destiny_stealer | 6ce3b06155624aa0600182302cc3bda88004595b812d4c70a542f5992bc815a5

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 15.9MB
Sample260726-1s2qcssscx
SHA256 6ce3b06155624aa0600182302cc3bda88004595b812d4c70a542f5992bc815a5
MD5 4ea56c31e7c6994a21f0173c4d624ce5
SHA1 77fb5342dbad7e4d19cd5a7da7991016ac538032
SHA512 a81062867395382fafa4b8c232b0426bfd2cdd46896772b6b3b5d53001ce0a2db286e4eb6d679d067ef36533c8a04a9ca5cd22bd67055a5159b7bc10fddb8744
SSDEEP 393216:ISn5ZSpQoNPj0OKPvzSFKcIfXMCHWUjgGwp15Qi:NmSy9KPvzuKc+XMb8gZj
TLSH
T1E1F63307735C42EFECA35532B1BA897A9611FC1B4B20C6CB76E4D56E0E174CC1A39AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution destiny_stealer stealer

Malware Config

Extracted

Family

destiny_stealer

77.110.115.255

Attributes

port
8888

Signatures

Family: Destiny Stealer
DestinyStealer is a stealer written in C#.
stealer destiny_stealer

Detect binaries embedding considerable number of MFA browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c6e9-419.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/5112-422-0x00000000009C0000-0x000000000147E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c6e9-419.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5112-422-0x00000000009C0000-0x000000000147E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detected Nirsoft tools 22 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4784-428-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4784-430-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4784-431-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4784-433-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/1960-434-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/1960-436-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/1960-437-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/1960-438-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/4660-444-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/4660-445-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/1144-449-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/1144-450-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/96-454-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/96-455-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/4248-464-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4248-465-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/244-472-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/244-473-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/2468-476-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/2468-477-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/5620-484-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral2/memory/5620-485-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral2/memory/96-454-0x0000000000400000-0x00000000004A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/96-455-0x0000000000400000-0x00000000004A5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3528-468-0x0000000000400000-0x0000000000468000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3528-469-0x0000000000400000-0x0000000000468000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5724-480-0x0000000000400000-0x0000000000454000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5724-481-0x0000000000400000-0x0000000000454000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

NirSoft EdgeCookiesView 4 IoCs

Password recovery tool for Microsoft Edge browser

resource	yara_rule
behavioral2/memory/4784-428-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral2/memory/4784-430-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral2/memory/4784-431-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral2/memory/4784-433-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5620-484-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral2/memory/5620-485-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 30 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5576	chrome.exe
2388	chrome.exe
2580	chrome.exe
2544	chrome.exe
5768	chrome.exe
6092	chrome.exe
4364	msedge.exe
1988	msedge.exe
2840	msedge.exe
3916	chrome.exe
2988	chrome.exe
1332	chrome.exe
4864	msedge.exe
724	chrome.exe
5476	chrome.exe
4648	msedge.exe
2488	msedge.exe
3872	chrome.exe
2264	chrome.exe
4696	chrome.exe
2916	msedge.exe
1704	msedge.exe
2128	msedge.exe
4796	chrome.exe
4952	chrome.exe
4116	msedge.exe
756	chrome.exe
952	chrome.exe
6116	chrome.exe
5840	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5112	Invoice.exe

Loads dropped DLL 22 IoCs

pid	Process
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 4784	5112	Invoice.exe	92
PID 5112 set thread context of 1960	5112	Invoice.exe	97
PID 5112 set thread context of 3864	5112	Invoice.exe	98
PID 5112 set thread context of 4660	5112	Invoice.exe	99
PID 5112 set thread context of 1144	5112	Invoice.exe	100
PID 5112 set thread context of 96	5112	Invoice.exe	101
PID 5112 set thread context of 1340	5112	Invoice.exe	102
PID 5112 set thread context of 4248	5112	Invoice.exe	103
PID 5112 set thread context of 3528	5112	Invoice.exe	104
PID 5112 set thread context of 244	5112	Invoice.exe	105
PID 5112 set thread context of 2468	5112	Invoice.exe	107
PID 5112 set thread context of 5724	5112	Invoice.exe	108
PID 5112 set thread context of 5620	5112	Invoice.exe	110

