Overview

overview

9

Static

static

3

Nexomia.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    293s
  • max time network
    278s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 19:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Nexomia.exe
  • Size 16.5MB
  • Sample260730-x9g6hawdma
  • SHA256 ac2351d21649bbe92bb010d83df9b2ae3b9e07aab14f7ed208e8345876d9c5cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceransomwaretrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 9 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 50 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 21 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5096.3304.7999309847716433081 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x194,0x7ffbb08e5fd8,0x7ffbb08e5fe4,0x7ffbb08e5ff0
        3⤵
          PID:6124
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1576 --field-trial-handle=1732,i,422724159789032905,1280990648911347749,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
          3⤵
            PID:5260
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1732,i,422724159789032905,1280990648911347749,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
            3⤵
              PID:944
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1732,i,422724159789032905,1280990648911347749,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
              3⤵
                PID:4948
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3352 --field-trial-handle=1732,i,422724159789032905,1280990648911347749,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
                3⤵
                  PID:108
              • C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
                "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp
                2⤵
                • Executes dropped EXE
                PID:1000
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              1⤵
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4716
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbad02c728,0x7ffbad02c734,0x7ffbad02c740
                2⤵
                  PID:1464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,16638136096719258787,16461135700715060366,262144 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
                  2⤵
                    PID:4068
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,14514540550729398873,11329419193072198064,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
                    2⤵
                    • Downloads MZ/PE file
                    • System Time Discovery
                    PID:4200
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,9047884376186145712,17850463485201790887,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
                    2⤵
                      PID:5084
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,5293449882303423976,14987554097528045156,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
                      2⤵
                        PID:4680
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,12325869822277556785,15685923461176842170,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
                        2⤵
                          PID:4984
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,17113871441246501988,4518724312839741190,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
                          2⤵
                            PID:248
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,9785064871371998451,7800388526855694241,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
                            2⤵
                              PID:1132
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5352,i,11196268412514340503,7651685078045940318,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
                              2⤵
                                PID:3444
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,6392749055518960397,14299473803780519510,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
                                2⤵
                                  PID:4484
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5656,i,13657026511879325259,2152358361887570295,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
                                  2⤵
                                    PID:5664
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5716,i,6828209321400428490,5861169450682644018,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
                                    2⤵
                                      PID:244
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6056,i,9978726049041868759,3003520441138296055,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
                                      2⤵
                                        PID:832
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6048,i,15371697886982623776,6698151922213360511,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
                                        2⤵
                                          PID:1512
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5712,i,15112356361829703783,4690044395454717205,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
                                          2⤵
                                            PID:5028
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3568,i,5018197501687125120,9566296683044229976,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
                                            2⤵
                                              PID:3068
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5776,i,9058191430774671668,905717663275700607,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
                                              2⤵
                                                PID:1328
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6060,i,8430742010487489505,5646948988898844107,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
                                                2⤵
                                                  PID:4840
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3536,i,7217203115578810802,2288693691506118873,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
                                                  2⤵
                                                    PID:3268
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6300,i,13643034953563772785,13406079869972636051,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
                                                    2⤵
                                                      PID:424
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6032,i,11506207871632116181,14873324185035517775,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
                                                      2⤵
                                                        PID:1436
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,15761130965230778745,2808292798653400737,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:14
                                                        2⤵
                                                          PID:5600
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3492,i,8683907649880911762,12123077615523857122,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
                                                          2⤵
                                                            PID:2104
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,17763594207615364961,8134878700283488692,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
                                                            2⤵
                                                              PID:3444
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,18319067836750349279,3022868334613386742,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
                                                              2⤵
                                                                PID:4184
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6384,i,4070504100144198466,14748373825592024051,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:9
                                                                2⤵
                                                                  PID:3308
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6436,i,8985541903919129792,92157892262341148,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
                                                                  2⤵
                                                                    PID:4828
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5508,i,7805688176760490750,7134369617406492074,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
                                                                    2⤵
                                                                      PID:6508
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,2987208617710106014,14751744433481776028,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
                                                                      2⤵
                                                                        PID:6648
