destiny_stealer | 6ce3b06155624aa0600182302cc3bda88004595b812d4c70a542f5992bc815a5

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/07/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 15.9MB
Sample260726-1s2qcssscx
SHA256 6ce3b06155624aa0600182302cc3bda88004595b812d4c70a542f5992bc815a5
MD5 4ea56c31e7c6994a21f0173c4d624ce5
SHA1 77fb5342dbad7e4d19cd5a7da7991016ac538032
SHA512 a81062867395382fafa4b8c232b0426bfd2cdd46896772b6b3b5d53001ce0a2db286e4eb6d679d067ef36533c8a04a9ca5cd22bd67055a5159b7bc10fddb8744
SSDEEP 393216:ISn5ZSpQoNPj0OKPvzSFKcIfXMCHWUjgGwp15Qi:NmSy9KPvzuKc+XMb8gZj
TLSH
T1E1F63307735C42EFECA35532B1BA897A9611FC1B4B20C6CB76E4D56E0E174CC1A39AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution destiny_stealer stealer

Malware Config

Extracted

Family

destiny_stealer

77.110.115.255

Attributes

port
8888

Signatures

Family: Destiny Stealer
DestinyStealer is a stealer written in C#.
stealer destiny_stealer

Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000246ef-429.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral1/memory/3632-431-0x0000000000EA0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000246ef-429.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/3632-431-0x0000000000EA0000-0x000000000195E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detected Nirsoft tools 29 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/4164-437-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/4164-439-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/4164-440-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/4164-444-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/4116-447-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4116-449-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4116-450-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4116-454-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/4320-461-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/4320-462-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/4320-464-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral1/memory/5452-469-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral1/memory/5452-470-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral1/memory/5452-472-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral1/memory/5660-475-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral1/memory/5660-476-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral1/memory/5660-482-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral1/memory/2660-491-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/2660-492-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/2660-494-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/3644-504-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral1/memory/3644-503-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral1/memory/3644-506-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral1/memory/2000-508-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral1/memory/2000-509-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral1/memory/2000-511-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral1/memory/4296-518-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral1/memory/4296-519-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral1/memory/4296-523-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 9 IoCs

resource	yara_rule
behavioral1/memory/5660-475-0x0000000000400000-0x00000000004A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5660-476-0x0000000000400000-0x00000000004A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/5660-482-0x0000000000400000-0x00000000004A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1172-497-0x0000000000400000-0x0000000000468000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1172-498-0x0000000000400000-0x0000000000468000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1172-500-0x0000000000400000-0x0000000000468000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/688-513-0x0000000000400000-0x0000000000454000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/688-516-0x0000000000400000-0x0000000000454000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/688-514-0x0000000000400000-0x0000000000454000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

NirSoft EdgeCookiesView 4 IoCs

Password recovery tool for Microsoft Edge browser

resource	yara_rule
behavioral1/memory/4164-437-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral1/memory/4164-439-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral1/memory/4164-440-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral1/memory/4164-444-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/4296-518-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral1/memory/4296-519-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral1/memory/4296-523-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 20 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3400	chrome.exe
3592	msedge.exe
4412	msedge.exe
5636	msedge.exe
5816	chrome.exe
5044	chrome.exe
3512	chrome.exe
5008	chrome.exe
1544	chrome.exe
4184	msedge.exe
5424	msedge.exe
3384	chrome.exe
5728	chrome.exe
3936	msedge.exe
4380	msedge.exe
4820	msedge.exe
1800	msedge.exe
4420	msedge.exe
3936	chrome.exe
4344	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
3632	Invoice.exe

Loads dropped DLL 22 IoCs

pid	Process
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 3632 set thread context of 4164	3632	Invoice.exe	88
PID 3632 set thread context of 4116	3632	Invoice.exe	90
PID 3632 set thread context of 1396	3632	Invoice.exe	91
PID 3632 set thread context of 4320	3632	Invoice.exe	92
PID 3632 set thread context of 5452	3632	Invoice.exe	93
PID 3632 set thread context of 5660	3632	Invoice.exe	94
PID 3632 set thread context of 4644	3632	Invoice.exe	95
PID 3632 set thread context of 2660	3632	Invoice.exe	96
PID 3632 set thread context of 1172	3632	Invoice.exe	97
PID 3632 set thread context of 3644	3632	Invoice.exe	98
PID 3632 set thread context of 2000	3632	Invoice.exe	100
PID 3632 set thread context of 688	3632	Invoice.exe	101
PID 3632 set thread context of 4296	3632	Invoice.exe	104

