pipemagic | dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a

max time kernel
148s
max time network
177s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
Size 4.6MB
Sample260712-p5a8dsas8k
SHA256 dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a
MD5 7e6bf818519be0a20dbc9bcb9e5728c6
SHA1 73f9469507d6162303821fc97d4809a2968f4ba3
SHA512 8824d15eefea3718b81c86134e078b5c1dbb49f9063ca636f76dba8c88e7aa7dc435a8ebf64e38528b6124e423e82f7e9ff8d40e538c78876b773db2048d4346
SSDEEP 98304:XK/cNYG9+pS2QyplZlUiQdt9fRWfWT6XQSUtaVkq9mVZR9Zw38Er6+0:tj6XlU6uZ08D+
TLSH
T1C3366C43F69585E9C06DC1B5831BA333FA33B8894524B3AB2BD44B213E55F906F5D3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery pipemagic trojan

Malware Config

Extracted

Family

pipemagic

aaaaabbbbbbb.eastus.cloudapp.azure.com:443

Signatures

Family: PipeMagic
PipeMagic is a modular backdoor written in C++.
backdoor pipemagic

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_23467701\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_23467701\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_729492966\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_729492966\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_729492966\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_1817326389\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_1817326389\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_23467701\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5284	msedgewebview2.exe
5284	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe
4512	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4840	dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4512	4840	dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe	88
PID 4512 wrote to memory of 4744	4512	msedgewebview2.exe	89
PID 4512 wrote to memory of 2228	4512	msedgewebview2.exe	90
PID 4512 wrote to memory of 2228	4512	msedgewebview2.exe	90
PID 4512 wrote to memory of 2228	4512	msedgewebview2.exe	90
PID 4512 wrote to memory of 2228	4512	msedgewebview2.exe	90
PID 4512 wrote to memory of 4456	4512	msedgewebview2.exe	91
PID 4512 wrote to memory of 2668	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 2668	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 2668	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 6068	4512	msedgewebview2.exe	93
PID 4512 wrote to memory of 6068	4512	msedgewebview2.exe	93
PID 4512 wrote to memory of 6068	4512	msedgewebview2.exe	93
PID 4512 wrote to memory of 6068	4512	msedgewebview2.exe	93
PID 4512 wrote to memory of 6068	4512	msedgewebview2.exe	93
PID 4512 wrote to memory of 2896	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 2896	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 2896	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 2896	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 2896	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 4828	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 4828	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 4828	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 4828	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 4828	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 3836	4512	msedgewebview2.exe	96
PID 4512 wrote to memory of 3836	4512	msedgewebview2.exe	96
PID 4512 wrote to memory of 3836	4512	msedgewebview2.exe	96
PID 4512 wrote to memory of 3836	4512	msedgewebview2.exe	96
PID 4512 wrote to memory of 3836	4512	msedgewebview2.exe	96
PID 4512 wrote to memory of 5484	4512	msedgewebview2.exe	97
PID 4512 wrote to memory of 5484	4512	msedgewebview2.exe	97
PID 4512 wrote to memory of 5484	4512	msedgewebview2.exe	97
PID 4512 wrote to memory of 5484	4512	msedgewebview2.exe	97
PID 4512 wrote to memory of 5484	4512	msedgewebview2.exe	97
PID 4512 wrote to memory of 5052	4512	msedgewebview2.exe	98