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,18118488167520227453,11238330734171600991,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
                                                                        2⤵
                                                                          PID:6656
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,8901811118607501004,9413198658886489068,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
                                                                          2⤵
                                                                            PID:6664
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6428,i,6274575889028716209,4341591768239556052,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
                                                                            2⤵
                                                                              PID:6768
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3936,i,7985490943361763127,8493371349404094600,524288 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
                                                                              2⤵
                                                                                PID:6712
                                                                              • C:\Users\Admin\Downloads\GlassWireSetup.exe
                                                                                "C:\Users\Admin\Downloads\GlassWireSetup.exe"
                                                                                2⤵
                                                                                • Drops file in Drivers directory
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Adds Run key to start application
                                                                                • Drops file in Program Files directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:6940
                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\vc_redist.x64.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\vc_redist.x64.exe" /install /quiet /norestart
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:756
                                                                                  • C:\Windows\Temp\{60316A34-6C58-495D-9021-E96D3289EB04}\.cr\vc_redist.x64.exe
                                                                                    "C:\Windows\Temp\{60316A34-6C58-495D-9021-E96D3289EB04}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\vc_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1556
                                                                                    • C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\.be\VC_redist.x64.exe
                                                                                      "C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AE72723C-1C0D-4CFB-85CA-4EA6B490F91B} {F11480EC-F8C5-4A56-AB52-6336799AB756} 1556
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      PID:6156
                                                                                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={a8cc5541-021a-45c0-a308-ad0035979d45} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{D0713B7F-9948-40BD-9929-5AEA588EA481} {99AB67FF-84B3-4643-8736-762F3311D241} 6156
                                                                                        6⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2036
                                                                                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={a8cc5541-021a-45c0-a308-ad0035979d45} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{D0713B7F-9948-40BD-9929-5AEA588EA481} {99AB67FF-84B3-4643-8736-762F3311D241} 6156
                                                                                          7⤵
                                                                                          • Loads dropped DLL
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4584
                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\GWInstallHelper.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\GWInstallHelper.exe" --install --installer-filepath="C:\Users\Admin\Downloads\GlassWireSetup.exe" --install-directory="C:\Program Files\GlassWire" --uninstall-directory="" --package-edition=full --package-version=3.9.1102 --os-platform=x64 --os-name=Eleven --clean-install=0 --clean-uninstall=0 --reset-firewall=0
                                                                                  3⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Checks whether UAC is enabled
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  PID:2324
                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\GWInstallHelper.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\GWInstallHelper.exe" --install-done --installer-filepath="C:\Users\Admin\Downloads\GlassWireSetup.exe" --install-directory="C:\Program Files\GlassWire" --uninstall-directory="" --package-edition=full --package-version=3.9.1102 --os-platform=x64 --os-name=Eleven --clean-install=0 --clean-uninstall=0 --reset-firewall=0
                                                                                  3⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Checks whether UAC is enabled
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  PID:5896
                                                                                • C:\Windows\system32\rundll32.exe
                                                                                  "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf
                                                                                  3⤵
                                                                                  • Adds Run key to start application
                                                                                  • Drops file in Windows directory
                                                                                  PID:5492
                                                                                  • C:\Windows\system32\runonce.exe
                                                                                    "C:\Windows\system32\runonce.exe" -r
                                                                                    4⤵
                                                                                    • Checks processor information in registry
                                                                                    PID:2880
                                                                                    • C:\Windows\System32\grpconv.exe
                                                                                      "C:\Windows\System32\grpconv.exe" -o
                                                                                      5⤵
                                                                                        PID:1268
                                                                                  • C:\Windows\system32\net.exe
                                                                                    "C:\Windows\system32\net.exe" start gwdrv
                                                                                    3⤵
                                                                                      PID:6760
                                                                                      • C:\Windows\system32\net1.exe
                                                                                        C:\Windows\system32\net1 start gwdrv
                                                                                        4⤵
                                                                                          PID:7020
                                                                                      • C:\Windows\SysWOW64\wevtutil.exe
                                                                                        "C:\Windows\system32\wevtutil.exe" im "C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\eventlog.man" /rf:"C:\Program Files\GlassWire\GWEventLog.dll" /mf:"C:\Program Files\GlassWire\GWEventLog.dll"
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5472
                                                                                        • C:\Windows\System32\wevtutil.exe
                                                                                          "C:\Windows\system32\wevtutil.exe" im "C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\eventlog.man" /rf:"C:\Program Files\GlassWire\GWEventLog.dll" /mf:"C:\Program Files\GlassWire\GWEventLog.dll" /fromwow64
                                                                                          4⤵
                                                                                            PID:3172
                                                                                        • C:\Program Files\GlassWire\GWCtlSrv.exe
                                                                                          "C:\Program Files\GlassWire\GWCtlSrv.exe" "-i"
                                                                                          3⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks whether UAC is enabled