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Invoice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	msedge.exe
972	msedge.exe
4812	chrome.exe
1976	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Invoice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Invoice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295765848668052"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7CE8BF00-7896-4BB2-82EE-6E76D3133FCB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{390E7DBC-7A71-4CCF-9402-7BDCE5589973}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4164	grpconv.exe
4164	grpconv.exe
3632	Invoice.exe
3632	Invoice.exe
5660	grpconv.exe
5660	grpconv.exe
5660	grpconv.exe
5660	grpconv.exe
5660	grpconv.exe
5660	grpconv.exe
5660	grpconv.exe
5660	grpconv.exe
2660	grpconv.exe
2660	grpconv.exe
3632	Invoice.exe
3632	Invoice.exe
3632	Invoice.exe
3632	Invoice.exe
4296	grpconv.exe
4296	grpconv.exe
4296	grpconv.exe
4296	grpconv.exe
3632	Invoice.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
3400	chrome.exe
3400	chrome.exe
3400	chrome.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
4344	chrome.exe
4344	chrome.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	3632	Invoice.exe
Token: SeDebugPrivilege	2660	grpconv.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3400	chrome.exe
4344	chrome.exe
4184	msedge.exe
4184	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 1240	5488	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	85
PID 1240 wrote to memory of 3632	1240	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	86
PID 3632 wrote to memory of 4164	3632	Invoice.exe	88
PID 3632 wrote to memory of 4164	3632	Invoice.exe	88
PID 3632 wrote to memory of 4164	3632	Invoice.exe	88
PID 3632 wrote to memory of 4164	3632	Invoice.exe	88
PID 3632 wrote to memory of 4164	3632	Invoice.exe	88
PID 3632 wrote to memory of 4164	3632	Invoice.exe	88
PID 3632 wrote to memory of 1672	3632	Invoice.exe	89
PID 3632 wrote to memory of 4116	3632	Invoice.exe	90
PID 3632 wrote to memory of 4116	3632	Invoice.exe	90
PID 3632 wrote to memory of 4116	3632	Invoice.exe	90
PID 3632 wrote to memory of 4116	3632	Invoice.exe	90
PID 3632 wrote to memory of 4116	3632	Invoice.exe	90
PID 3632 wrote to memory of 4116	3632	Invoice.exe	90
PID 3632 wrote to memory of 1396	3632	Invoice.exe	91
PID 3632 wrote to memory of 1396	3632	Invoice.exe	91
PID 3632 wrote to memory of 1396	3632	Invoice.exe	91
PID 3632 wrote to memory of 1396	3632	Invoice.exe	91
PID 3632 wrote to memory of 1396	3632	Invoice.exe	91
PID 3632 wrote to memory of 1396	3632	Invoice.exe	91
PID 3632 wrote to memory of 4320	3632	Invoice.exe	92
PID 3632 wrote to memory of 4320	3632	Invoice.exe	92
PID 3632 wrote to memory of 4320	3632	Invoice.exe	92
PID 3632 wrote to memory of 4320	3632	Invoice.exe	92
PID 3632 wrote to memory of 4320	3632	Invoice.exe	92
PID 3632 wrote to memory of 4320	3632	Invoice.exe	92
PID 3632 wrote to memory of 5452	3632	Invoice.exe	93
PID 3632 wrote to memory of 5452	3632	Invoice.exe	93
PID 3632 wrote to memory of 5452	3632	Invoice.exe	93
PID 3632 wrote to memory of 5452	3632	Invoice.exe	93
PID 3632 wrote to memory of 5452	3632	Invoice.exe	93
PID 3632 wrote to memory of 5452	3632	Invoice.exe	93
PID 3632 wrote to memory of 5660	3632	Invoice.exe	94
PID 3632 wrote to memory of 5660	3632	Invoice.exe	94
PID 3632 wrote to memory of 5660	3632	Invoice.exe	94
PID 3632 wrote to memory of 5660	3632	Invoice.exe	94
PID 3632 wrote to memory of 5660	3632	Invoice.exe	94
PID 3632 wrote to memory of 5660	3632	Invoice.exe	94
PID 3632 wrote to memory of 4644	3632	Invoice.exe	95
PID 3632 wrote to memory of 4644	3632	Invoice.exe	95
PID 3632 wrote to memory of 4644	3632	Invoice.exe	95
PID 3632 wrote to memory of 4644	3632	Invoice.exe	95
PID 3632 wrote to memory of 4644	3632	Invoice.exe	95
PID 3632 wrote to memory of 4644	3632	Invoice.exe	95
PID 3632 wrote to memory of 2660	3632	Invoice.exe	96
PID 3632 wrote to memory of 2660	3632	Invoice.exe	96
PID 3632 wrote to memory of 2660	3632	Invoice.exe	96
PID 3632 wrote to memory of 2660	3632	Invoice.exe	96
PID 3632 wrote to memory of 2660	3632	Invoice.exe	96
PID 3632 wrote to memory of 2660	3632	Invoice.exe	96
PID 3632 wrote to memory of 1172	3632	Invoice.exe	97
PID 3632 wrote to memory of 1172	3632	Invoice.exe	97
PID 3632 wrote to memory of 1172	3632	Invoice.exe	97
PID 3632 wrote to memory of 1172	3632	Invoice.exe	97
PID 3632 wrote to memory of 1172	3632	Invoice.exe	97
PID 3632 wrote to memory of 1172	3632	Invoice.exe	97
PID 3632 wrote to memory of 3644	3632	Invoice.exe	98
PID 3632 wrote to memory of 3644	3632	Invoice.exe	98
PID 3632 wrote to memory of 3644	3632	Invoice.exe	98
PID 3632 wrote to memory of 3644	3632	Invoice.exe	98
PID 3632 wrote to memory of 3644	3632	Invoice.exe	98
PID 3632 wrote to memory of 3644	3632	Invoice.exe	98
PID 3632 wrote to memory of 4060	3632	Invoice.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Users\Admin\AppData\Local\Temp\tmp_e2cvzo6\Invoice.exe
    C:\Users\Admin\AppData\Local\Temp\tmp_e2cvzo6\Invoice.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4164
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260726225545.txt"
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4116
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1396
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260726225545.html"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5452
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5660
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1172
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3644
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260726225545.txt"
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:688
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260726225545.txt"
      4⤵
      PID:1304
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4296
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_e0f5d8bf\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3400
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc46d6c728,0x7ffc46d6c734,0x7ffc46d6c740
        6⤵
        
        PID:4040
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
        6⤵
        
        PID:4056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4812
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:8
        6⤵
        
        PID:5056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2912 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3936
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2916 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3720 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:5816
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4040 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5728
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,6309112445242195096,1978874559395848226,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:8
        6⤵
        
        PID:5188
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4344
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc46d6c728,0x7ffc46d6c734,0x7ffc46d6c740
        6⤵
        
        PID:2828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:2
        6⤵
        
        PID:4576
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:1976
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:8
        6⤵
        
        PID:4712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2872 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3512
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2884 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5044
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3668 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:5008
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3996 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1544
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,7559385327885385955,4266146623373168162,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:8
        6⤵
        
        PID:5940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x24c,0x250,0x254,0x248,0x25c,0x7ffc454cc188,0x7ffc454cc194,0x7ffc454cc1a0
        6⤵
        
        PID:5396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
        6⤵
        
        PID:2292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
        6⤵
        
        PID:5068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:5636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        6⤵
        
        PID:5304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
        6⤵
        
        PID:4756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        6⤵
        
        PID:5240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        6⤵
        
        PID:2712
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
        6⤵
        
        PID:1276
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
        6⤵
        
        PID:5500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
        6⤵
        
        PID:4808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
        6⤵
        
        PID:3468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
        6⤵
        
        PID:4380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
        6⤵
        
        PID:2516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2176,i,2086751337122165339,5468258144818832844,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
        6⤵
        
        PID:2008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x24c,0x250,0x254,0x248,0x25c,0x7ffc454cc188,0x7ffc454cc194,0x7ffc454cc1a0
        6⤵
        