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4364_301731885\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_218724679\_locales\mk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2976	powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3532	4784	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Invoice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2748	chrome.exe
3896	msedge.exe
4860	msedge.exe
4108	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Invoice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Invoice.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295765864284629"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{C7565C32-E333-4FA7-9155-EC49BCB857C7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4784	grpconv.exe
4784	grpconv.exe
5112	Invoice.exe
5112	Invoice.exe
96	grpconv.exe
96	grpconv.exe
96	grpconv.exe
96	grpconv.exe
96	grpconv.exe
96	grpconv.exe
96	grpconv.exe
96	grpconv.exe
4248	grpconv.exe
4248	grpconv.exe
5112	Invoice.exe
5112	Invoice.exe
5620	grpconv.exe
5620	grpconv.exe
5620	grpconv.exe
5620	grpconv.exe
5112	Invoice.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
756	chrome.exe
756	chrome.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
3872	chrome.exe
3872	chrome.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	Invoice.exe
Token: SeDebugPrivilege	4248	grpconv.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
756	chrome.exe
3872	chrome.exe
4364	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 672	4644	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 672 wrote to memory of 5112	672	2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 5112 wrote to memory of 4784	5112	Invoice.exe	92
PID 5112 wrote to memory of 4784	5112	Invoice.exe	92
PID 5112 wrote to memory of 4784	5112	Invoice.exe	92
PID 5112 wrote to memory of 4784	5112	Invoice.exe	92
PID 5112 wrote to memory of 4784	5112	Invoice.exe	92
PID 5112 wrote to memory of 4784	5112	Invoice.exe	92
PID 5112 wrote to memory of 1244	5112	Invoice.exe	96
PID 5112 wrote to memory of 1960	5112	Invoice.exe	97
PID 5112 wrote to memory of 1960	5112	Invoice.exe	97
PID 5112 wrote to memory of 1960	5112	Invoice.exe	97
PID 5112 wrote to memory of 1960	5112	Invoice.exe	97
PID 5112 wrote to memory of 1960	5112	Invoice.exe	97
PID 5112 wrote to memory of 1960	5112	Invoice.exe	97
PID 5112 wrote to memory of 3864	5112	Invoice.exe	98
PID 5112 wrote to memory of 3864	5112	Invoice.exe	98
PID 5112 wrote to memory of 3864	5112	Invoice.exe	98
PID 5112 wrote to memory of 3864	5112	Invoice.exe	98
PID 5112 wrote to memory of 3864	5112	Invoice.exe	98
PID 5112 wrote to memory of 3864	5112	Invoice.exe	98
PID 5112 wrote to memory of 4660	5112	Invoice.exe	99
PID 5112 wrote to memory of 4660	5112	Invoice.exe	99
PID 5112 wrote to memory of 4660	5112	Invoice.exe	99
PID 5112 wrote to memory of 4660	5112	Invoice.exe	99
PID 5112 wrote to memory of 4660	5112	Invoice.exe	99
PID 5112 wrote to memory of 4660	5112	Invoice.exe	99
PID 5112 wrote to memory of 1144	5112	Invoice.exe	100
PID 5112 wrote to memory of 1144	5112	Invoice.exe	100
PID 5112 wrote to memory of 1144	5112	Invoice.exe	100
PID 5112 wrote to memory of 1144	5112	Invoice.exe	100
PID 5112 wrote to memory of 1144	5112	Invoice.exe	100
PID 5112 wrote to memory of 1144	5112	Invoice.exe	100
PID 5112 wrote to memory of 96	5112	Invoice.exe	101
PID 5112 wrote to memory of 96	5112	Invoice.exe	101
PID 5112 wrote to memory of 96	5112	Invoice.exe	101
PID 5112 wrote to memory of 96	5112	Invoice.exe	101
PID 5112 wrote to memory of 96	5112	Invoice.exe	101
PID 5112 wrote to memory of 96	5112	Invoice.exe	101
PID 5112 wrote to memory of 1340	5112	Invoice.exe	102
PID 5112 wrote to memory of 1340	5112	Invoice.exe	102
PID 5112 wrote to memory of 1340	5112	Invoice.exe	102
PID 5112 wrote to memory of 1340	5112	Invoice.exe	102
PID 5112 wrote to memory of 1340	5112	Invoice.exe	102
PID 5112 wrote to memory of 1340	5112	Invoice.exe	102
PID 5112 wrote to memory of 4248	5112	Invoice.exe	103
PID 5112 wrote to memory of 4248	5112	Invoice.exe	103
PID 5112 wrote to memory of 4248	5112	Invoice.exe	103
PID 5112 wrote to memory of 4248	5112	Invoice.exe	103
PID 5112 wrote to memory of 4248	5112	Invoice.exe	103
PID 5112 wrote to memory of 4248	5112	Invoice.exe	103
PID 5112 wrote to memory of 3528	5112	Invoice.exe	104
PID 5112 wrote to memory of 3528	5112	Invoice.exe	104
PID 5112 wrote to memory of 3528	5112	Invoice.exe	104
PID 5112 wrote to memory of 3528	5112	Invoice.exe	104
PID 5112 wrote to memory of 3528	5112	Invoice.exe	104
PID 5112 wrote to memory of 3528	5112	Invoice.exe	104
PID 5112 wrote to memory of 244	5112	Invoice.exe	105
PID 5112 wrote to memory of 244	5112	Invoice.exe	105
PID 5112 wrote to memory of 244	5112	Invoice.exe	105
PID 5112 wrote to memory of 244	5112	Invoice.exe	105
PID 5112 wrote to memory of 244	5112	Invoice.exe	105
PID 5112 wrote to memory of 244	5112	Invoice.exe	105
PID 5112 wrote to memory of 4980	5112	Invoice.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Users\Admin\AppData\Local\Temp\tmp76yvaux8\Invoice.exe
    C:\Users\Admin\AppData\Local\Temp\tmp76yvaux8\Invoice.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4784
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 240
        5⤵
        Program crash
        
        PID:3532
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260726225545.txt"
      4⤵
      PID:1244
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260726225545.html"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4660
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:96
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3528
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260726225545.txt"
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2468
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260726225545.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_972ffbe1\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:756
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd1fa6c728,0x7ffd1fa6c734,0x7ffd1fa6c740
        6⤵
        
        PID:5104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
        6⤵
        
        PID:1320
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4108
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:13
        6⤵
        
        PID:4932
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5840
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:952
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6092
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
        6⤵
        
        PID:4824
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
        6⤵
        
        PID:2204
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2544
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6116
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
        6⤵
        
        PID:4484
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5576
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2988
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2388
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:724
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        6⤵
        
        PID:1580
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
        6⤵
        
        PID:5808
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4952
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1944,i,11977208892398408609,2213177914131430730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:9
        6⤵
        Uses browser remote debugging
        
        PID:1332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3872
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffd1fa6c728,0x7ffd1fa6c734,0x7ffd1fa6c740
        6⤵
        
        PID:5708
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
        6⤵
        
        PID:4908
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2748
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:13
        6⤵
        