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          PID:4872
                                                                                          • C:\Program Files\GlassWire\GWCrashpadHandler.exe
                                                                                            "C:\Program Files\GlassWire\GWCrashpadHandler.exe" --no-rate-limit --database=C:\ProgramData\glasswire\.sentry-native\system-service --metrics-dir=C:\ProgramData\glasswire\.sentry-native\system-service --url=https://o987771.ingest.us.sentry.io:443/api/4507899343601664/minidump/?sentry_client=sentry.native/0.7.8&sentry_key=04e57d3832851252464860012085bbb2 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\c784d2f0-0a3a-4b8f-e03a-fb4db08728fa.run\__sentry-event --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\c784d2f0-0a3a-4b8f-e03a-fb4db08728fa.run\__sentry-breadcrumb1 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\c784d2f0-0a3a-4b8f-e03a-fb4db08728fa.run\__sentry-breadcrumb2 --initial-client-data=0x3a4,0x3a8,0x3ac,0x378,0x3b0,0x7ff701b3b440,0x7ff701b3b458,0x7ff701b3b470
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:1452
                                                                                        • C:\Program Files\GlassWire\GWCtlSrv.exe
                                                                                          "C:\Program Files\GlassWire\GWCtlSrv.exe" "-s"
                                                                                          3⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks whether UAC is enabled
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          PID:7100
                                                                                          • C:\Program Files\GlassWire\GWCrashpadHandler.exe
                                                                                            "C:\Program Files\GlassWire\GWCrashpadHandler.exe" --no-rate-limit --database=C:\ProgramData\glasswire\.sentry-native\system-service --metrics-dir=C:\ProgramData\glasswire\.sentry-native\system-service --url=https://o987771.ingest.us.sentry.io:443/api/4507899343601664/minidump/?sentry_client=sentry.native/0.7.8&sentry_key=04e57d3832851252464860012085bbb2 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\93a787c4-116a-42d6-5431-769ee08bdbd9.run\__sentry-event --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\93a787c4-116a-42d6-5431-769ee08bdbd9.run\__sentry-breadcrumb1 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\93a787c4-116a-42d6-5431-769ee08bdbd9.run\__sentry-breadcrumb2 --initial-client-data=0x3a4,0x3a8,0x3ac,0x378,0x3b0,0x7ff701b3b440,0x7ff701b3b458,0x7ff701b3b470
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6728
                                                                                        • C:\Windows\explorer.exe
                                                                                          "C:\Windows\explorer.exe" "C:\Program Files\GlassWire\glasswire.exe"
                                                                                          3⤵
                                                                                            PID:6932
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6780,i,14306710621729519595,2741610060293728842,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1292
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4876,i,15011975861497750385,4956425225914434289,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6232
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7008,i,8371571684053955760,12681133478840607379,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4848
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6780,i,11704019546684019187,5636077975592290074,262144 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:10
                                                                                                2⤵
                                                                                                  PID:108
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7344,i,2326859700816749056,603513892269174958,2097152 --field-trial-handle=1792,i,12560728994737654243,6896872995884157228,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:6496
                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:4776
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                    1⤵
                                                                                                      PID:5180
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:4768
                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                      1⤵
                                                                                                      • Checks SCSI registry key(s)
                                                                                                      PID:6404
                                                                                                    • C:\Windows\system32\srtasks.exe
                                                                                                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                      1⤵
                                                                                                        PID:5992
                                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                                        1⤵
                                                                                                        • Enumerates connected drives
                                                                                                        • Drops file in System32 directory
                                                                                                        • Drops file in Windows directory
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4340
                                                                                                      • C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe
                                                                                                        "C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe" /burn.runonce
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2548
                                                                                                        • C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe
                                                                                                          "C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730203829.log" /install
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1320
                                                                                                          • C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe
                                                                                                            "C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730203829.log" /install
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1084
                                                                                                            • C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe
                                                                                                              "C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BCE97D13-F2E3-42F9-9298-B9C53B941A2A} {697A8D20-181D-481C-91D2-60B73F945B6C} 1084
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry class
                                                                                                              PID:2696
                                                                                                              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={a8cc5541-021a-45c0-a308-ad0035979d45} -burn.filehandle.self=924 -burn.embedded BurnPipe.{777D33E9-A83B-450F-B789-6574CEA6A020} {C58A6926-7033-4A80-9A23-1DF810BD7D59} 2696
                                                                                                                5⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:6152
                                                                                                                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={a8cc5541-021a-45c0-a308-ad0035979d45} -burn.filehandle.self=924 -burn.embedded BurnPipe.{777D33E9-A83B-450F-B789-6574CEA6A020} {C58A6926-7033-4A80-9A23-1DF810BD7D59} 2696
                                                                                                                  6⤵
                                                                                                                  • Loads dropped DLL
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6816
                                                                                                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0A97B4F7-AFCE-4070-8E20-7327B77D110F} {4B73B685-D8CD-4379-9E20-CBB85EBF5EC7} 6816
                                                                                                                    7⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry class
