073252d209919060326113a6600de334b32bc3eb97712aa8b05baed1763322390ff9981e9a09ae400ac7e0da6a6a18510bc
SSDEEP 96:sth05spQib9dff4Z8i0vhECkUxyvm/7qx+WVHMSm+uecLh7zN1iWKQjZ+g50GoMC:sth0SvfAZ8pawQu/S+WiT7BwWKUgGoMC
TLSH
T125E1A7535E2869775CC7F61DBA35FB56E2F6102266D50E98EBFCC60C04E66EC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a36a.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Preferences~RFe59a36a.TMP
Size 6KB
SHA256 df58a8ac0955d106b7206080b1cdf9a464880bfda6e5eee6f2c55668812b81ed
MD5 5fd19341ef7a93cdf1588c2332b08037
SHA1 df3354abf4eb666acea7580fc1a0289edff6a59d
SHA512 ae33dab51b6bfad64bb8c729e0f48669f0f66f7a50c014b850fa3325ae1d8b90de0c1fa6d2870ba3d82b29b95bf5b01b32c771bd603a547ead3f5b612760b1b6
SSDEEP 96:sth05spQib9zff4Z8i0vhECkUxyvm/7qx+WVHMSm+uecLh7zN1iWKQjZ+g5JGoM8:sth0S5fAZ8pawQu/S+WiT7BwWKUtGoM8
TLSH
T1B2D1A6535E2869774CC7E219BA35FB46E2FA102266D50E98EBFCC61C04D66EC2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State
Size 1KB
SHA256 2c70415ac1038f1d15d3dcc32715771dabbdfae992df66114b5a5b18ed560c26
MD5 dec739fb5dd0c2fe8821f0adf7e9b2b8
SHA1 bff495965d6d5f6643b78abf0dff79e00a3dcaf3
SHA512 57013a1724ef86ffa3a9cca62ddbbf8120eb754360919cf431a52fc7424d8cc43c402aa80287936ce933037963d60a2e8ff94ecc5f008ed147b957401288499e
TLSH
T10F316573E0445F737DC25785F546FA4B2D600026A1A14E5852DD8B0C02F79BC966AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State
Size 3KB
SHA256 717154c54834000143c44297fdf0f808e314e7d84659746d7d853bc646a06366
MD5 aa01849d21dcfc6421bab3d48483bd98
SHA1 23b3e1b2e064a074fe8e17146651b0253bbd4a84
SHA512 501b993b7443f0ce735c6cc163eab849a2c6028f3c73b30390d8a385c0f01f3dbcdc64b36f1a7f8c4de636e165d5f56732ac2b41a611d305d06a34812de6f7a1
TLSH
T16E719737646899775DE39A44F8896B0ABAA54127E5D13FA8C6EC0F0C01DB7AC1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State
Size 16KB
SHA256 82104609aaf82d12ba358bc984a6cf9e2e8221c51652cec7173b4589127aeb02
MD5 e84aaf1a5301af82c9166c56bc1fcb58
SHA1 4254a56c563f246aad1d0100363e9d4b1e5d898d
SHA512 77e6b428761999515dab65b565155b310b70918f0642c53a2c5b8457b5ca30564fb6946a0fcfb98bfad66148d66fa367fffc3ce60bd7abeb84a6caeb91417c0a
SSDEEP 384:zAsrv+89zHqlDNP9oidw3Nb8scprIjAPyNk:Hrv+4UNbdwPyIjAaNk
TLSH
T17272AE33A42C97336DF3A944F44A6A0B7F785156A1C20BA4D99D4F8E429E0ED2306D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59044c.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State~RFe59044c.TMP
Size 1KB
SHA256 49c04b37e3338e9ff2682ccf1d85d81bb54f87c434b0a1d773def62071f95c17
MD5 5dbf4462fcdde88a3b645c6f139b78e1
SHA1 b0e83ccf602c5bc0b155b8bc0689aa8a9281099e
SHA512 a9202cf735a2390e605df7e10d6dbec249ba1a10f6385a1e2cf39ec7ebacc28166453a8d8b94f65771f708e3f905d5a2b59f98c3718a06411b973178123bbdbc
TLSH
T197215473D0456FB27D811A89F546FB8F3D904126A2A05E5C93DE870C02FB9BC967AC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-134-0x00007FFF5BCC0000-0x00007FFF5BCC1000-memory.dmp

Download

memory/3332-597-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-601-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-602-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-604-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-595-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-596-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-605-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-606-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-603-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3332-607-0x000002BC272D0000-0x000002BC272D1000-memory.dmp

Download

memory/3724-49-0x00007FFF5C6B0000-0x00007FFF5C6B1000-memory.dmp

Download

memory/3724-48-0x00007FFF5BAF0000-0x00007FFF5BAF1000-memory.dmp

Download

memory/4456-30-0x00007FFF5BCC0000-0x00007FFF5BCC1000-memory.dmp

Download

memory/4704-208-0x000001CF3EC90000-0x000001CF3ECB5000-memory.dmp

Download

memory/4704-206-0x000001CF3EC50000-0x000001CF3EC6A000-memory.dmp

Download

memory/4704-207-0x000001CF3EC70000-0x000001CF3EC8D000-memory.dmp

Download