        PID:3696
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5768
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5476
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
        6⤵
        
        PID:256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2264
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
        6⤵
        
        PID:1832
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        6⤵
        
        PID:3964
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
        6⤵
        
        PID:5652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
        6⤵
        
        PID:1676
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4696
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1948,i,12622002858908890216,5370195581632082341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
        6⤵
        Uses browser remote debugging
        
        PID:2580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x274,0x278,0x27c,0x270,0x284,0x7ffd1e24c188,0x7ffd1e24c194,0x7ffd1e24c1a0
        6⤵
        
        PID:4712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
        6⤵
        
        PID:2204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
        6⤵
        
        PID:3476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:9
        6⤵
        Uses browser remote debugging
        
        PID:4648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:14
        6⤵
        
        PID:4384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
        6⤵
        
        PID:3416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
        6⤵
        
        PID:4160
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        6⤵
        
        PID:4836
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        6⤵
        
        PID:4936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
        6⤵
        
        PID:3368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2440,i,14875175736953119181,2742709513174290129,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
        6⤵
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:4116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x274,0x278,0x27c,0x270,0x284,0x7ffd1e24c188,0x7ffd1e24c194,0x7ffd1e24c1a0
        6⤵
        
        PID:1684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
        6⤵
        
        PID:2760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
        6⤵
        
        PID:548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:9
        6⤵
        Uses browser remote debugging
        
        PID:4864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
        6⤵
        
        PID:2572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        6⤵
        
        PID:616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2184,i,1229793334890089770,15964289064558404249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
        6⤵
        
        PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4784 -ip 4784
1⤵
PID:3000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