        PID:4480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
        6⤵
        
        PID:4264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
        6⤵
        
        PID:412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:1800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        6⤵
        
        PID:4640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        6⤵
        
        PID:5236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
        6⤵
        
        PID:5040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
        6⤵
        
        PID:3512
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
        6⤵
        
        PID:2384
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
        6⤵
        
        PID:3348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
        6⤵
        
        PID:4600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
        6⤵
        
        PID:1204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
        6⤵
        
        PID:1712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
        6⤵
        
        PID:5224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2892,i,12980412935367044492,4852316411835876326,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
        6⤵
        
        PID:5208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b959cb0b64fc12c08165db9b2f158e878736f852705bc40b23f4142e3e98afa9
MD5 6235279d4017641ca875f8ec86dd8e37
SHA1 edccfa77f0e73cce325ae459b767bf1f0fdac82a
SHA512 30271e9edbf6f009a74f006dcfa51ed13a70e6e29bc7c15ee0b64d93a5592f3b79629e9d554fa49070d5f3de2989626e384fcbffc67d834da1816069d40576e6
TLSH
T17BE02BAACA209D2F0DFD071924580646E69423173B40456F3E3CD20DCFB86762986C2C
MD5 SHA1 SHA512 TLSH

Submit Download

930f1aa4-40f1-4d5b-a953-bd5b8aa55482.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\930f1aa4-40f1-4d5b-a953-bd5b8aa55482.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6e1c8014a135e621f46e2d6d301a3f8f1ab867898f6ee7ebd4b4c57e33e08d13
MD5 bbd2e9cf5389eec579ce186c6a680f77
SHA1 6614baf6bcca9c28b634c9b4effd83d056476b7d
SHA512 79cec19e2d1d58a36a6c5c363500df65ee1e5791c4ab6a36a565719b2c76c4ef9563a0ac524708e13c9a0736578bbd9e9e66c37507aefe772393efcdd2c6e2fa
SSDEEP 1536:TZQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Iqfd7NtZL8cHQRZEQ6Spsk
TLSH
T185C30237EBC21F339D96CB60B9530FD697F644A59034D301AA6D77AF6C83491784289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0fd5c3e30bf4b7796409feaf54295247dae6df444c12b40cd94825ad612ea003
MD5 e5d329b20e92284e74a9fd0ecbaf99fb
SHA1 99159ab4b020959b325bae3ddcbc2f018f3d073b
SHA512 abd7db513d08629487b8f20f084923a6bff47605abba1cacbe6515afbe2e8824daf359046269641710e7a9aa80b277cd26aca86fe09f8c1c7dd699ff2df38031
SSDEEP 1536:T6QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjC:rqfd7NtZL8cHQRZEQ6SpsN
TLSH
T133C30237EBC21F339D96CB60B9530FD697B644A59034D301EA6D77AF6C83491784289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5998f2fb04649d9407ce0e17897d445ce9e08ad344c10288e0f355b30a9fae7e
MD5 884847055d1cea43c8e53650630cef43
SHA1 070f26e10e290f53ecb1737eb4f79088493c8279
SHA512 6f8c434ce1084895a55ec57b968dbe8e8af37536501b27815319220b00b0cd428e5ec96d9265770ae503ed6c6c085a85494b6ca7f6bf5bb52d6d721ab420f954
TLSH
T103D08067790D7415E71F4231D413D350676B4072A5629701F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 6681c3ca39190cdb1de3a9100406ed5e88b144f8aa6fbadc7130023856b52e9d
MD5 2da56d07c45cba7cffb74742d0c9553a
SHA1 aea9867f44599ac30393aeff9936074d54727b3b
SHA512 5200a8db3511ed518156bf723c326e3d6b3c932a898b6d7ab0667d3952db09075b69c25e55333beb31c9f6beae7426ca04e7cabc942c3bc2b10983298a5578a1
TLSH
T15A213E8D8EA0898FF8A481B20072E2E07770D8CC4B22A2235C3C31316E2335E3A4B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 8d1b53cf8a21da9ffb10348bab658de0583502f6c1ce9ee2f070eec0ccbf2729
MD5 0b6d2db3a8c59656e2c82ed992ae9947
SHA1 58039239232df88a898066d5e5f5bc4053b5a5b2
SHA512 11c1dc57b8ba48e16f6fcb41542c7b4f79ebb368bfd7d4ae09fac44bad8b124f1f3ac53ded841cc128f5c238df15c2c56a7d3457581cf514ec62ac81f506e030
TLSH
T14051814E8DD18D8BE9A810B3147BA1D4B331E8DD4B45F717682C71346EA33493A87498
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe58fa3a.TMP
Size 1KB
SHA256 8738832ae48fa2f20b41f1dccc4b09799f7a996bd78b1b3b022d0a38eb3ff1b9
MD5 6e3e437f63b7ac1030a01220abce4222
SHA1 8aa8984f86d4539d55d472eb745aa6f003529615
SHA512 81e375fe334d3dbe7aaa6b86d9b2d2f08bbfd2478e79b24bfbf9ea3cf882b31c12b55ced76b06ce8a0aadeed50c559750084269d72c00d82e501494f966095a3
TLSH
T12A21108A4AD18D0FF884907B09A3F8F873318C005722B393693C62395D21B8E1A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe591c19.TMP
Size 2KB
SHA256 05be475379a38f174aef04096b6ecd932faa0f1ca9dd4cd0d7e08e1ebbebfb6f
MD5 38b289a1b196167ff202e92b8c2b5ea7
SHA1 5fe799bddf573049d940e5be9471f75cc7ea6c18
SHA512 787fe54401f1603b006105fa7cf5c19ccb450404c8105d01273b3fecedf519c957b0e6da3c89fc1942c939d7bc4b0ee84fbcb9d7fb2812f9e1cd2ffe6ccd5ad3
TLSH
T1AA51B5068AD29D1BFDE500B70966A8FC7331D8109346F363713CB2381DA6B4D2DAE0D9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ed51a4eb4a388b39ceb9204396616df8f898794884d78443a25e3b6cfb7d0141
MD5 109e63c9a9cbeceee8be096c152f90f5
SHA1 ad4a04a3f23b56bee574c9b6b3a2b3e08e257d1a
SHA512 9293d0904d345c16253a9ab1e9817fe1b8c572dd01d8440324a7b7d920d60bcf6e59617e7e38e3e6bb3f8f601591607f7d3c5d48417d523118bb0a3748380c96
SSDEEP 96:KA1eK2AEK0KTCqyuoKfq4NAKtyiiCAK7i3mDi204EgYL:E2//3PvGmDi204EtL
TLSH
T101E1345630BA02923C7F6A0C86D597268E52B2533118E53F7BEC04B24E67E219DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a223a1452e8dfa068af8322e694d1fd15245b23190fedb4075562aa987d16687
MD5 c5c9d7b1de29332534bf246d6ca91d94
SHA1 25a1f37bb5799b1f529dc6e42f0fb0dcaabaea27
SHA512 1ea5ce42451a26b932baa59911d2c47a5a245df5168c61a7f015f30bf49fdcf18fe983cea98c7ac7c0ec10cef965f20ec14329319016f3118be3b6f80774332a
SSDEEP 192:wONR61FWQmiUz+CIAGX5Obd+jwODyRi7kySJryEsvAYmb1khI:wONR6GyhAGX5od+0ODn7ktJrYVmmhI
TLSH
T14C220836A528ACB78EE6BE45F48736535FD8206BD5492FC5C6EC1E1C01C769C230AC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85818c3fb2b4127fb670960da070474d4ec3a666932f2402a21d41fba6e247bb
MD5 75e5686ccc24fd95642df80cb90c9106
SHA1 152acd005125683febf3db572088d66326aa9b10
SHA512 23f93613be69e6255094e085f0d78a06efdf53a0eec9e20050e4e6a4addbab025895eede9f3a470f64881579dbda3d7435c71e438a87042c0b941b492ec11a4c
SSDEEP 192:yON461VWQmiUylIgGX5Obd+jwODyRiV/aP39qXU6:yON46WLgGX5od+0ODnYFqXU6
TLSH
T1E002E93569686C7B8EF3AE49B48737135FE4206BEA556F84D6E81F1C00D765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 cf3311852f2ee82474267d8270a79e0cf413aae04af4d708ca2ccd79bd7e777f
MD5 d2589568a650adecea9658d88984f6f1
SHA1 abe835e597fa0957b948af8a58657c2ff532ee36
SHA512 7ad67e490561721765320b6b243907be8aa226a7b3825f6580b15ac7a6aed58bb5bfbaeec5f78863c085849bffa0acd8c97e02cbc267a913d80a0d44934ecf6a
SSDEEP 192:wONS61FWQmiUz+QIAGX5Obd+jwODyRi7kySJrSjJo12eU6:wONS6GyzAGX5od+0ODn7ktJruwU6
TLSH
T19B12F8366568EC774DE6B544F48B32936EE420B7D949AF85D2E81F1C00D769C2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e886455ff571fb888bf17362a966e813ed822b87a3fc1457a20fbf001ce12d32
MD5 dbf149dec3f85b189dd68b9c198d85a6
SHA1 573a167ac6bf76e4f0d7101881730303a2eb29ed
SHA512 0c9a07c7f6117a6e78ee4e409cfe5b4b9e597d66f7a24dd99edb930d1f82a5c7129777d8d1c9421dae4a3f15ba752e0ecaccb7756680848ddd0b5c381b417469
TLSH
T15D41185CABEA1148B3B77E5A9BF6A86E447FB8372E0A905E10110D4F0A37B40D971733
MD5 SHA1 SHA512 TLSH