                                                                                                                    PID:4836
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                        1⤵
                                                                                                          PID:720
                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{df6ed5ed-f14b-314e-9d56-c16592bda458}\gwdrv.inf" "9" "4e7eab47b" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "C:\Windows\system32\drivers"
                                                                                                          1⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:4608
                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                          DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_6676978477e06802\gwdrv.inf" "0" "4e7eab47b" "0000000000000190" "WinSta0\Default"
                                                                                                          1⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:7116
                                                                                                        • C:\Windows\system32\grpconv.exe
                                                                                                          grpconv -o
                                                                                                          1⤵
                                                                                                            PID:7156
                                                                                                          • C:\Program Files\GlassWire\GWCtlSrv.exe
                                                                                                            "C:\Program Files\GlassWire\GWCtlSrv.exe"
                                                                                                            1⤵
                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                            • Checks BIOS information in registry
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks whether UAC is enabled
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            PID:5656
                                                                                                            • C:\Program Files\GlassWire\GWCrashpadHandler.exe
                                                                                                              "C:\Program Files\GlassWire\GWCrashpadHandler.exe" --no-rate-limit --database=C:\ProgramData\glasswire\.sentry-native\system-service --metrics-dir=C:\ProgramData\glasswire\.sentry-native\system-service --url=https://o987771.ingest.us.sentry.io:443/api/4507899343601664/minidump/?sentry_client=sentry.native/0.7.8&sentry_key=04e57d3832851252464860012085bbb2 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\fb899527-1c50-4332-f04e-b50a890ec28a.run\__sentry-event --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\fb899527-1c50-4332-f04e-b50a890ec28a.run\__sentry-breadcrumb1 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\fb899527-1c50-4332-f04e-b50a890ec28a.run\__sentry-breadcrumb2 --initial-client-data=0x3ac,0x3b0,0x3b4,0x384,0x3b8,0x7ff701b3b440,0x7ff701b3b458,0x7ff701b3b470
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:6768
                                                                                                          • C:\Program Files\GlassWire\GWCtlSrv.exe
                                                                                                            "C:\Program Files\GlassWire\GWCtlSrv.exe"
                                                                                                            1⤵
                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                            • Checks BIOS information in registry
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks whether UAC is enabled
                                                                                                            • Enumerates connected drives
                                                                                                            • Drops file in System32 directory
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            • Drops file in Windows directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:2412
                                                                                                            • C:\Program Files\GlassWire\GWCrashpadHandler.exe
                                                                                                              "C:\Program Files\GlassWire\GWCrashpadHandler.exe" --no-rate-limit --database=C:\ProgramData\glasswire\.sentry-native\system-service --metrics-dir=C:\ProgramData\glasswire\.sentry-native\system-service --url=https://o987771.ingest.us.sentry.io:443/api/4507899343601664/minidump/?sentry_client=sentry.native/0.7.8&sentry_key=04e57d3832851252464860012085bbb2 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\474de513-b351-4273-0276-d2ad5b69f3b5.run\__sentry-event --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\474de513-b351-4273-0276-d2ad5b69f3b5.run\__sentry-breadcrumb1 --attachment=C:\ProgramData\glasswire\.sentry-native\system-service\474de513-b351-4273-0276-d2ad5b69f3b5.run\__sentry-breadcrumb2 --initial-client-data=0x3a4,0x3a8,0x3ac,0x37c,0x3b0,0x7ff701b3b440,0x7ff701b3b458,0x7ff701b3b470
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:4608
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2564
                                                                                                            • C:\Program Files\GlassWire\GlassWire.exe
                                                                                                              "C:\Program Files\GlassWire\GlassWire.exe"
                                                                                                              2⤵
                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks whether UAC is enabled
                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                              PID:1696
                                                                                                              • C:\Program Files\GlassWire\GWCrashpadHandler.exe
                                                                                                                "C:\Program Files\GlassWire\GWCrashpadHandler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app --metrics-dir=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app --url=https://o987771.ingest.us.sentry.io:443/api/4507899343601664/minidump/?sentry_client=sentry.native/0.7.8&sentry_key=04e57d3832851252464860012085bbb2 --attachment=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\a9e03401-6f3d-46de-b385-237db5165654.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\a9e03401-6f3d-46de-b385-237db5165654.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\a9e03401-6f3d-46de-b385-237db5165654.run\__sentry-breadcrumb2 --initial-client-data=0x3dc,0x3e0,0x3e4,0x3b8,0x3e8,0x7ff613262200,0x7ff613262218,0x7ff613262230
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:2328
                                                                                                          • C:\Program Files\GlassWire\GlassWire.exe
                                                                                                            "C:\Program Files\GlassWire\glasswire.exe" -hide
                                                                                                            1⤵
                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                            • Checks BIOS information in registry
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks whether UAC is enabled
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            PID:3584
                                                                                                            • C:\Program Files\GlassWire\GWCrashpadHandler.exe
                                                                                                              "C:\Program Files\GlassWire\GWCrashpadHandler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app --metrics-dir=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app --url=https://o987771.ingest.us.sentry.io:443/api/4507899343601664/minidump/?sentry_client=sentry.native/0.7.8&sentry_key=04e57d3832851252464860012085bbb2 --attachment=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\153464fb-808b-4734-fccd-39ffc9c87eb9.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\153464fb-808b-4734-fccd-39ffc9c87eb9.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\153464fb-808b-4734-fccd-39ffc9c87eb9.run\__sentry-breadcrumb2 --initial-client-data=0x408,0x40c,0x410,0x3cc,0x414,0x7ff613262200,0x7ff613262218,0x7ff613262230
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:6216
                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                            1⤵
                                                                                                              PID:4992