941f1baf-b841-4a53-8a6e-18cc2a9ae8d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\941f1baf-b841-4a53-8a6e-18cc2a9ae8d4.tmp
Size 414B
SHA256 9d8dd9b1d53fa80c9ae2772d947a561a1076426c96f8b155d45c0da0f68e3240
MD5 866fd14c0068f187b76ebbc4eea6268c
SHA1 a3debdfa411c0a27ffeb065aa8922b6b9afa3020
SHA512 5709a58abaadee7f51abe11fb6dd18aba4959f4320c914451b7a7157d9b69f6347477fbda91a5b370c011ee07ebbba1aa23fe1a742ce7af570df057700727ad0
TLSH
T19BE02BEAC821E82718FD079D70A14646FB5413572B40485F3B3C911D8FB067A5586D7C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_128.png
Size 4KB
SHA256 149fc2270389655ee20da9cebb31ffde75e16e3ad371b9b907f62013ed45e705
MD5 7424a1046f7a440dc5e43b9a3c5d791e
SHA1 0672cf5b67820e81beb23010f62123e0b362e3ab
SHA512 2836cb5b4d682bc70e74c88af21e0ce972679eb07e88aa0b80db5990a68453e1c9580e530eede390c743d7377ea8ff3df7b78a7c5ddbde124d7782c63cf329bb
SSDEEP 96:jzliICMC5QmAjL7eTu3Ay1Hnn5IlQRU19x0tfo4CPmukC0:jzQzAjLiTK1H5IlQW1Xbm7
TLSH
T1AF916BA01EB4FABCD449F179A423BA2CD4049904D83583278E1DBF7626247A633C94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_16.png
Size 582B
SHA256 15b1cc630202324ad6b3b142a22cb1a55de8d6d9a0bcab78d5b14cd997a5ddd5
MD5 b323815b176657da3933a39e5658177e
SHA1 27e230c6d7b1774a9cfdebd6271e781619e797eb
SHA512 c049c8c8ad36fef941ef3917fee911d632923f41e8d2b3caea8938c87dda229c0d632f8f07aa3334fe79a31de87e75bb73d45d4811f9e81e0f261238bc41014b
TLSH
T105F0E1E29628FDD8C20AC13E4619AD21BDB258D85BA04B380553ECB13DA9AA9C065195
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\manifest.json
Size 1KB
SHA256 f52714812d68c577a445169d11e84df6751c2d6886bc429643072bb5d61c6c27
MD5 01334fb9d092af2aa46c4185e405c627
SHA1 47ad3c0e82362ffe5b881df8d71d6f79ab7f5796
SHA512 888d96adb7a847abe472145258c8c46950eb2fa3ba7d596c2e90a17c8fb06fd0155c56cc8aba5d076d89368417464bcb2d236f9e40e53241950a01f9f8ed548f
TLSH
T1F721CAE72455C0BB16B0DBD9B8A8620BF733130E8490C6CF793C404DCFBA8E2524A668
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e5f073b1dcf271b0d306f8c1568439ba0b74a53489f157c776940f309697354b
MD5 a053238bf984a5752b15fc4b665c1613
SHA1 5eb486d89d18d6f7753f4792625662a352172740
SHA512 4b001dea9cf1c3c1c0b030d5a620e5fc6d3b7dea042f94d466b94a20d64ec323b4ee2e252a4da742fe511092df57cc9baadb22e6962a168d2aa981eb295394e3
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5R/gmDRfB6nGyvn0b4T8qiybJv4a:xC0ITo+TQ0InDUDRvbPPb4T8bybl
TLSH
T173A10936A0284DB74476D44AF1622A43CEB97067D972AFD4EAD90F0D14F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 863ffed169f837418ee96327a5229640abb132a2b7bfc15465740527b6e3d19d
MD5 5f13337c7c16cf77ee1b3d269fbeaab5
SHA1 7f0b6fae974327efe1ac19ca3897a4b809411428
SHA512 9ae2e3124548dbf6938837bd4b0581bcc72debe05d2a0928a5bd2962715654ae1322e55afcb4a3c6b7ae89a5a742172a5876ff61d4d2ad925177b3033ac2a7df
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5R/gmDRfB6nGyvn0bFT8qcybJW4a:xC0ITo+TQ0InDUDRvbPPbFT85yby
TLSH
T113A10936A0284DB74476D48AF1622A43CFB97067E972AF94EADD0F0D14F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a7bb65cc62ab23f55fb19fcb902cd2b7e6a37d677e3122e475e04e6f589e9fd2
MD5 ff6abcbc94cf2e1074a8d1ceb880d0a0
SHA1 0932e92d4dd001ea1c49f4abbefa4b09c095a3ae
SHA512 8b35619a11ad3560171c61eddbb4611b2e59bdb1bf7cc1b6e4665f6d49c89df6f75e62254b4198c943d375fa52e8dba9f95c112d591afccec19cece0ee4dc705
TLSH
T188D080F47AA6E621C50E0135D550532051635970799F77675191540DAF7D081D2DF07A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 16d7521ce56630da11fde3dc2dde2193ce844df30ffc91bc2b07057fad7d79b3
MD5 fe476615a72f6366c43c24bd31d5ccb6
SHA1 a4409af6774853181ca8e648c4a9c8eabf449073
SHA512 63dc13453201085dfb15a5f5131bb18507ee76fa866b79fdb9e0a2f66108a1007ac1dcc54ce1c51993f2c3a8e9478c0663ebae22ed937f9e4e255fda3d89e3ca
TLSH
T1DAD080F07AA6E521C50E0135D550533051535970259F77675191540DAF7D081D3DF0A6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index
Size 864B
SHA256 980fffba858e153c79cd348efbcb72b50b1792adc123a0e1eb2a51e232329cc2
MD5 4356dfec3f999287e41990f13968ce15
SHA1 f65d95ceaa6b028d469fc04fb9284c0fbb21a1b5
SHA512 36354657e522734f91ef237d2c14a9fe2499d5b5847faa6ffc91671baa6ff43970933973dccdc9640ac8e0e5a1b4dd644c8ec1e87b5564e439a3d32b43b42e57
TLSH
T116112D0B8C864C12CD8B10F754BE8244733261EE2489CF2B210CBA3C8DE359A2A56800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index
Size 120B
SHA256 00fae24eef55c885dde4aca4dacac9d3d94d084892406b01a193f55fb5e2b868
MD5 6758af618a51c5f1a91685fe0c18a491
SHA1 db8f0ff39e3d61e0af8ef41f3b453214e6a03a8d
SHA512 0d82ebcf87a0064491fa10a6c8b62cae663fb139a4505beccd6efd13d2cbb94f826bff02cb4755f5716e8f9604668e63ff47ae0b41baa51b7a9a6ff858af1c05
TLSH
T10FB012818C590DD1CD07113105B7325437754FDC092107B710DC101698D10AEC096402
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a800e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index~RFe5a800e.TMP
Size 120B
SHA256 8f8a2133ba5a9bddea05407192fb9ba5c50c6eb28c1fb45bdd4d010961a8ee91
MD5 6824246b297fd92aadac3745d636f7c5
SHA1 c1f3e82805844ecb3f20538d3351874f8412a550
SHA512 8e17c3aca05f3a224bee15c1309fc077f12239b3fa393bedb0310027af5606dc64b4ba54cf31cbe57364f0b658c62807200c41e86b35bd077e6290710353627a
TLSH
T145B0121251910DE0CC0B16701033835433A68C140830630720DD085B4CB14CC4081404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa21d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index~RFe5aa21d.TMP
Size 864B
SHA256 379717a00b39122a6deb1b0dd4eab8597c36b16e161df153c89a7a11b3a39243
MD5 4d40bce87c65a342d31171199a46feed
SHA1 75e42d593fcb5d21b1a47c427a0b6f8d5d1f9fc3
SHA512 c28d19cb046f50263e8e91683cd56a9bbd00532d147190ac7765c929c630ff976b823de2e99c07ceb2dfed1054a6f560406a3eff35dcbf1e7ad1c4a29a31193c
TLSH
T16C11411B5981ACB3CD8304F6842AC10C7731E4282259DB1B304CF83C0DE34491EA591E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 940f47f6463bf8ac82b888a5251fd24e5416a82634d172e99c96486259f10e95
MD5 d99cdf88159059d47c911b6a9440df4a
SHA1 1af8a38c11c187b79bee33f26ab4e683bd30a166
SHA512 7c3ea4967f33348d91822a37d8001dc54aaece3a562683e7062f2c68c6995c8cfcb6334cf36cba4519992e7ea8d332fa15eb1a6d8a9c0839745df767fb522282
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrHlyLf1vz3W7gugn3K4Wg53cdF4Le2QKXKr:CCHuC0UE9MZSy6ngoJSaBgCrHlyLf1vo
TLSH
T15D91AA14717A0A44387D750981A88C2BD6C1B477355E747B7BB802B95F2BE0B4EFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 05599843d2b934e1459472b2b1fc11bcb3ff0893e4c4ddcc8ebbcdf49d48b552
MD5 d451c67121816475458e7bc2033bb1aa
SHA1 5ea6182464fcc38a403f4e155215e5c50b420bb9
SHA512 9f859fc4b924cffa76b40dca56736c2d67131a6c8f456a5fd94bde6e54b7273f7a969ee504578051da759961a5fa4a23c93decae99b7cd639d09430692a04d87
SSDEEP 768:hrv+4UNbdz3Hq/TBOWSYONXyer1IRCzniBKeVH1SK7:hbsbV3KBSIqnVEH1l
TLSH
T1A303C032E4A89E338DE2A3C5B147B6437FB86057C6840790DDDE2F4D069B59E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12b51921-364d-4ce2-a043-5f118bb0a6bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\12b51921-364d-4ce2-a043-5f118bb0a6bd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