PID 4512 wrote to memory of 5052	4512	msedgewebview2.exe	98
PID 4512 wrote to memory of 5052	4512	msedgewebview2.exe	98
PID 4512 wrote to memory of 5052	4512	msedgewebview2.exe	98
PID 4512 wrote to memory of 5052	4512	msedgewebview2.exe	98
PID 4512 wrote to memory of 1372	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 1372	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 1372	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 1372	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 1372	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 2784	4512	msedgewebview2.exe	101
PID 4512 wrote to memory of 2784	4512	msedgewebview2.exe	101
PID 4512 wrote to memory of 2784	4512	msedgewebview2.exe	101
PID 4512 wrote to memory of 2784	4512	msedgewebview2.exe	101
PID 4512 wrote to memory of 2784	4512	msedgewebview2.exe	101
PID 4512 wrote to memory of 1580	4512	msedgewebview2.exe	104
PID 4512 wrote to memory of 1580	4512	msedgewebview2.exe	104
PID 4512 wrote to memory of 1580	4512	msedgewebview2.exe	104
PID 4512 wrote to memory of 2736	4512	msedgewebview2.exe	105
PID 4512 wrote to memory of 2736	4512	msedgewebview2.exe	105
PID 4512 wrote to memory of 2736	4512	msedgewebview2.exe	105
PID 4512 wrote to memory of 3456	4512	msedgewebview2.exe	106
PID 4512 wrote to memory of 3456	4512	msedgewebview2.exe	106
PID 4512 wrote to memory of 3456	4512	msedgewebview2.exe	106
PID 4512 wrote to memory of 3456	4512	msedgewebview2.exe	106
PID 4512 wrote to memory of 3456	4512	msedgewebview2.exe	106
PID 4512 wrote to memory of 5284	4512	msedgewebview2.exe	107
PID 4512 wrote to memory of 1364	4512	msedgewebview2.exe	108
PID 4512 wrote to memory of 1364	4512	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4840.3244.7461850891633823474 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView /prefetch:4 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe9b1d5fd8,0x7ffe9b1d5fe4,0x7ffe9b1d5ff0
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3012 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3212 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3600 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4204 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4388 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4632 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3672 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3568 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=1936 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4984 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3628 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4212 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4320 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView" --webview-exe-name=dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5068 --field-trial-handle=1792,i,13048830588981116289,18020293145568840433,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5e254d46b460ecb74214f3ab4b5eba28ae8cf6bf
    3⤵
    PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ff9b49a045363d117cfcd2505d4a127fbdd0357a54d4559dd460669024dca38d
MD5 77c1223d7415aeecaffaa6c7b59f3bc4
SHA1 892856454c0739b91fcfd81de11eb5c3aaa8c264
SHA512 1248de0fb0961e3c1595e84a0ab799db86835cb3e90131480393e3ecffd9c23468940951fb5c7c320bc7e136d880561c36b062f9f331dab346060671efa93cf4
TLSH
T118D01217360109B4C0202133030261088800D31B40464106582C853E1B14055090B481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e00917eb62bab874a9fd88da4a0656d07fda7ba9d737cfdb64718c256f5f3fd6
MD5 2a3f802e2ea4d0d0a7c0e684bdf9556b
SHA1 5a8e94990a7704f021606a7eb40cf4b133493ff9
SHA512 9ab3d9625f247b69a3ad93690b8540a173ee1863a22d4dd7ea6f154754c1f21b499b344c30a304ac485b55fee9e7a96a0afce766d2f5f0579eed284f6304ff3d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3758cbab-6a5d-403f-a671-ff1d9085c533.tmp