Submit Download

AdapterWatch.html

Path C:\Users\Admin\AppData\Local\Temp\ZeroTrace_826569bf\AdapterWatch.html
Size 3KB
SHA256 d6277109dab872a60ddd0d223288f1f52f0da1e7c5df2d782eda6f994948a13b
MD5 811cd03806437913be57a8a2a8f8bc4f
SHA1 b7e42ff41ba6e26ce9af823b6959e5ca2134103b
SHA512 61737c430e435b4136b59cbf2071f5478f7751520c7cf114c4241ef5515043b6d6d9490a9e262d964e295e5524166159a0fbbbe6eabd83aa60e91e3e6e7a00a4
TLSH
T17471FE92F1096DBA9DAB01CC4101F86FB7146C9271510EFE2B1FF5CBF681862C6A29D6
MD5 SHA1 SHA512 TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
MD5 17c99edf022309bc2c54a732fb8fbf26
SHA1 57a8cbcbf0caed90b8ce9adc8f9188561f4a5e2b
SHA512 f8dc12948abc33487f136b92efe755b7234ea8ea65b40dbfabe6bdcf8214c1dcf3509d1ecf5f21741e5300456b03983739c9f400ef8352fcac9f3edf90c37f92
SSDEEP 192:SBeCWznuR5zIzpshfrQ0ZFqdpofnLjcqg542:SBOCMpqVDqUge2
TLSH
T159521792F32701EAE42B9175CD734A4BAABCBA00635167DB1320C1178C62BE1323E796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
MD5 088a5fda312ec2e1957e83d530f9bb8f
SHA1 29629e5dc8ade5f79eaa20017dbe01589d160508
SHA512 146c224d680bdd60dc680a744bd7ae08a867cf28d0e6e251e108fd19ec77e13e2e0f50558032391e6effd62644460ff06831e2da46291bd046144ca232e0a5d6
SSDEEP 96:I4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdTqke:IJB3jD2hoeeqLO9I1oC07xlYmBtcqg9
TLSH
T10932184BEA158AF9D1134336C0770649AAB6BB10B38277CF0365916A2D337D2723E795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
MD5 efb1f498321597f1aaf7fb6a57603c76
SHA1 1c074ba191dade8b05924dbf4933916817fd19be
SHA512 44f0ec8a4044fed41440ede528e2d2b9005477a8e163de4121f8344dba116e179de98a4131f6ff2d211e44a28c541733742e8263f83b8b6bd1479dd7d96fcbcc
SSDEEP 192:yd8+SBjsK5tcGndG4xfSo06lw7KDy8gJcqgwxCLx:88575trWCvcgwxCL
TLSH
T1F9525C85F6A985FEE85B42B98673490996B9F414635073CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
MD5 d350d601e5716a85f4beeba6e11f54d0
SHA1 8e972659a7867859ca9d36f454e8e2c49634b128
SHA512 a34cbfbdd5a429407d441a5bd163307f18f6af2403b44dc9c0c4365a6a5d8e0b6a3a0a24ef2e272e2e916a3a2a58be0ffe9e90408cfb60e6049fb5b9aa56620c
SSDEEP 192:4Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjW+Hrcqg9K2:BOJ+0QPSfu6Oh+FLkgx/dg9
TLSH
T10A823C94EAAA54FDE625C434C6534A2F9379B11A4B61E3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
MD5 d950a144de4ba6f7834772196b1853b1
SHA1 c949b8ff73436131ea495c37452c2de19b5296b6
SHA512 cf8fed63c95e9f40c2b595e92981e458ae8f587b464e2144c28ab0b2de7c608075140951e496b92ac3c72f4c61d9fcc0b236966fa49e23c8c7ccc5bdb181ebff
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3MzMR7kLqhgZvRv:JP/YtswvbHXM3c3ZkLqKZZv
TLSH
T1EAA20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
MD5 d21f9b5765c83bfd97b4b16027ff83f4
SHA1 1965e7c74ad04f1c36e751bc198b1ceebe6dd793
SHA512 f6248fa077cc74a837b1ec6928919068d0b3c111170e7e1e7eb66bae6e6d05b4ab6bad2ff50cca1ec0e349a3be1ba1fca8d947592e8cd768228d574297de81de
SSDEEP 192:h3B6qjvnrrx5yWva2Hbds/P0pxz9l8lcqgO:/6qTVC2akHrMgO
TLSH
T1B342394DFA5049F9F6124279C4334E5AA5BAB60027B17BCF03A4929A1E733C6323D796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
MD5 fecc7e50926f0ec3286d9cac0bc3938a
SHA1 e12c70ee106d580a9adb0f81b38734d376266607
SHA512 925cdac89dbb66b8b9f69e9beeda001c4735e16fb1a3e3c0ab94648a7b8915f99469b0bf87e3a0d0ddc39d35a8f66680ae22c96eed22af354aed225b761a25c6
SSDEEP 96:dkEOstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsncZqkSffcX6gi1:dkEXtOzRr+Uj0TsBz178sncwkgcqgi
TLSH
T13322E888FA568CF6E51582B9C9374E4EB175B710972067CF1374CA691E227CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_asyncio.pyd
Size 72KB
SHA256 bac2870d61a72be50cabc968be924147132036185b3b538aa3b1b43d8c828a2e
MD5 ad364098aa105e804c8c98d343ec3527
SHA1 4ebe5696875c94bdbbd6cd031c0593ae89d176af
SHA512 beb0a44a44969abf7290fc560deceac5bd8cee96d560041f783dd439a5f73b340634e451797ac1b67405f655299fce5a20627cbacba4943f7723778fde61497f
SSDEEP 1536:CFc5RUrojeb89TANqywkzGFI+OnqyUzR9rVfI/KV2X/:C6wrQeg9ENqywpFI+OnFfP
TLSH
T151738E86A2A0818BDD93F274C5636F93FBB0F7421501575F61A8C18E2F6339183FE226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_bz2.pyd
Size 84KB
SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
MD5 03bad8289d9aa18e859ed7270a719e92
SHA1 ee371b1afc7d5be754553d54bd0db8968568c703
SHA512 5267906b6daf79e898f87d24b6c0467f75df4c53fe0f44c5dcb02eeffef3b9b7078b2b1af3417ba92ab7586a7968a6b4fdb44b398287cdc1cb0c1dff2e4e9aab