375e19b9-58f7-4282-b19c-ae9e2a7999e5.tmp

Path C:\Users\Admin\AppData\Local\Temp\375e19b9-58f7-4282-b19c-ae9e2a7999e5.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44e17944-8e7f-4a16-ad4a-9dff3c03d7eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\44e17944-8e7f-4a16-ad4a-9dff3c03d7eb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cookieextract.ps1

Path C:\Users\Admin\AppData\Local\Temp\CookieExtractor_972ffbe1\cookieextract.ps1
Size 9KB
SHA256 7d1c93f66ce2582570e64695da5ed92fba44f6a916efda4a417478ca7952c2fb
MD5 efb5f106eee5ab6f38797adb2de2f822
SHA1 cfc7a8c241c7f37faabe27084a30c629317d3f71
SHA512 0cbced89acf86c82f58fba9a1aeaccd611f8136c6e03e64ca868c6f3523ffb42c6af9a74345d03c5255706d1ee35844ebb61631fea8ffac42649dc087a2fa712
SSDEEP 192:uEQ3KqHzxZS6dHBdN6UyrpCcANLLtSa8Yr8+nlisBssqPjxX92:hEHDS6d/oUyru8YUsBRqPjxX92
TLSH
T1AB129319790D911D56F3A7B67681A406FB06102F129D4C0478ED96E81FB0A8BCEE8F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
MD5 17c99edf022309bc2c54a732fb8fbf26
SHA1 57a8cbcbf0caed90b8ce9adc8f9188561f4a5e2b
SHA512 f8dc12948abc33487f136b92efe755b7234ea8ea65b40dbfabe6bdcf8214c1dcf3509d1ecf5f21741e5300456b03983739c9f400ef8352fcac9f3edf90c37f92
SSDEEP 192:SBeCWznuR5zIzpshfrQ0ZFqdpofnLjcqg542:SBOCMpqVDqUge2
TLSH
T159521792F32701EAE42B9175CD734A4BAABCBA00635167DB1320C1178C62BE1323E796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Cipher\_raw_cbc.pyd
Size 11KB
SHA256 a5c300a4bda97236f9f8ffa57f9db0e5c0a0f1d8a5699389aa03dbf1aebd77fc
MD5 088a5fda312ec2e1957e83d530f9bb8f
SHA1 29629e5dc8ade5f79eaa20017dbe01589d160508
SHA512 146c224d680bdd60dc680a744bd7ae08a867cf28d0e6e251e108fd19ec77e13e2e0f50558032391e6effd62644460ff06831e2da46291bd046144ca232e0a5d6
SSDEEP 96:I4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdTqke:IJB3jD2hoeeqLO9I1oC07xlYmBtcqg9
TLSH
T10932184BEA158AF9D1134336C0770649AAB6BB10B38277CF0365916A2D337D2723E795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
MD5 efb1f498321597f1aaf7fb6a57603c76
SHA1 1c074ba191dade8b05924dbf4933916817fd19be
SHA512 44f0ec8a4044fed41440ede528e2d2b9005477a8e163de4121f8344dba116e179de98a4131f6ff2d211e44a28c541733742e8263f83b8b6bd1479dd7d96fcbcc
SSDEEP 192:yd8+SBjsK5tcGndG4xfSo06lw7KDy8gJcqgwxCLx:88575trWCvcgwxCL
TLSH
T1F9525C85F6A985FEE85B42B98673490996B9F414635073CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
MD5 d350d601e5716a85f4beeba6e11f54d0
SHA1 8e972659a7867859ca9d36f454e8e2c49634b128
SHA512 a34cbfbdd5a429407d441a5bd163307f18f6af2403b44dc9c0c4365a6a5d8e0b6a3a0a24ef2e272e2e916a3a2a58be0ffe9e90408cfb60e6049fb5b9aa56620c
SSDEEP 192:4Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjW+Hrcqg9K2:BOJ+0QPSfu6Oh+FLkgx/dg9
TLSH
T10A823C94EAAA54FDE625C434C6534A2F9379B11A4B61E3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
MD5 d950a144de4ba6f7834772196b1853b1
SHA1 c949b8ff73436131ea495c37452c2de19b5296b6
SHA512 cf8fed63c95e9f40c2b595e92981e458ae8f587b464e2144c28ab0b2de7c608075140951e496b92ac3c72f4c61d9fcc0b236966fa49e23c8c7ccc5bdb181ebff
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3MzMR7kLqhgZvRv:JP/YtswvbHXM3c3ZkLqKZZv
TLSH
T1EAA20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
MD5 d21f9b5765c83bfd97b4b16027ff83f4
SHA1 1965e7c74ad04f1c36e751bc198b1ceebe6dd793
SHA512 f6248fa077cc74a837b1ec6928919068d0b3c111170e7e1e7eb66bae6e6d05b4ab6bad2ff50cca1ec0e349a3be1ba1fca8d947592e8cd768228d574297de81de
SSDEEP 192:h3B6qjvnrrx5yWva2Hbds/P0pxz9l8lcqgO:/6qTVC2akHrMgO
TLSH
T1B342394DFA5049F9F6124279C4334E5AA5BAB60027B17BCF03A4929A1E733C6323D796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
MD5 fecc7e50926f0ec3286d9cac0bc3938a
SHA1 e12c70ee106d580a9adb0f81b38734d376266607
SHA512 925cdac89dbb66b8b9f69e9beeda001c4735e16fb1a3e3c0ab94648a7b8915f99469b0bf87e3a0d0ddc39d35a8f66680ae22c96eed22af354aed225b761a25c6
SSDEEP 96:dkEOstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsncZqkSffcX6gi1:dkEXtOzRr+Uj0TsBz178sncwkgcqgi
TLSH
T13322E888FA568CF6E51582B9C9374E4EB175B710972067CF1374CA691E227CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\_bz2.pyd
Size 84KB
SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
MD5 03bad8289d9aa18e859ed7270a719e92
SHA1 ee371b1afc7d5be754553d54bd0db8968568c703