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\3758cbab-6a5d-403f-a671-ff1d9085c533.tmp
Size 6KB
SHA256 fda316621b5e3d3353a50df131f06d1185e2e3100710be4b21d8e3f0e165bbd1
MD5 54e1e4731b3c901d8a0ea9281b54e2a9
SHA1 d05f53f3ded9af46c624814b2b1118e65313b6a0
SHA512 e163bf33f89e8d61ee650566c5055e5a8984dd6e00dda84632cb203ae209219c7ce7b8d8c86b1f2ed44ab0deebffec671f980098302542a9d9ce2bdc115b836f
SSDEEP 96:sth/dqUi7wb9Gkbko5h16ZJoJyOs7/x+6MhmuecLhKozX1eoue45K+gkn28XM1CO:stVgUg6koyoIOsV+FJLjQouocG6K
TLSH
T1B5D1B4135A24697B5CC6E649BB25BA4BE2F5603271D12E58EBFC871C04DB6DC2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Cache\Cache_Data\f_000004
Size 194KB
SHA256 33272d42014cb0d97171ba6125046062483dc3b3db6cdd85631196db096ef0c3
MD5 8ed677bd203d968c677d97c225eb0904
SHA1 059eedc56a3afba699ef7ab8948110efb6acfc16
SHA512 f6d1d8c97adf6920f2eb484e9622b32fdbdb679dc9e87f185ae49eb1581ff5d59b1aa295e100ae4df06390353eb4b813fba89122e5cb752a97703176f5ddc256
SSDEEP 6144:hJxMsQNTQSLHw92QwtbsNhKobX39f+a/T9CLIOEyu+:hgs8TQAw9TDfActyn
TLSH
T1971412CC05BFA460EC976D408E466FEBE72C451462B6653EA9F2D59D33CF583CA4C228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ae4c351bd8a4ecc35472200496ca91aed757abea61bd172e7b85a1d7d77b5d0b
MD5 000c2455a2c788b234d5f911c25db4e8
SHA1 be01ef0960d43baac201a894bf50a8ca879aa608
SHA512 8cc4f4138cf8621be28bb50fda26caa00362563f2029657dd1222abc2b4e1bfd0f1162810133a3379f043bbe05cda53344d9a0088786c7ec083ff10b770d6f32
TLSH
T16281F7A22B4C60E4D34E31BFB8D64C68F6B500290BABCCE6359A95B9447F790E3D149C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a478a.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a478a.TMP
Size 48B
SHA256 f848956c0939a562e1398bd9b95ad52d13b3dc389c9d978627308c91b035ca01
MD5 d83def5ca7376e31550577c37c1716bc
SHA1 fbb4abfff0b9dd777c825771180186a0110fba7f
SHA512 8b85fdeee0d10913726420c473667c60da0a0d81e587e57aff68a7f487d8adf3690ae924f35512b5f735e821dc6f995c089036d9107e52f1078182126f798bab
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State
Size 810B
SHA256 c277ffe3ddf68a477609f38e8e2a8a6d5bfeb7ec4fc176b8e3f41976b5b4e938
MD5 1e8b39950290408be9d686d5c73b76f8
SHA1 a6537ccf987abbc2fb24e59ef45878ecfc349996
SHA512 0517c9ee01f4eb006a0a232205f9d39333f0079e2e96940407a17a32945943b88d412c19fabf2a55d2472ee6a7f68699277921ff96b968140e0196f97ff65516
TLSH
T1400149F7C3E4066EDB6102F82A346D2FCE7E0824071C3939C9D5AB5797E0576E10495B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 81dcb80ad31b48cf625cea6b5db92b1d5ac8533cfde1ae53b9083c066cac7052
MD5 dce85962e7f2aafd427d68781bc7a5e1
SHA1 508ff447615a31fb0427634e9b4f71aef0bc3559
SHA512 f107a1ca623aa5a681f95317f5b0ccd6a5cbcd2001d26a001b3b830c263f82b64c3b193c18dead3f16d3b06c3a20ba544d61404d83aaa33b1147ddbb1b7c961c
TLSH
T112214BE7C7E8426EDB6112F42A342D2FCE7E082803183D39C9D5EB5B97E0575E10065B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a16f4.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\Network Persistent State~RFe5a16f4.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 edcf5239d35ea1af09dc73665b3a236061c55748e798079f5bc77174635df584
MD5 7bde0209643bd197fb09eb1d0cca4e4f
SHA1 5141c3b656a9a9687e70147fc6a5025dc485d760
SHA512 6d579715555289534c1e313da69af336e4ce45c682284de3a57c7642a7f1bbfb483eebf0b0cde2e752f6e53a7a8485d613f18bf2b10a90e50dafb0b7fd310c75
TLSH
T14BE020F3817FF067603D09AF4D987D061E3DF43111819CE4D5579A7CE1A00FA0212467