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                  Reconnaissance

                                                                                                                  Resource Development

                                                                                                                  Initial Access

                                                                                                                  Execution

                                                                                                                  Persistence

                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                  1
                                                                                                                  T1547

                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                  1
                                                                                                                  T1547.001

                                                                                                                  Privilege Escalation

                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                  1
                                                                                                                  T1547

                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                  1
                                                                                                                  T1547.001

                                                                                                                  Defense Evasion

                                                                                                                  Modify Registry

                                                                                                                  1
                                                                                                                  T1112

                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                  1
                                                                                                                  T1497

                                                                                                                  Credential Access

                                                                                                                  Discovery

                                                                                                                  Browser Information Discovery

                                                                                                                  1
                                                                                                                  T1217

                                                                                                                  Network Share Discovery

                                                                                                                  1
                                                                                                                  T1135

                                                                                                                  Peripheral Device Discovery

                                                                                                                  2
                                                                                                                  T1120

                                                                                                                  Query Registry

                                                                                                                  8
                                                                                                                  T1012

                                                                                                                  System Information Discovery

                                                                                                                  7
                                                                                                                  T1082

                                                                                                                  System Location Discovery

                                                                                                                  1
                                                                                                                  T1614

                                                                                                                  System Language Discovery

                                                                                                                  1
                                                                                                                  T1614.001

                                                                                                                  System Network Configuration Discovery

                                                                                                                  1
                                                                                                                  T1016

                                                                                                                  Internet Connection Discovery

                                                                                                                  1
                                                                                                                  T1016.001

                                                                                                                  System Time Discovery

                                                                                                                  1
                                                                                                                  T1124

                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                  1
                                                                                                                  T1497