SHA512 5267906b6daf79e898f87d24b6c0467f75df4c53fe0f44c5dcb02eeffef3b9b7078b2b1af3417ba92ab7586a7968a6b4fdb44b398287cdc1cb0c1dff2e4e9aab
SSDEEP 1536:smNz7JrA+VLsS7XtGHakUwFHkklV88YmTNiR1iNI+CVzyUzR9pfI/KYF:jNzdb7XfQVpn/pTSYNI+CVCb
TLSH
T171839E86E36962F6F46B91B986910393F730BA51075093BFF258C2592F03F816E6C35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\_ctypes.pyd
Size 124KB
SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
MD5 f8d2950d5496d3940aef6758c9e9e576
SHA1 ed68c88c14e44871a085e93bf8cf6aabc816ce28
SHA512 ab25ff65abd64f39b156f7aa91c35a327c930f31d3a5d128e67e00c6307e0a0637595ab812931dc2ffec7102e33a2afc746de6267f6130d4f5a8d3445bcded79
SSDEEP 3072:+X+A2TuMyOpRf8/dy+5pf/EaWODBiPxI+LPKaO:3VTuTOpRIpf/EaNDCo
TLSH
T1C5C36D0B379400A6EBA35178C5736E07D7B1B45B172193CF12A4C6992F637A36E3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\_hashlib.pyd
Size 65KB
SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
MD5 5b08c2dcbe1b1dea46abbd6c9425878e
SHA1 8fe7d98d8f3ccab36d92da7e84cdc0f7d10dbadd
SHA512 3843966697558800c639037a34da13f6bd6a0c3816bc0bbd292f04db13acc03f0b79a8fab4c58ad25fe18dd11471bc9dc20cc0d9c97c4c63fbe025ea6242b4d7
SSDEEP 1536:axO3I17/ZRoh3IcV3WFI+OImPyUzR9pfIPn:AFZR0IcNWFI+OIz/
TLSH
T1E9638D09A69540A9D6778174C9A39F87F9F1F2421710A7EF4268C28D2F233C3D77A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\_lzma.pyd
Size 156KB
SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
MD5 02b16654f73129b1a1220c00d757112d
SHA1 7ce602e4c2854be7c6b439bc64162d58b1467750
SHA512 8daf5d68230d0340e5d940067afca39922078ce94b6753f2be7ae208d7982e87f5273aca768465b110477f83735f4c8e14f7bf95c2a48e2e5457bc723398e541
SSDEEP 3072:dA1h7DfXFDu7NjQ69wJGznfV9mNojn+RN1VlHNiNI+Z1zxVVm:dMDfZOX9YOjKlHNiHw
TLSH
T117F34B96A394F0D6F3628C78D6628F53E7F5781A0310929E01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\_socket.pyd
Size 83KB
SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
MD5 dc5a5ab89e6e2b48cb50b463b214fd89
SHA1 f7740ff9d75767ccdac7aa0dde8659d3133249a2
SHA512 98a886daa82848bc4ca352ec7e7f663822cbad5cd40c5ea7915821097964167d0628af47b8f19f22a825f9696f3199ffbaa94d699ae773a7eb57ae6dc1c3814f
SSDEEP 1536:bOYxHEUZql2HLSyypHT9/s+S+pzm8iaWmIHJyKNxI+LwWWyUzR9nfIc2Xm:qdUZqzyypHT9/sT+pzm8NxIplNxI+Lw5
TLSH
T175836A05A6A051FADB63C175C2639E23FBB4B5C11395A35F10A2C65A1F337C2BF39A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\_wmi.pyd
Size 39KB
SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
MD5 e203a46e89f443646cec65d96aceadba
SHA1 6ec891960ac4b9d501e593157f5e89bcddeb0cb4
SHA512 5678c0cff56e41b59577c13fd206af279831bfca6fa9e56b4fd6f960f3c11834775498ed2d9008a21b6ef65cb2dfffa0152a4e2ad1da4cf198ecceedcb599e4d
SSDEEP 768:YEkKOSx+lZbHE+NQ6PlNI+Ci2JyUFRYT2Ip4/Txf1mlBqsyvvqJ:YE9O5XQ+NQcNI+Ci6yUzR9FfIQsy3qJ
TLSH
T1AE036D8AE7680046E963DA75CAB6CE53F974B7D31712D38F325585990F223C0E73932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\base_library.zip
Size 1.2MB
SHA256 531e9bde97f369ea3073702a53df3c3905332eaf159b0f0b862a6ffa2e92b44b
MD5 e28074a5a513958b3dafe9b1535f4c11
SHA1 1e60ac456f2e07fe0a98978c32032b94b84f193f
SHA512 1dc17a95d93905655a2f0d91233391f4d89e94f9973194ed604ee33bf7e9c83a94648093260b431772b07182cca37ab86eb3d53020a9fd5cd1e943e4ccb1cd0a
SSDEEP 12288:EAXdsLrFCKPKiuYCbF9UsTI0wEVJP1ASrcVXUyUbi6Zj5mvFpDGqS:EAXdsLNPKLYqbdpJP1ASrcyqS
TLSH
T18D45B480B592E4B3FC48F3BB04261A0EA3658670BF45D74729A7C5E49F9F2E49D819CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\python312.dll
Size 6.6MB
SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
MD5 f9a43765b486c561bf0895eb9390ed1f
SHA1 b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
SHA512 f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
SSDEEP 98304:8HdLykRHSHAtre59efJBVvTHqMiEnrZpd50:8HdLykRXg9Y5iEZpdu
TLSH
T11A667C567358C0A9C97BA0B0CC13C68EE7B27C517F50930B70AAB75E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46442\select.pyd
Size 32KB
SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
MD5 208cef2d2c60a3457b13aa428dceb347
SHA1 f78ddbe4be3ff0b21f06aea5f2266625d489470b
SHA512 8b0d14d1c93089368d34bdf49602f4c8e1daa1711c2760eeb2c59a10dbf7611fce098af0f11d7d5aa53d7d07dde39b1f31ecf5f62f7f91f31d7abeed5d828b19
SSDEEP 768:+FypHfy2YxI+QGXJyUFRYT2Ip4UJCxf1mltdK2363:+Fyp/y2YxI+QGZyUzR9UefI/K2e
TLSH