SSDEEP 1536:smNz7JrA+VLsS7XtGHakUwFHkklV88YmTNiR1iNI+CVzyUzR9pfI/KYF:jNzdb7XfQVpn/pTSYNI+CVCb
TLSH
T171839E86E36962F6F46B91B986910393F730BA51075093BFF258C2592F03F816E6C35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_ctypes.pyd
Size 124KB
SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
MD5 f8d2950d5496d3940aef6758c9e9e576
SHA1 ed68c88c14e44871a085e93bf8cf6aabc816ce28
SHA512 ab25ff65abd64f39b156f7aa91c35a327c930f31d3a5d128e67e00c6307e0a0637595ab812931dc2ffec7102e33a2afc746de6267f6130d4f5a8d3445bcded79
SSDEEP 3072:+X+A2TuMyOpRf8/dy+5pf/EaWODBiPxI+LPKaO:3VTuTOpRIpf/EaNDCo
TLSH
T1C5C36D0B379400A6EBA35178C5736E07D7B1B45B172193CF12A4C6992F637A36E3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_decimal.pyd
Size 251KB
SHA256 847e2b2c69ca623e0f96bbda0f421ca978fbb5925beec4cc5e4c5d9c966c4bbc
MD5 c68fc0d5c1878d02069503280234e969
SHA1 98c8e90bf27067a4ff0764c23b95a8b845869736
SHA512 ff745d92beb4c850371b1251c0d81c301a6ce5f6d7d5cb785a5d50dbe17817455eafc32bb6624b24dd074270892fb3fd52a864fcca6e6ea6d46723d3a1c2b6fa
SSDEEP 6144:qIJS9pQGv6cAdpoyMmPMHf9qWM53pLW1A0RRRfKtrxvVh:qPQGvOQyMMMHSvFvVh
TLSH
T119447C57A2490CA5DE738074D9979B47EBB278860360D38F43B48AA73F577A3236D348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_hashlib.pyd
Size 65KB
SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
MD5 5b08c2dcbe1b1dea46abbd6c9425878e
SHA1 8fe7d98d8f3ccab36d92da7e84cdc0f7d10dbadd
SHA512 3843966697558800c639037a34da13f6bd6a0c3816bc0bbd292f04db13acc03f0b79a8fab4c58ad25fe18dd11471bc9dc20cc0d9c97c4c63fbe025ea6242b4d7
SSDEEP 1536:axO3I17/ZRoh3IcV3WFI+OImPyUzR9pfIPn:AFZR0IcNWFI+OIz/
TLSH
T1E9638D09A69540A9D6778174C9A39F87F9F1F2421710A7EF4268C28D2F233C3D77A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_lzma.pyd
Size 156KB
SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
MD5 02b16654f73129b1a1220c00d757112d
SHA1 7ce602e4c2854be7c6b439bc64162d58b1467750
SHA512 8daf5d68230d0340e5d940067afca39922078ce94b6753f2be7ae208d7982e87f5273aca768465b110477f83735f4c8e14f7bf95c2a48e2e5457bc723398e541
SSDEEP 3072:dA1h7DfXFDu7NjQ69wJGznfV9mNojn+RN1VlHNiNI+Z1zxVVm:dMDfZOX9YOjKlHNiHw
TLSH
T117F34B96A394F0D6F3628C78D6628F53E7F5781A0310929E01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_multiprocessing.pyd
Size 35KB
SHA256 b66a5a1a4aa1f187cc349e7548c3cf6d815552937a6a1d33ecc87b76794a1939
MD5 3966d8fd4d83fa54db28338ff6087e08
SHA1 61309a8044bef8b0aa0a7447d3afdfd7502ffebb
SHA512 2203f5e547c74dc0aa177f2708aa09950825f16cfacadf84de005296baf305f08d732ee1e38dafbb80eeec72bf090b56359f5e2df8c28c87ded8ea5552fecf71
SSDEEP 768:/ppp7OBajKCs2Qil0uNu1I+WtVJyUFRYT2Ip46Cxf1mlD0S:hptOBaGtil0uY1I+Wt/yUzR9ffIIS
TLSH
T125F28E8AA6680087E463DA71C5A3DF86F535F7931A21875F71A5C18E1F33381A77A30E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_overlapped.pyd
Size 55KB
SHA256 0e6081da5bbf8fcd756b02153ab7fca12bd0bc04842abe5765f7409af4987b17
MD5 1e467f86ce9bb4dbe682bc0bf41b018a
SHA1 3a9d3ad208fb41a843d9d4d10f245d6a21266ffc
SHA512 22271f1c2f709e764d88dbf6fd0ede850f1d2d80992049b88b11f6620e6b055f18f1c55df43d6281ccf8ca84224ac88f72cb03beedd9173888a71a5549b3ac59
SSDEEP 1536:t9+rYIgKZPXLCJP+XdwIDrpI+XtzyUzR9RfIIc+:tBJP+XdwIDrpI+XtK+
TLSH
T1BA436B0A679401DAEE73D279D1638F07FA74B2D31610A31F61B8C68A1F73792A71E385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_queue.pyd
Size 32KB
SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
MD5 6f8624f0746fa31cf72ef568d6a121f1
SHA1 1054fb373ea2aa51cb04fe98e6efd130be34fc43
SHA512 e52199265a0360027d21034060984dd2100b79faeb03b86cb7a6545da10c00d860117598f659ca38c5bddf368d2f525e4a337011cc78bbce5307baa52588fb9a
SSDEEP 768:j1zRmezU6rGS17r4xI+QUtlJyUFRYT2Ip4ACxf1mlD0D8:9Rm01Gw7r4xI+QUtvyUzR9xfIID8
TLSH
T1ABE27DCBAA684047D563D670C2B2DE92F935B7D3160187DF206AC18D2F277C2A72971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_socket.pyd
Size 83KB
SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
MD5 dc5a5ab89e6e2b48cb50b463b214fd89
SHA1 f7740ff9d75767ccdac7aa0dde8659d3133249a2
SHA512 98a886daa82848bc4ca352ec7e7f663822cbad5cd40c5ea7915821097964167d0628af47b8f19f22a825f9696f3199ffbaa94d699ae773a7eb57ae6dc1c3814f
SSDEEP 1536:bOYxHEUZql2HLSyypHT9/s+S+pzm8iaWmIHJyKNxI+LwWWyUzR9nfIc2Xm:qdUZqzyypHT9/sT+pzm8NxIplNxI+Lw5
TLSH
T175836A05A6A051FADB63C175C2639E23FBB4B5C11395A35F10A2C65A1F337C2BF39A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_ssl.pyd
