cc0e22e862a9779906140193d5d53fb6cd93fdcb059ce48d260e79e0682ad4c5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
Size 3.4MB
Sample260804-lb7sqagg55
SHA256 cc0e22e862a9779906140193d5d53fb6cd93fdcb059ce48d260e79e0682ad4c5
MD5 dbc9c8acae88b0ef00fef47ab8e166a0
SHA1 fa3551bdc52d030a0908ff0c714a13d440a77ce4
SHA512 5d2d500be7a727cee6cc30eca0ebb7590b63d98bbb264004693a9f19d970acf60211ced1bd7a7cfdfe86fdcff5dd2af0f75a4c22a9c2cc9899c7dedb68deb910
SSDEEP 49152:H1gxn3ar2vWv7S/w2cFUFFgOxUjwrifdysdnpJfjZuFN:W3a8WvOF/KfdyO/fjZu
TLSH
T19EF52943E79600E5D5BBC175CE169227BB71385807F1A7A772805AD22FB2FB07A2D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2420	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303090873434397"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
1320	chrome.exe
1320	chrome.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
1320	chrome.exe
1320	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1860	wmic.exe
Token: SeSecurityPrivilege	1860	wmic.exe
Token: SeTakeOwnershipPrivilege	1860	wmic.exe
Token: SeLoadDriverPrivilege	1860	wmic.exe
Token: SeSystemProfilePrivilege	1860	wmic.exe
Token: SeSystemtimePrivilege	1860	wmic.exe
Token: SeProfSingleProcessPrivilege	1860	wmic.exe
Token: SeIncBasePriorityPrivilege	1860	wmic.exe
Token: SeCreatePagefilePrivilege	1860	wmic.exe
Token: SeBackupPrivilege	1860	wmic.exe
Token: SeRestorePrivilege	1860	wmic.exe
Token: SeShutdownPrivilege	1860	wmic.exe
Token: SeDebugPrivilege	1860	wmic.exe
Token: SeSystemEnvironmentPrivilege	1860	wmic.exe
Token: SeRemoteShutdownPrivilege	1860	wmic.exe
Token: SeUndockPrivilege	1860	wmic.exe
Token: SeManageVolumePrivilege	1860	wmic.exe
Token: 33	1860	wmic.exe
Token: 34	1860	wmic.exe
Token: 35	1860	wmic.exe
Token: 36	1860	wmic.exe
Token: SeIncreaseQuotaPrivilege	1860	wmic.exe
Token: SeSecurityPrivilege	1860	wmic.exe
Token: SeTakeOwnershipPrivilege	1860	wmic.exe
Token: SeLoadDriverPrivilege	1860	wmic.exe
Token: SeSystemProfilePrivilege	1860	wmic.exe
Token: SeSystemtimePrivilege	1860	wmic.exe
Token: SeProfSingleProcessPrivilege	1860	wmic.exe
Token: SeIncBasePriorityPrivilege	1860	wmic.exe
Token: SeCreatePagefilePrivilege	1860	wmic.exe
Token: SeBackupPrivilege	1860	wmic.exe
Token: SeRestorePrivilege	1860	wmic.exe
Token: SeShutdownPrivilege	1860	wmic.exe
Token: SeDebugPrivilege	1860	wmic.exe
Token: SeSystemEnvironmentPrivilege	1860	wmic.exe
Token: SeRemoteShutdownPrivilege	1860	wmic.exe
Token: SeUndockPrivilege	1860	wmic.exe
Token: SeManageVolumePrivilege	1860	wmic.exe
Token: 33	1860	wmic.exe
Token: 34	1860	wmic.exe
Token: 35	1860	wmic.exe
Token: 36	1860	wmic.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: 36	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe
1320	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1860	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	92
PID 5112 wrote to memory of 1056	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	94
PID 5112 wrote to memory of 4480	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	96
PID 5112 wrote to memory of 2780	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	98
PID 5112 wrote to memory of 3588	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	100
PID 5112 wrote to memory of 1320	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	104
PID 1320 wrote to memory of 1872	1320	chrome.exe	105
PID 1320 wrote to memory of 5100	1320	chrome.exe	107
PID 1320 wrote to memory of 5100	1320	chrome.exe	107
PID 1320 wrote to memory of 2420	1320	chrome.exe	108
PID 1320 wrote to memory of 3324	1320	chrome.exe	109
PID 1320 wrote to memory of 3324	1320	chrome.exe	109
PID 1320 wrote to memory of 3084	1320	chrome.exe	111
PID 1320 wrote to memory of 3084	1320	chrome.exe	111
PID 1320 wrote to memory of 456	1320	chrome.exe	112
PID 1320 wrote to memory of 456	1320	chrome.exe	112
PID 1320 wrote to memory of 932	1320	chrome.exe	113
PID 1320 wrote to memory of 932	1320	chrome.exe	113
PID 1320 wrote to memory of 444	1320	chrome.exe	114
PID 1320 wrote to memory of 444	1320	chrome.exe	114
PID 5112 wrote to memory of 1320	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	104
PID 1320 wrote to memory of 4480	1320	chrome.exe	115
PID 5112 wrote to memory of 1872	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	105
PID 5112 wrote to memory of 5100	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	107
PID 5112 wrote to memory of 2420	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	108