                                                                                                                  Lateral Movement

                                                                                                                  Collection

                                                                                                                  Command and Control

                                                                                                                  Exfiltration

                                                                                                                  Impact

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  e5b01e6.rbs
                                                                                                                  • Path C:\Config.Msi\e5b01e6.rbs
                                                                                                                  • Size 19KB
                                                                                                                  • SHA256 eb719634e15df217695e1b488a24d90f02b93105405b93222ea83f157acff3e0
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  e5b01f2.rbs
                                                                                                                  • Path C:\Config.Msi\e5b01f2.rbs
                                                                                                                  • Size 19KB
                                                                                                                  • SHA256 49e8a596c7a2ebdea9dbb09f504a78268b3b48f5d9c5d703157530d7e559da34
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  e5b01f9.rbs
                                                                                                                  • Path C:\Config.Msi\e5b01f9.rbs
                                                                                                                  • Size 21KB
                                                                                                                  • SHA256 903bb1aea1ba750eadd34422b63528a10c231ef56e41cd8073938af1eb231647
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  e5b0208.rbs
                                                                                                                  • Path C:\Config.Msi\e5b0208.rbs
                                                                                                                  • Size 21KB
                                                                                                                  • SHA256 173971c875e4e10faf5b88136ebcaff2bbae9be5b247084bdcd77bdb1a57c5fa
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  GlassWire.exe
                                                                                                                  • Path C:\Program Files\GlassWire\GlassWire.exe
                                                                                                                  • Size 16.6MB
                                                                                                                  • SHA256 82053105129a5410cff8bc580bc3d15f298494724baacd065043e0b2af645126
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  state.rsm
                                                                                                                  • Path C:\ProgramData\Package Cache\{a8cc5541-021a-45c0-a308-ad0035979d45}\state.rsm
                                                                                                                  • Size 976B
                                                                                                                  • SHA256 ed9df85d527431ea30176ebcadf887d3cafe5bbb3e3ec8db24384d9c512ba636
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  __sentry-event
                                                                                                                  • Path C:\ProgramData\glasswire\.sentry-native\system-service\c784d2f0-0a3a-4b8f-e03a-fb4db08728fa.run\__sentry-event
                                                                                                                  • Size 443B
                                                                                                                  • SHA256 f42e30da74d3fcdb3af601f0dfc858e3744b0aa9a32f9be468294b6363269631
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\ProgramData\glasswire\.sentry-native\system-service\settings.dat
                                                                                                                  • Size 40B
                                                                                                                  • SHA256 5bbae3c2f99b2e5fdf76ba4601159ab275f4d44302ddfe37c7be6f29f0ba1de4
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                  • Size 6B
                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  temp-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                  • Size 1KB
                                                                                                                  • SHA256 bfdb8bcbb177ff4da84eab9b0641cd9512327592ff224cdd3fc531b4721a34ce
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 936B
                                                                                                                  • SHA256 24a8b9394b46b9ad9445d01cf5238ca4e92b82227e54d7647036f388bc38f97a
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  messages.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                                  • Size 593B
                                                                                                                  • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  craw_background.js
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                                  • Size 531KB
                                                                                                                  • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 20KB
                                                                                                                  • SHA256 7cb29c1deae74cf0a16d78f13c390160999e6085636d45fd4d0557f83aef2373
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                  • Size 12KB
                                                                                                                  • SHA256 51c068997710b847b1bb2e9f1bf10fbb32b92975e9fa458587f6e8a1701e4b23
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  TransportSecurity
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                  • Size 3KB
                                                                                                                  • SHA256 ae8eb9201f2ad3682c8b9ec0266e112a92810bfc3afc1c7797cb4bb0b37a4711
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 11KB
                                                                                                                  • SHA256 e6fab95a63dab428d0fe7858ea2e89493e1f35e66672d6ceaa302e3d48cbf794
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 13KB
                                                                                                                  • SHA256 f3f76ea6c5367a6692e4ab977a20a51519fb26736ef0bc5670eb4890eb0f1cd6
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 13KB
                                                                                                                  • SHA256 690704da21f90c6fcee279d4c0ae66cb519592dd421f87d119631e49b9839c28
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 13KB
                                                                                                                  • SHA256 87e1c8af21c0324d6a2420654d19a9bcf5de56200bf2be5a2753b66018286436
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 14KB
                                                                                                                  • SHA256 bed57a0637b7872f90eb2adfd5d3d5fdfbd70050591668ed0683a961ba045cd9
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                  • Size 14KB
                                                                                                                  • SHA256 057819136e8f739ca7f143c5bc2a2bd0a6a2db35b163b8f63e8e41393787687d
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Secure Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                  • Size 11KB
                                                                                                                  • SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                  • Size 96B
                                                                                                                  • SHA256 b9e6e860c59afd860c6fa2bb7310b7a240dc13575d57c6feba1ba2279670fcb6
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                  • Size 72B
                                                                                                                  • SHA256 dcd3052ed9f0c776ad70a5269e04357f9df64830b2897b895338bcffef1f1f3d
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 72B
                                                                                                                  • SHA256 b1d731fbce4d0a8fea9ccb6e1e5950433a8974c095f126f74ab1e5d97aa6ddef
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index~RFe5a2135.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a2135.TMP
                                                                                                                  • Size 48B
                                                                                                                  • SHA256 0c8cdb2aa1ec3572e801e6eca9354e91622dbe708833186e2c601e6ab3b1f3fc
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
                                                                                                                  • Size 24B
                                                                                                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
                                                                                                                  • Size 111B
                                                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 125KB
                                                                                                                  • SHA256 d677080dec764eed857d2eb1046d420e3f2193d5d71ef5bf86f2b308cdd4f2e2
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 125KB
                                                                                                                  • SHA256 dae8cd9d2efb23da3279e838c79f537a27b34e1e264ca66b07102ea85ca1ad0e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 126KB
                                                                                                                  • SHA256 2df46b192ae3834ae0d98451267d8cb6edec5e5afcabf8704c9cde40354620b3
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 126KB
                                                                                                                  • SHA256 97800d9a1c1f71fd9398fdd65cb2cdaed90ef4760ec3799fce9b157273fe05f9
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 4KB
                                                                                                                  • SHA256 6224bdd7a8e9a3403a31d24da7753c377e07c1e882fcaa5d5c971452f8e64221
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 126KB
                                                                                                                  • SHA256 0461749d4ac380a7943d09b616c1c8296e91b79d4046fffe66d285890adf8fa0
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 5KB
                                                                                                                  • SHA256 d06b2ddf2cfeb1e6b356e8733379d77520e543505ef445c532b961cb09682bf0
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                  • Size 125KB