Size 175KB
SHA256 81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128
MD5 25d4b1c6ca053c573a55d68ae3db5ce2
SHA1 ed6bc021e3d5e5ca8083e22b718bc89d55d3ab7f
SHA512 396a5432461408059ccda92cc9ca641e68150aad02efcb635dcd3f7d68d9dd09ccec0619705abf3f43a959997b4f8821b726822b89c217c4054f8e8a67eb7fc3
SSDEEP 3072:H1l+KugCpMRjN/fP6X6z7Gx8nvgkKuFBZd4rYcvsswCfyX0NoFNI+C7Bt:H1QKugCpAJHP6X6gQvg9gFq
TLSH
T15B048C07B6442AF7D813E4B9C2334903EBB1F155331257DE48D5D68A0F07B4AAE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\_wmi.pyd
Size 39KB
SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
MD5 e203a46e89f443646cec65d96aceadba
SHA1 6ec891960ac4b9d501e593157f5e89bcddeb0cb4
SHA512 5678c0cff56e41b59577c13fd206af279831bfca6fa9e56b4fd6f960f3c11834775498ed2d9008a21b6ef65cb2dfffa0152a4e2ad1da4cf198ecceedcb599e4d
SSDEEP 768:YEkKOSx+lZbHE+NQ6PlNI+Ci2JyUFRYT2Ip4/Txf1mlBqsyvvqJ:YE9O5XQ+NQcNI+Ci6yUzR9FfIQsy3qJ
TLSH
T1AE036D8AE7680046E963DA75CAB6CE53F974B7D31712D38F325585990F223C0E73932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\base_library.zip
Size 1.2MB
SHA256 531e9bde97f369ea3073702a53df3c3905332eaf159b0f0b862a6ffa2e92b44b
MD5 e28074a5a513958b3dafe9b1535f4c11
SHA1 1e60ac456f2e07fe0a98978c32032b94b84f193f
SHA512 1dc17a95d93905655a2f0d91233391f4d89e94f9973194ed604ee33bf7e9c83a94648093260b431772b07182cca37ab86eb3d53020a9fd5cd1e943e4ccb1cd0a
SSDEEP 12288:EAXdsLrFCKPKiuYCbF9UsTI0wEVJP1ASrcVXUyUbi6Zj5mvFpDGqS:EAXdsLNPKLYqbdpJP1ASrcyqS
TLSH
T18D45B480B592E4B3FC48F3BB04261A0EA3658670BF45D74729A7C5E49F9F2E49D819CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\pyexpat.pyd
Size 198KB
SHA256 fb0be386ab5bc1695e47e49220f52beee99239bbe85c1749694a8a696054865f
MD5 ab15ffb93ea7d8abd0a01060eefc39f0
SHA1 f90a7fad0c9970cd0d3e94f7b7b7959dfd6fcbc2
SHA512 5df2497c6e76c4bee30bef634d52a815a9112d11dbc737dfe16002d08b5ba885a56dbb56ce1deeeaa46a99fb37d5e350a28937382de443c553e5027be7bec01a
SSDEEP 3072:akRxirK87LSFD35pbZ0/7+I9HMK6l2pa1MsF0mnn+hl2/1nR7TvxI+LhE5N:VirK87+FD3x0/7+I9SVGsmW+h8Tvo
TLSH
T120145B5B72A2C0EBD8938038D6D78A07DBB2B8A5038197DF12D4E77D4F277523A29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\python312.dll
Size 6.6MB
SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
MD5 f9a43765b486c561bf0895eb9390ed1f
SHA1 b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
SHA512 f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
SSDEEP 98304:8HdLykRHSHAtre59efJBVvTHqMiEnrZpd50:8HdLykRXg9Y5iEZpdu
TLSH
T11A667C567358C0A9C97BA0B0CC13C68EE7B27C517F50930B70AAB75E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\select.pyd
Size 32KB
SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
MD5 208cef2d2c60a3457b13aa428dceb347
SHA1 f78ddbe4be3ff0b21f06aea5f2266625d489470b
SHA512 8b0d14d1c93089368d34bdf49602f4c8e1daa1711c2760eeb2c59a10dbf7611fce098af0f11d7d5aa53d7d07dde39b1f31ecf5f62f7f91f31d7abeed5d828b19
SSDEEP 768:+FypHfy2YxI+QGXJyUFRYT2Ip4UJCxf1mltdK2363:+Fyp/y2YxI+QGZyUzR9UefI/K2e
TLSH
T1ABE27DCA6B745047EAA3D631C6A2CE43F939B7A35711869F30B9D1890E137C1B73A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54882\unicodedata.pyd
Size 1.1MB
SHA256 e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753
MD5 5e432cca03cd6c18cf4043ed1f3af40a
SHA1 f418bc194c3d35298028bb43dc8cff720360eb2b
SHA512 02076ef322d23becfe3e24cca5e868a3acb28086dfe83188d82a1a138ad24b9ea097df667bcf8b5486b3306abff0138462e757171a92cd2b58a98a2ac152ec91
SSDEEP 12288:drEHdcM6hbBCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcQPXs:drEXsCjfk7bPNfv42BN6yzUQPXs
TLSH
T1EA354BC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_slzgjn1u.dqu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_slzgjn1u.dqu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bhv7AB9.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhv7AB9.tmp
Size 14.0MB
SHA256 69479ae00e629c668c2c4db93180638c619a083684c9bfbda8abb267f0bc9c1b
MD5 d9f0c43feb41d530083dc59375900c4b
SHA1 1da80ef99fa93b95723dede549c6ea5f1071874f
SHA512 d7d6c68e3d640d2bad7d60d20de2c9e71ff571d8ce5d56a5c0a6d02cc1b4b9362fd43c2f52d5fdd883c1075991962f0b5165989d3daf8944fc33c9505193c0b4
SSDEEP 6144:25FrSEprscEStVMHIwvsK9oXmYunLyBmABP1z+uvMKfTfTITuTBTZTEThxtx3cqu:Isr7BQsP
TLSH
T1DBE63ACB86A51612EB724F30A5F2E7123F76A2C26651C7D614B4E15A0E537C3BF2331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d799ae19-d541-449b-9d9e-b2e2516e2a8c.tmp