PID 5112 wrote to memory of 3324	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	109
PID 5112 wrote to memory of 3084	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	111
PID 5112 wrote to memory of 456	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	112
PID 5112 wrote to memory of 932	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	113
PID 5112 wrote to memory of 444	5112	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	114
PID 1320 wrote to memory of 4868	1320	chrome.exe	117
PID 1320 wrote to memory of 4520	1320	chrome.exe	118
PID 1320 wrote to memory of 4120	1320	chrome.exe	119
PID 1320 wrote to memory of 4516	1320	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" nic where (NetConnectionStatus=2) get MACAddress
  2⤵
  PID:4480
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get ProcessorId
  2⤵
  PID:2780
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get UUID
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc7abc728,0x7ffdc7abc734,0x7ffdc7abc740
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,9943147211409981091,12673429976345555638,262144 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:5100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,3753393511646706941,2533410526882496581,524288 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,15065496035463525597,12843030389556631865,524288 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:3324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,16078839296265841301,1376750724938696873,2097152 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,874434637551264430,14811495013423394327,2097152 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4100,i,13296986382555953964,14882363891592656106,2097152 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4116 /prefetch:2
    3⤵
    PID:932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,9136926065272389694,16932260401225846404,2097152 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
    3⤵
    PID:444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,4825609616512571318,5465836233470048447,524288 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:4480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,11296917309101381182,1865703647388881788,524288 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,14791681972979505937,4539831340973239833,524288 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,8894985823438424938,1054469159293880388,524288 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5808,i,5908884890856591955,14621963318296751285,262144 --field-trial-handle=1984,i,9493334630602096302,8004495366047259031,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:4516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 35eca9e9b7b048a383e5377d6a1450472aab7437b04dde0a00c0a9ebc1fdd254
MD5 63603cf1e69ed59c116260e9a0e0ab2b
SHA1 12bbf57a290a6f22d1fe92ed3fd705cec7183c2a
SHA512 dbfccfb7a600990461cb38a4eac7bc261a29728023a51b038348a2a673720e09ffc529b9f7b4fba32c948940ad33ff92a5852ed0116a4445965c4197db79a176
TLSH
T1E2E02BA9D921AC270CFD1B6820104646E75113663F90D81F3B3E910C8FB5A7A4666D2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b0f3a3571bb5baf9c554d0906b4d97f0c6ee1132e47b34c17627f50ea6f35ac
MD5 ed53a07125719febbca83396fd064819
SHA1 e84ac2280ca909d4330174e15488f6f53dad567d
SHA512 8d3dab7077ba99c7766697bc59f8512e7aacbc136c7fee9fa0014fc61a8ea9d2d2736c6ee8904c9271b3668dd40d5b07dfbc4700bbaa75d1120cf152200f4b13
TLSH
T1E2518CF7D7E4897DC51156F4DA216F2FCE2E0A18031C3C6688D8AE5B43E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4a403488ca78a5baa1d358e84daba6872a614b43c7047b5009ac068c78a0bf38
MD5 b69c4ec5e1869d95872cc8f0ef38850f
SHA1 1e57497145b3a1abbe78798a3a54e0e4d8bd051b
SHA512 b31f29122b57a49859cffff173d8604c0ad6a7f324950a096b2f67d88c9092a686e3385072c76fb15cee54e6ca5badcaad1744b9e6e8ea5c315a2bab05557899
SSDEEP 384:e/BRcXC7W2Xy8zfEf7fYwUXlgrwcG20AJXanMe8:eIXC7W2Xy8zfEf7fN0grwcGTAJqnMt
TLSH
T13542D82EB920757B5CDBC229F9167757E7F6202225942EC4E7FC892C25E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 baaff5165041e1d6cde6f7580798767b3bdf6956cd1acb98c29254b20c86b471
MD5 96781aa52e40f4f87866cc3acbb533d2
SHA1 7ed79bc09c28871a5416b3e55281626bbab362e3
SHA512 fbeb5974def4049701e55bcb2aa2e523479ad7d6d30ce7d4ebc1870e768826ac3713e030f8570e67eeb653301d93eb06d91ab58fe468b7aad635bae830261575
TLSH