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 be31941ecfef245fa10489d5870a9cf4a2ac1dd1d45511102690c9f9d624ab63
MD5 a3a3622bdc6e3ea30e252c29cb5a1bc2
SHA1 19fabab9f1392a123686e54c2d31acb2137149ea
SHA512 f45155ce5a3ed97cb77705aa16c5fe85bc6d0d01a9aa2a336e72270665175ecc3f1c7bb23c8a3bd27fb12a5f5140bae4eb491b7d5892bffa032cd79a90f5712e
TLSH
T131E020F3A17EF066503D09AF4E987D051E39F831018198E4E557967CE1B00FA4216167
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 1a99b169160b891a4f9938d324e9ed99fd24a06ce9f6afe6390ecf7765122f52
MD5 3f911b4a150718c9039d57c70aaf9e1c
SHA1 f548b9f9976432aa77dca0d35e88eb102ea954af
SHA512 924aa873139f8364a3c78a3fcf677463cdaddc63afb5e90d41659bbc1b6ccbe3320a49794e4d4ef63892951878d86ffd6d3d0b14444eb10653f5e7cc881df66a
TLSH
T174E0DFE2827AF026606D09AB0E85BD866F3AB0324191A9E8D596823CE1540BB5702063
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59dcca.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Network\TransportSecurity~RFe59dcca.TMP
Size 355B
SHA256 197a048cb58452dc742e83b067bf194f39acc43019368912eb4db6c779a7af72
MD5 e0f0f2a5e7c6c8aaf91e7d12778da63c
SHA1 3ffc2bf48f5b7295d493c296f8202f89e5df1568
SHA512 79459e43e71a7ad1e21acab608b55763b92fb4866db4ae037ed90e4015d3b547f96bf3041f9cbcddd8f7d7072cd7184ca6ba87eb1413c40fce7eb7ffa96158c9
TLSH
T1F0E0D8E3817AF036907909AA0DC87D195E39B832018158E4E65696BCE0500BA42135A7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Default\Preferences
Size 6KB
SHA256 e4fa55431782c978d77c220260c6cef77ee24f9fb7d8c328a28a1a70fd97d302
MD5 134a672a164711092524de615e0d8859
SHA1 5b15ff7c9f22b37d689c1a60a04f85f74bba42b0
SHA512 a3f2ba35c6726aec17a3e0b30122ac376d4bb985aceff6e098fc14779052d4dd0a4ae08d1dd1ed99f9fd420d51cb198cf8dffe8250588c07afea5dff56b4b96a
SSDEEP 96:sth/dqUiqGwb9Gkbko5h16ZJoJyOs7/x+6MhmuecLhKozX1eoue45K+gkeX28XMz:stVgU+6koyoIOsV+FJLjQouoHXG6K
TLSH
T153D1B6035A24697B5CC7E659BB25BA57E2F5603271D12E58EBFC871C04DB6EC2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State
Size 15KB
SHA256 46c0ef5301795fd3e86eb10e349df4442bf684004dd9423614db575a8cc03d30
MD5 c19df4134933af5df680d2ee11df9c5d
SHA1 78ab2ad1bdd89f7e98cb6b76852d06ec36b55508
SHA512 55bb35789d6e780c54edaa7864fff127cb0af8456f683e78cf04df7f5379bf44b0fb8c81b1c6533fd03567fa789f3e7257c7dfdc528567b3b9c67139bd46feab
SSDEEP 384:qsrv+89zHqlDNP9oid93NBSWUWegigfF43RnYeN2:1rv+4UNbd9Ono43RntN2
TLSH
T1C072BF33D578AA339DB38509B44AAE0B7FB8619762C20B64DAD95B4C81CB4E93307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State
Size 2KB
SHA256 2d3b638fd89b51a6f5ff16f67c7502332405cadcc07070c9339b8ece865e664b
MD5 57ba8f4ee0ad09bccf6774d5e8729a4f
SHA1 e0aed666489ccda88add0f5a51826fdc30c7cc7e
SHA512 fcf5532e225781e3d78128506d7949dfa0b0dd04f2d8132c3333e983df633b3e62ea12ff4b9d97ae9fc9bc33b0d15799ad3759e4203890dc0ed97111aa4812c7
TLSH
T1E55195735910AA3399A396057E4ABFA7DF7551A2AB822F54AADC0B0801C395C2347C72
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State
Size 3KB
SHA256 2afcbee233d2eaa122995295c643ddb81e3d8ef7f37c1cc46c108e5e4fcf851d
MD5 bef6eb6fcdb8944d0652c9e486d68271
SHA1 ea355c7e725515397b598f340967e86d3bc39e32
SHA512 e723b5d0a8acc869ff18b1317f5a4d8869f6c7057145762b22e4476c6d6daf470d548eda22aa05eb9f9a93b2974270f9d68ff47cc8b32cd53f038718cb179a9a
TLSH
T15E71A47B5960A9374DA39A05BD867B5ABBA54127E9C23F94DAEC0F0C01C36981343C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5978ff.TMP