Path C:\Users\Admin\AppData\Local\Temp\d799ae19-d541-449b-9d9e-b2e2516e2a8c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d7aecbf1-eca3-4c90-b1b4-4e11b63db826.tmp

Path C:\Users\Admin\AppData\Local\Temp\d7aecbf1-eca3-4c90-b1b4-4e11b63db826.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8122358a-0493-4766-a64d-3caff46bbe61.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_750346236\8122358a-0493-4766-a64d-3caff46bbe61.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_862214253\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5424_455656631\CRX_INSTALL\manifest.json
Size 1KB
SHA256 157696227de4fbbb1b201e16ceb091d502dbb5dbaa4ff9eb66fafc1a786085d9
MD5 e40ad42b3c23ed2276b1099a0c89b3f4
SHA1 8b3316f2f53fadb1cbaa894e75316719b31db175
SHA512 701a53a3c704bae6b5a11a4ed13027007072f074b97a2f0893e8ee8156292b4f956de2aaa500106b7645a67981b91f099146bfdfba293447e233b55933513a0c
TLSH
T1804169F7BC00AD634BA49998AA1E714EFB29B24D55CFD4DB8298107302CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5424_457572427\CRX_INSTALL\manifest.json
Size 626B
SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
MD5 b9d00380c0947d7ba5fd1efcbb8a7347
SHA1 fa8ef5bce53e46999cdd957da6113b37d04e116d
SHA512 577b235564c77be3050f2aa0e1b6986bcd3d38b09a792a01f943d7d85efccc43bdc9659aaa3b81311bddc1bcce47faf4f3d3eca77d955ee2fe93fa6b095f0c13
TLSH
T17CF04677EA1D482746F057A4E864B189FA22175FA0A05C063AFC542E0FB01AB0A03B2D
MD5 SHA1 SHA512 TLSH