                                                                                                                  • SHA256 9b9e60c70369ebe9a3382f82ce6902e497fa5f9b15e6179e8edd15dbac193414
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  dd_vcredist_amd64_20260730203829_000_vcRuntimeMinimum_x64.log
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730203829_000_vcRuntimeMinimum_x64.log
                                                                                                                  • Size 2KB
                                                                                                                  • SHA256 a3aa79b3d9356a36772e152b83b273555b4b38bda1dbcfb48af96191f101492f
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  dd_vcredist_amd64_20260730203829_001_vcRuntimeAdditional_x64.log
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730203829_001_vcRuntimeAdditional_x64.log
                                                                                                                  • Size 3KB
                                                                                                                  • SHA256 7dcaac80cf373fe3a911a3d19b2220008b28fd603ea5c0b66756c76eaa3ee8b9
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  StartMenu.dll
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\StartMenu.dll
                                                                                                                  • Size 7KB
                                                                                                                  • SHA256 e74f442771f034a24b77d3a849b343551bdef69ef151c622cb9fd5f34dccda81
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  System.dll
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\System.dll
                                                                                                                  • Size 12KB
                                                                                                                  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  modern-wizard.bmp
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\modern-wizard.bmp
                                                                                                                  • Size 150KB
                                                                                                                  • SHA256 8a20f1f8c29842153c4a5ad53815ea6da1ff4780d1fc68c8c4178b6b2b8701c2
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  nsDialogs.dll
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\nsDialogs.dll
                                                                                                                  • Size 9KB
                                                                                                                  • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  nsExec.dll
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\nsExec.dll
                                                                                                                  • Size 7KB
                                                                                                                  • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  vc_redist.x64.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsa4E51.tmp\vc_redist.x64.exe
                                                                                                                  • Size 24.4MB
                                                                                                                  • SHA256 463f736d5925566edc0e8f7d8e70c0a1fc95adf44afa5d5390b979f5a35934cc
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  messages.json
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4716_359387068\CRX_INSTALL\_locales\en\messages.json
                                                                                                                  • Size 450B
                                                                                                                  • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  __sentry-event
                                                                                                                  • Path C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\153464fb-808b-4734-fccd-39ffc9c87eb9.run\__sentry-event
                                                                                                                  • Size 437B
                                                                                                                  • SHA256 59148b755f69b672d82eb55c42158ac7e2f4c22311452a8b7da91fbc0fb04a8a
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  __sentry-event
                                                                                                                  • Path C:\Users\Admin\AppData\Local\glasswire\.sentry-native\user-app\a9e03401-6f3d-46de-b385-237db5165654.run\__sentry-event
                                                                                                                  • Size 436B
                                                                                                                  • SHA256 8e95bb42139b4deb8b810774cc38cd5357e904c0a202784d03c9742e4c4a620d
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
                                                                                                                  • Size 280B
                                                                                                                  • SHA256 27373b90976fb167f6b75b4c4781d0ca084dcdb881591ab0c47d622346abf1bc
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
                                                                                                                  • Size 280B
                                                                                                                  • SHA256 8c025c6a254422d74e32e6c8c0f92f41f88360200a926bcccedc74a29196421f
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  throttle_store.dat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
                                                                                                                  • Size 20B
                                                                                                                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  the-real-index
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                  • Size 648B
                                                                                                                  • SHA256 34ae29b1bd191993d7db87b5a94a70f896ec10e575956fa97674a2ad388fe438
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  the-real-index~RFe59e0e0.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e0e0.TMP
                                                                                                                  • Size 48B
                                                                                                                  • SHA256 0d059c74ea88cf1366c300a56b9fc039726343fa4114ac3d966787564e07f13f
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  CURRENT
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Scripts\CURRENT
                                                                                                                  • Size 16B
                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  MANIFEST-000001
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension State\MANIFEST-000001
                                                                                                                  • Size 41B
                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
                                                                                                                  • Size 59B
                                                                                                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Network Persistent State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
                                                                                                                  • Size 686B
                                                                                                                  • SHA256 088f96a691f4c677983b7920c411eff6e882dbb897e6bf0786503944241cb74b
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  SCT Auditing Pending Reports
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                  • Size 2B
                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
                                                                                                                  • Size 6KB
                                                                                                                  • SHA256 1060f412078c87f850736bda8c653ef79072f0333f50cde555b1cf2a620204b4
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
                                                                                                                  • Size 6KB
                                                                                                                  • SHA256 25a965e01ee66c097ce4705ea43a7140c14cb9098d37a444b95734aae3e9f3d3
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Preferences~RFe59b711.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59b711.TMP
                                                                                                                  • Size 5KB
                                                                                                                  • SHA256 270c2419c4e8bb5ff8a12bc6403c45ae6fbfeac875c239fa997df198bf64ff5c
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  data_0
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  data_1
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
                                                                                                                  • Size 264KB
                                                                                                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  data_2
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  data_3
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
                                                                                                                  • Size 15KB
                                                                                                                  • SHA256 57ba6ddf7ee1bd9fc130292b31cf0aef2f0932e9ca2daed4b6056957f8c5b108
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
                                                                                                                  • Size 2KB
                                                                                                                  • SHA256 e0730a6f7bb16a466532b7a12e33224ebd1a944f05c03d45cd18cd5a8d6fae36
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
                                                                                                                  • Size 3KB
                                                                                                                  • SHA256 38c09836d2d54000ebe02eaa92f8185bc8c4c9f15c8ccf0a8d87b63c429abf85
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
                                                                                                                  • Size 3KB
                                                                                                                  • SHA256 d86d6d732b87dd1cf5809d2fcbc5f9a89ddf6d5fec7a1cd5956b9a1d989f8dfe
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  Local State~RFe595634.TMP
                                                                                                                  • Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe595634.TMP
                                                                                                                  • Size 1KB
                                                                                                                  • SHA256 0491a3c03594efa5251b861acc5e5cfb79bedce20bfc6fc20d6105768a28c638