Path C:\Users\Admin\AppData\Local\com.nofwl.chatgpt\EBWebView\Local State~RFe5978ff.TMP
Size 1KB
SHA256 c65097822b7eacab098efca178a1bc791ff7c51e4a1faca4162f2a19a0ae672b
MD5 a3f5ab07b4725390ce7cee4d08d75337
SHA1 e23a6ca57ee25607830b84637526aa8dee1ebd3b
SHA512 216d7774638a41cffbb3e41ff9e638e330f4142c419cc695a5aeb4bdd5cd1d7222158dd625e095c569cffa1b1ff0a0fcb71ee9f6b3726ba3280ea39a8ae3199f
TLSH
T1353154B686906B32AC8362463A46FADBAF7101B692424F4476DD4B0805D355C666FD32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1372-451-0x0000026E9C7A0000-0x0000026E9C847000-memory.dmp

Download

memory/1580-560-0x00007FFEBD0C0000-0x00007FFEBD0C1000-memory.dmp

Download

memory/1580-561-0x00007FFEBD680000-0x00007FFEBD681000-memory.dmp

Download

memory/2228-314-0x0000012364B30000-0x0000012364BD7000-memory.dmp

Download

memory/2228-105-0x00007FFEBD3F0000-0x00007FFEBD3F1000-memory.dmp

Download

memory/2784-506-0x00000202F28F0000-0x00000202F2997000-memory.dmp

Download

memory/2896-225-0x00000299F6A20000-0x00000299F6AC7000-memory.dmp

Download

memory/3456-615-0x000001C06C940000-0x000001C06C9E7000-memory.dmp

Download

memory/3836-446-0x0000021EB5F00000-0x0000021EB5FA7000-memory.dmp

Download

memory/4828-201-0x0000024036C60000-0x0000024036D07000-memory.dmp

Download

memory/4840-188-0x0000027C173C0000-0x0000027C173E5000-memory.dmp

Download

memory/4840-187-0x0000027C173A0000-0x0000027C173BD000-memory.dmp

Download

memory/4840-186-0x0000027C17380000-0x0000027C1739A000-memory.dmp

Download

memory/5052-255-0x0000027DD9D20000-0x0000027DD9DC7000-memory.dmp

Download

memory/5284-620-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-622-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-629-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-630-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-628-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-627-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-626-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5284-631-0x0000015FB39B0000-0x0000015FB39B1000-memory.dmp

Download

memory/5484-450-0x00000179D2F40000-0x00000179D2FE7000-memory.dmp

Download

memory/6068-106-0x00007FFEBD3F0000-0x00007FFEBD3F1000-memory.dmp

Download

memory/6068-226-0x000001C528F30000-0x000001C528FD7000-memory.dmp

Download