Submit Download

Invoice.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp_e2cvzo6\Invoice.exe
Size 10.7MB
SHA256 6d77f26c44b3ea0f079097296c1aca99d4bfbd579a8cccb5930dfc2863583ad6
MD5 35309fa45d95f49cd3ba66da20ed7bed
SHA1 0c5b1c08af1356e98c66e074dfabe45b44d952ed
SHA512 0ab5893deea45b0de13cd7a4d905a689f164226b1dd7dcb7fdb90f79df76a2b2331eec9a16dbc7084bc81fb2de2a88fe206ecfdde52cc642355a0140e39d1e76
SSDEEP 49152:XOdpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:
TLSH
T139B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternativeEdgeCookies-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260726225545.txt
Size 17KB
SHA256 90fc348c1391618b2e9d5f46a0dfe6ed2f6c69419f41af42dc1265b098f9ee8c
MD5 591b4f1717e3676a2871a392fc446412
SHA1 b582a9b4a6d2bbd27190c67b7efcd2ec8a2db42b
SHA512 5e5944b84386c37ceec34c548d81149371695b8ea685fbfb7a67275b87da61807206019a140ca87c59011f19ee581b0c3f168b14bc142f5ce8bbc3fd84f153b9
SSDEEP 192:qhA4tB1kGS1CAL1kac3jgr0J1Pp1PZjPb1PRcA4tHk6jmsx91AT51wD1Bq3E1jp1:Sq8Pjjm0Tz1ZKhjmFY/3EU
TLSH
T117828D1F15E5040AB1B7F557CAB2047A9633786A847C840C21EED7C567E3900BBD7BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260726225545.txt
Size 4KB
SHA256 a449c1d3b55acd2dbfa544bfe72c249be8c34b657bdd19cea099b4f23ccabe5c
MD5 5bf16eaf0fc071c1a27d59ad8daeb766
SHA1 b75d6fa8cf0870ffaae58d7b97584cece0f0c1c1
SHA512 5cafc607f1fb10fd1fd0e27b93d49b6cca116f9135ad5de3e1589944718738b39a138f1b416251b7fa622287d5ecee37b7e887452c83a2db4732804de32694c8
SSDEEP 96:eVAKJ4mnT6cQYGTVSq+Z4D4V7qQ4FAVpDj4m:eVAC+7YGTVSqW7V7P9Vpv/
TLSH
T1BDA1710717F90100F2F3E966EAB66075A63739495C7D800C51EDA6CA07F3928E6D3B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeV20-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260726225545.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

InstalledApps-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260726225545.txt
Size 146KB
SHA256 3ee3cac99f9c8d7fd93a7223683a61180a4b8b2908d35570cdc3e3c58fa32ed1
MD5 dbfe786206362de79b9f7fdb85efe599
SHA1 358b35cfb13ebd880e2cd8431efc30b701977bed
SHA512 6eb6dc40dc7274e920cb8ba0834c6e9539fe50728594d9613695771d03366ff4b3224c9b8af8d36aef42d39ce7aade6b500dba766a56f5e5906760c08272ef6b
SSDEEP 3072:Lu/ecAkU1vr4E6D0plUGyO31AllNtvGyWD74iSaZHBXNeYaJdR66fLmrF3dMTf:NG
TLSH
T19BE315166BF50219F1F39F85EDF154665E33BCA58C34D68C019942CE0AB3A05E8E3B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WorkingTasks-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260726225545.txt
Size 6KB
SHA256 53735ff7ff2f9d80e0d2847509928df70f105c3916aae139875dd5775f4a50c0
MD5 cb10bc338c0b4990af00949b68ed2dba
SHA1 8fe5526538927595d4821ba6b2022b9ac2d093f2
SHA512 3f80c22d7f53650e861e901b4ff5db94d800f6dbf08f528f3b8165ef11fb95d46c41320ff58cbad2c55230dd72f5c57a2fa64e1dc88542f8d5072550113e2c21
SSDEEP 192:hVYp15yWXeiOVHb15yWX4UZcVwt15yWXeXnVhVv1oyWX4ks:jYp15yWXYHb15yWXMwt15yWXyhVv1oyF
TLSH
T1E8E1131222F95044A2B3BA46EAF2547707B7785A9D7CC05D61CC83D94BE3E40D6E3BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watch-output_20260726225545.html

Path C:\Users\Admin\AppData\Roaming\watch-output_20260726225545.html
Size 3KB
SHA256 a1125618c8e010310777133a2f801dedc69939aedceb146bee4f19863a5d92db
MD5 25b790f9dbb55c5e5341236cd0565e7d
SHA1 066a11ff2b0b5c5d3f8a0e92fd8f886c7a17b88b
SHA512 354f2f2d2a0762a25b229e4a93175abd22efff04f35f81e9ae8b2f51369536939632184739431b64d5b33a71e908ff0f77e8dcf05d69279287958a5e0b609d25
TLSH
T17571FF92F2096DBA9CAB00CC4101F86FB7146C9271510EFE2B1FF5CBF681862C6929D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/688-514-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/688-516-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/688-513-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/1172-498-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1172-500-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1172-497-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/1396-458-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1396-455-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1396-456-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2000-508-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2000-509-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2000-511-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2272-555-0x0000000005EE0000-0x0000000006234000-memory.dmp

Download

memory/2272-561-0x00000000074E0000-0x0000000007502000-memory.dmp

Download

memory/2272-1077-0x0000000009350000-0x000000000987C000-memory.dmp

Download

memory/2272-560-0x00000000077D0000-0x0000000007866000-memory.dmp

Download

memory/2272-559-0x0000000006A30000-0x0000000006A4A000-memory.dmp

Download

memory/2272-544-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

Download

memory/2272-545-0x0000000005730000-0x0000000005D58000-memory.dmp

Download

memory/2272-546-0x0000000005520000-0x0000000005542000-memory.dmp

Download

memory/2272-547-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/2272-558-0x0000000007E50000-0x00000000084CA000-memory.dmp

Download

memory/2272-1072-0x0000000008C50000-0x0000000008E12000-memory.dmp

Download

memory/2272-556-0x00000000064F0000-0x000000000650E000-memory.dmp

Download

memory/2272-557-0x0000000006580000-0x00000000065CC000-memory.dmp

Download

memory/2660-494-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2660-492-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2660-491-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3632-431-0x0000000000EA0000-0x000000000195E000-memory.dmp

Download

memory/3632-467-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/3632-436-0x0000000006F80000-0x0000000006F90000-memory.dmp

Download

memory/3632-435-0x0000000006DA0000-0x0000000006E32000-memory.dmp

Download

memory/3632-434-0x0000000006740000-0x000000000674A000-memory.dmp

Download

memory/3632-433-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/3632-1808-0x0000000002350000-0x0000000002362000-memory.dmp

Download

memory/3632-432-0x00000000067F0000-0x0000000006D94000-memory.dmp

Download

memory/3644-503-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3644-506-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3644-504-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4116-447-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4116-450-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4116-449-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4116-454-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4164-437-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4164-439-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4164-440-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4164-444-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4296-518-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4296-523-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4296-519-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4320-464-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4320-461-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4320-462-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4644-485-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4644-486-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4644-488-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5452-469-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5452-470-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5452-472-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5660-475-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/5660-476-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/5660-482-0x0000000000400000-0x00000000004A5000-memory.dmp

Download