T1ABE27DCA6B745047EAA3D631C6A2CE43F939B7A35711869F30B9D1890E137C1B73A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhv1B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhv1B7.tmp
Size 14.0MB
SHA256 20d329850fed9c81adf39a4e994fdf70c7d4cb47993d3707f69b6265e0e694cd
MD5 a22bdd81355d1dbad161e28bf52e0e76
SHA1 2764959ca4bebea7c016012bf49f5ea3370ea5c2
SHA512 b4287f169ecd02c05d29fd9746e7e3b70ae5c1c8b8c3a1b774eb759b5d0a5179605074315ba58256abdb0e15c747fcdb54130e3a46956df61e9b5010d637965a
SSDEEP 3072:FbXS+MCHDvOHpFPmAtJp/NBBy40ACSh0c7M0/PPpkbXS+MCHDvOHpFWp28zu51W3:ZtLt/2Jc3tYJv2KEpzzp
TLSH
T16AE6F6CF4AD30A03F7324B31A0E297532B77D9D113468B966975F5A76F4A393AB02309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3872_1220750639\CRX_INSTALL\images\icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3872_1220750639\CRX_INSTALL\images\icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3872_1220750639\CRX_INSTALL\manifest.json
Size 1KB
SHA256 49d9de983f7436ba786e6e04a5a20c10f41687ae06b266b1b6553f696719563d
MD5 6ca25f3ef585b63f01bcdf8635120704
SHA1 00c063811e31ea5f9a00f175a71ea25e7821f621
SHA512 566bfd9badbd8951ee52e5911eb68b51e86286989096d32de6e32a2523761b0e0afca251ef3bea36b5d51fb8354a5fca567772a02c3f3b9d8dfe529609fa0430
TLSH
T1CA118CD3A458C9732280D6D468A8B30BF372154F8C95BDDA777D000C5F8D4EB027A2AC
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir756_1653068936\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Invoice.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp76yvaux8\Invoice.exe
Size 10.7MB
SHA256 6d77f26c44b3ea0f079097296c1aca99d4bfbd579a8cccb5930dfc2863583ad6
MD5 35309fa45d95f49cd3ba66da20ed7bed
SHA1 0c5b1c08af1356e98c66e074dfabe45b44d952ed
SHA512 0ab5893deea45b0de13cd7a4d905a689f164226b1dd7dcb7fdb90f79df76a2b2331eec9a16dbc7084bc81fb2de2a88fe206ecfdde52cc642355a0140e39d1e76
SSDEEP 49152:XOdpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:
TLSH
T139B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260726225545.txt
Size 4KB
SHA256 b9af9548b238e29f83aa4fb0ec8872126ff74eabcf478d7699b7687b8abba3d6
MD5 15521a023229aba7ab5db590b880b85c
SHA1 f0c923844512ea248a008191eb951e800b6b79de
SHA512 7d7213bdfe35be73249720688f614158d2257771f9eb67c340928840b159262b78f7ca36e9afb56b82b26349c024ca993c25d3041230e63c6d46b8f19173e575
SSDEEP 96:eV+EMAmnT6cQYGTVcE+kAD4V9EFAFAVf98Am:eV+dm7YGTVcE3jV9kFVfaH
TLSH
T1CFA1C41317F90144F2F7AA66EAB61172A737751A5D39800C61DCA2CA07F3928DAD3BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeV20-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260726225545.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ExtensionsView-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260726225545.txt
Size 34KB
SHA256 8320ab24c2f5b3d86267b6e278130148c1b680f8d2ee51649a815f485c631d7d
MD5 a51666a730c13223c8550c28d0371980
SHA1 5ea732a67dcfeb2485108f3694b714ee7c272b81
SHA512 155f62ce9d18686a5811f21d39506417681099996e1112709db540bd798e65b9499233caf36cd23658776595179c545276b402fb05e40a7e0c5280e4b0ad5d10
SSDEEP 768:mRzhzUHzMz2zynTzX/JzuzVnTz6naz+knuz8nTz2HVr6HR0aQ8cY5cDsmqVwOCRe:mRdAHwyWnT7RK5nT+nadnugnTyHx6Hey
TLSH
T184F2BE5316FD8104F1F37A52EAB6417867B778699878C40C61DC92C90BF3A14A6E37E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstalledApps-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260726225545.txt
Size 119KB
SHA256 278607df0c8e1e6d9154d4e98e3c966ea4aa9cbdaeaa055b0ffeb73f6b5d5ffc
MD5 7e9475283942176daf2ba584be020c14
SHA1 2f57604c325c4e7a8d3d967dba0c55347224f8fc
SHA512 06f321d20b2e8f9397cedd9d1f9e84ce98717a29c92540f93fdaf1c96074e5ccd1852427d6b0528344ac4e3d3ff29b34bc78578139ad51d2f22f4e94b90b0964
SSDEEP 1536:2yTygyfygygUy7yRuyruyvvySyPEysy1yjy6yOyxyPygj9yazhP83E2yQyyny+yQ:VLO
TLSH
T150C304166BF50208F1F3AF85E9F154635E37BCA58D74D68C119942CE0AB3A04D8E3B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductKeys-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260726225545.txt
Size 786B
SHA256 824e9581dfb1f50d3a63afdc291bb339e4648f92d6662269ac733b07d9f92566
MD5 fd6177351be7c0e9368c0d1ddb244fe7
SHA1 27227a4168cf95effc0b0e40a9113816d62e396a
SHA512 c6ae1f950f905236c4ca4124fd82a855f3e71b5f97c7db85727bd22bac037b651062078fceaf1b8381cc47b53f80d8d22c65bb30d194f6a49d4bad4d23788d80
TLSH
T19E01C2A2E0D9418370C506B206627AF0FD8C3DD29DA3221871EDDA99176678BB76811F
MD5 SHA1 SHA512 TLSH