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  luau-lsp.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
                                                                                                                  • Size 16.3MB
                                                                                                                  • SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  settings.json
                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
                                                                                                                  • Size 2KB
                                                                                                                  • SHA256 d4bfe66cdf16dcdd05d58f454d6caf738894ea52d13c12e69abaf38f8fca14d8
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  gwdrv.inf_amd64_6676978477e06802.ini
                                                                                                                  • Path C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_6676978477e06802.ini
                                                                                                                  • Size 408B
                                                                                                                  • SHA256 bd5d9ae3e0cdd2469ef1fba6972f1e43a826f8f2e480cf239c595f43e7f667ab
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  dberr.txt
                                                                                                                  • Path C:\Windows\System32\catroot2\dberr.txt
                                                                                                                  • Size 68KB
                                                                                                                  • SHA256 bf86a6f66123e14dfaa38c189b48197cabe6285deb2a4cd3076dbc502757e7cf
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  logo.png
                                                                                                                  • Path C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\.ba\logo.png
                                                                                                                  • Size 1KB
                                                                                                                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  wixstdba.dll
                                                                                                                  • Path C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\.ba\wixstdba.dll
                                                                                                                  • Size 215KB
                                                                                                                  • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                                                  • Path C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                                                  • Size 5.4MB
                                                                                                                  • SHA256 883afd6f9a2f7ba6c88cc11000eeada139704bc87345173c9d131815023bc0a3
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  cab5046A8AB272BF37297BB7928664C9503
                                                                                                                  • Path C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\cab5046A8AB272BF37297BB7928664C9503
                                                                                                                  • Size 969KB
                                                                                                                  • SHA256 426a041f91f051ce34d7443585678197d0ee5153525694d86df086420f9fc525
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  vcRuntimeAdditional_x64
                                                                                                                  • Path C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\vcRuntimeAdditional_x64
                                                                                                                  • Size 208KB
                                                                                                                  • SHA256 835d63d33ed1de353a10fed3206c0b72cd7959c44d3e5d82410a39d12d0c9323
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  vcRuntimeMinimum_x64
                                                                                                                  • Path C:\Windows\Temp\{19DE5164-5948-49E5-A5FB-5F710EE325AA}\vcRuntimeMinimum_x64
                                                                                                                  • Size 208KB
                                                                                                                  • SHA256 c6545e3306b3cc3272ef052428ee84d6e52554375a311c00bc7c5e4c76a41841
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  license.rtf
                                                                                                                  • Path C:\Windows\Temp\{2E2AFB13-6EFC-41F8-9315-54C03AE3A9CE}\.ba\license.rtf
                                                                                                                  • Size 9KB
                                                                                                                  • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  thm.wxl
                                                                                                                  • Path C:\Windows\Temp\{2E2AFB13-6EFC-41F8-9315-54C03AE3A9CE}\.ba\thm.wxl
                                                                                                                  • Size 2KB
                                                                                                                  • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  thm.xml
                                                                                                                  • Path C:\Windows\Temp\{2E2AFB13-6EFC-41F8-9315-54C03AE3A9CE}\.ba\thm.xml
                                                                                                                  • Size 8KB
                                                                                                                  • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  wixstdba.dll
                                                                                                                  • Path C:\Windows\Temp\{3E465C15-92F5-4DE4-B7CC-D0891C32E106}\.ba\wixstdba.dll
                                                                                                                  • Size 191KB
                                                                                                                  • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  vc_redist.x64.exe
                                                                                                                  • Path C:\Windows\Temp\{60316A34-6C58-495D-9021-E96D3289EB04}\.cr\vc_redist.x64.exe
                                                                                                                  • Size 670KB
                                                                                                                  • SHA256 e8ecfa04e3d61d8d9e78854f4d42aa2e9054d1372afc31d35a95d1027e31b6b7
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  memory/108-84-0x00007FFBCF850000-0x00007FFBCF851000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2036-1460-0x00000000002C0000-0x0000000000337000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1471-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1478-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1474-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1476-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1475-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1468-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1473-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1472-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1470-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2324-1469-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4584-1459-0x00000000002C0000-0x0000000000337000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4836-1412-0x00000000002C0000-0x0000000000337000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1874-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1872-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1888-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1887-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1876-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1875-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1871-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1870-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1873-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1869-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1868-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1866-0x00007FF6FFB40000-0x00007FF702967000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1858-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1859-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1861-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1862-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1860-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1863-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1864-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1865-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4872-1867-0x00007FFBAB1D0000-0x00007FFBAC68B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-159-0x0000025031D00000-0x0000025031D01000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-183-0x00000250348E0000-0x00000250348E1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-156-0x0000025031CC0000-0x0000025031CC1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-157-0x0000025031CE0000-0x0000025031CE1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-158-0x0000025031CF0000-0x0000025031CF1000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-160-0x0000025032A60000-0x0000025032A61000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5260-102-0x00007FFBCF850000-0x00007FFBCF851000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5656-1901-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5656-1893-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5656-1892-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5656-1895-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5656-1896-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1610-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1619-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1614-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1620-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1615-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1616-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1617-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1661-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1611-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5896-1618-0x00007FF7A3420000-0x00007FF7A4F53000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6152-1446-0x00000000002C0000-0x0000000000337000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6816-1445-0x00000000002C0000-0x0000000000337000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/7100-1898-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/7100-1900-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/7100-1903-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/7100-1899-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/7100-1897-0x00007FFBAB9D0000-0x00007FFBACE8B000-memory.dmp
                                                                                                                  Download