Submit Download

WorkingTasks-output_20260726225545.txt

Path C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260726225545.txt
Size 5KB
SHA256 dda6e99369f6f1cd90bc33024c08d4ffeaaa22e434bf49a157bd121d3c1ade79
MD5 0db7211a7733b87ccf9412ab6be00197
SHA1 e2bf3340c6af4ec78ac3979dd041d0a7e8c875f0
SHA512 c25237f6b041670c2ed0cbdee6ffb477afc5e27b8e1d8cdb665e74d9adf73a692559b91498e51faa868ac6e7dee69a4c5bfe0c7cf6e1a98e1b35cc939565505d
SSDEEP 96:SVBR81NUw/WX4RDJa8cVwr1NUw/WXeSDJtVdd1NUw/WXedDJf:SVH815/WX4RLcVwr15/WXeSPVdd15/WO
TLSH
T1ADB1101322F91045A2B7BA46EEF2547707B7785A9D7C805D20CC83D94BE7A40D6E3BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watch-output_20260726225545.html

Path C:\Users\Admin\AppData\Roaming\watch-output_20260726225545.html
Size 3KB
SHA256 92914410d8fe9a85f15af17cd396ef41b365fb4523959c2741a8c8d86c4648e0
MD5 df8b83e4ed662eced74b05054dc13fc8
SHA1 192993f0a576926575c5f40957e55453d2b661a8
SHA512 ae686e3187fe70452a3a250fc01b4fb3e3bcb8842779beca37deab6daa8784915dbf916af0433f337444209e05db5b3202c8d76a4d4b5046d25d922f1c7d2dad
TLSH
T1D2710E92F1596DBA8CAB01CC4002F86FB7146C9231510EFE2B1FF5CBF681862C6929D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/96-455-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/96-454-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/244-472-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/244-473-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1144-449-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1144-450-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1340-460-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1340-461-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1960-434-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1960-437-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1960-436-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1960-438-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2468-476-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2468-477-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2976-503-0x0000000006360000-0x00000000066BB000-memory.dmp

Download

memory/2976-497-0x0000000002F50000-0x0000000002F86000-memory.dmp

Download

memory/2976-498-0x0000000005D10000-0x000000000635A000-memory.dmp

Download

memory/2976-510-0x00000000079E0000-0x0000000007A02000-memory.dmp

Download

memory/2976-1439-0x0000000009700000-0x0000000009C2C000-memory.dmp

Download

memory/2976-507-0x0000000007E00000-0x000000000847C000-memory.dmp

Download

memory/2976-508-0x0000000006D70000-0x0000000006D8A000-memory.dmp

Download

memory/2976-499-0x0000000005AE0000-0x0000000005B02000-memory.dmp

Download

memory/2976-500-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/2976-509-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Download

memory/2976-1434-0x0000000009000000-0x00000000091C2000-memory.dmp

Download

memory/2976-505-0x00000000067F0000-0x000000000683C000-memory.dmp

Download

memory/2976-504-0x00000000067B0000-0x00000000067CE000-memory.dmp

Download

memory/3528-468-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/3528-469-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/3864-440-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3864-439-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4248-464-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4248-465-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4660-445-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4660-444-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4784-433-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4784-428-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4784-430-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4784-431-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5112-424-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Download

memory/5112-423-0x0000000006410000-0x00000000069CA000-memory.dmp

Download

memory/5112-1869-0x0000000074BC0000-0x000000007537C000-memory.dmp

Download

memory/5112-1862-0x0000000006C50000-0x0000000006C62000-memory.dmp

Download

memory/5112-452-0x0000000074BC0000-0x000000007537C000-memory.dmp

Download

memory/5112-442-0x0000000074BD2000-0x0000000074BD3000-memory.dmp

Download

memory/5112-421-0x0000000074BD2000-0x0000000074BD3000-memory.dmp

Download

memory/5112-425-0x0000000006280000-0x000000000628A000-memory.dmp

Download

memory/5112-427-0x0000000074BC0000-0x000000007537C000-memory.dmp

Download

memory/5112-422-0x00000000009C0000-0x000000000147E000-memory.dmp

Download

memory/5112-426-0x0000000006330000-0x00000000063C2000-memory.dmp

Download

memory/5620-485-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5620-484-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5724-481-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/5724-480-0x0000000000400000-0x0000000000454000-memory.dmp

Download