T164B0121080015201C04202F0118298CC71946F1CAB1F170143E06D23CC27161C114052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593483.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593483.TMP
Size 96B
SHA256 be100223efcbb843fa0871b1b50a684f68c91d97578432feba36202e6f304c6f
MD5 93b6fef68e442eb9ce28cfa4344e4cf1
SHA1 b98cf980781d682da9295c71cf45b3ffc5612230
SHA512 6097cebd775c2384999d3afbe76351521de2d133869d9f41de7e7e9590afa30c271854ef7f63715272df3485e11e11ae66a157e689021e651ac88f96e5903962
TLSH
T13BB0222CC0032302C00203B02080C8CCB020CF38C323020282F00A23EC32AB0C02A020
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 930e6e547402af9268384cc647d7cc4b0294bde351efccb705910f087de1a369
MD5 0572135bf096fa5b210a8e9fcd04a7da
SHA1 9c739737ecd4aa2849a773b5a46850d2ea73af0e
SHA512 e611e3d2ad24adeb75ebfc1ae2a3d2f3015b9e3b31458276dbd14b3fba59df05b3c332818acf495baccc4422d002845b0f30d550badd4f484de1aba6e5e108c2
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OeSpX6Gq/+dVumkwkb:jeuvBnhJsueMEGvIW1DcP2O5yWVumknb
TLSH
T1A4D3974B3A743002EDE69A721CE050BB5E3C716D4F55A5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0de698c-10c1-4b7f-9c5e-79d22f1200df.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e0de698c-10c1-4b7f-9c5e-79d22f1200df.tmp
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 af6e3022e6e553f55c5d70c287d56c2c6ee033dda2d12d15a21a7fffc3828daf
MD5 96619cfac2fbeb6a1dce3c4e45791bb0
SHA1 721a809681d08ea57775e7368d864ed1967fab5b
SHA512 68973347ae1077db8500d70dea5b40c0280bdbc6f2b08163c1dc75c6c443e5624890bbdbe2907793cc30c634f53f43db66374d52c6600d1d900a4e7aba5bc191
SSDEEP 6144:GRnIkpBWPX8zb1eLng5hjFmUi21rSm8uUVNSlzYe:GRIkWkzbsLnIfi21b8j8zL
TLSH
T155342322F9F3F872BF582110B0FD2A195BA5A85102DCF51447A36D488A9E3C67F7DA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 80072d78bd1358a1bd6dcc7e9c162978de3091cde9aef8e1cda0673496206f94
MD5 503750f0c455c9c3b5a5193aab863830
SHA1 abb76ffd27dadbcac580ab76bb86ae863c33a3f7
SHA512 2a0ec8b92e9d184b3080f247e6e914ee3e1ff681d802ceb4df4b977c1dc9667ef073c1c8fe7b2c485921ab7b8316afe6bbce1ca5a3b58c4c9042729a839d6bc3
SSDEEP 6144:zRnIkpBWPX8zb1eLng5hjFmUi21rSm8uUVNSlzYe:zRIkWkzbsLnIfi21b8j8zL
TLSH
T141342322F9F3F872BF582110B0FD2A195BA5A85102D8F51447A36D488A9E3C67F7DA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 ac66df73ae938ada519d6a40a14e8cb7362dce3a8f71bfbed5d0c4ec0aed7e45
MD5 119e0b4160ae766c7838d3cc6fb79514
SHA1 1b9b11436301b2632ab207bb409f45fee5315f8e
SHA512 b830ff6638efe94b636a1a09e450fdfc05e71cb8c706fbd02518849f2d1102977b9332ab1be3e20c691ab9dd7b029d71a561a5670d524e831d153345a73050e5
SSDEEP 6144:kARnIkpBWPX8zb1eLng5hjFmUi21rSm8uUVNSlzYe:HRIkWkzbsLnIfi21b8j8zL
TLSH
T1F1342332F8F3F873BF182110A0AD3B155F95A8520698F90446A36E49995E386BF6DE1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 61d9f3e86b49d5d110f2374ba4a09b9d88dbb775d8c0e8a2114d1091626a104e
MD5 f8cae16a9c4d8675c93c03f45aee4386
SHA1 27aa5367ea9b88454afddf93680076cc41eccab9
SHA512 ed281796b31ae44ef05f597487871ea888ee64e84121737a754388b0a824aa6f184acfe2eb0cc48b210e25b57a1c52ab3098dab30d44b487a77e4a4b9759986c
SSDEEP 3072:SMFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:BFmUi21rSm8uUVNSlzY/
TLSH
T1DCC31300B6E3E9F2EE5930447BEE2A149D6C0D818191C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_downloads

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\temp_downloads
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_downloads

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\temp_downloads
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseBackup.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\CloseBackup.xlsx
Size 10KB
SHA256 98c84d21bb92cf16173490fa837009d2691734beb08ded81be3731c10b0b9473
MD5 8804caf0e574bfd023aa7b08d10ade75
SHA1 578624d8990ad8af342b1d5ca46cebae594231ff
SHA512 1db93ae6a4b4812118cbc98a82d81d2619ad862b2c3772a8200a8a92c1401bf7f8de960ccfb982d8a207bce3daa30e4d76021e4e42b0ca02229cffd68a732304
SSDEEP 192:wc8mV4oHLIAb3UZlm7KqiClWl3lWyaFUlbVvevUqzQXpS0YvE6Uu2OVaoNf6:wc3uorIg3KA7HWl3l6UlM9z6pZLduaow
TLSH
T1FC326D9AE560857DC566947FC09F00E4F64D10C28F522E997C30E95EBBC16B3238F2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteTrace.doc

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\CompleteTrace.doc
Size 671KB
SHA256 c3958912a1b18480f64d05f36e8f3b06db7c58c1c866c1d3c5e5d0232949b936
MD5 1226f13fcb2caa86aa2b110023422490
SHA1 e4707133c16335bfcba8600008bdbc99ddec95d5
SHA512 b01f44495b8d136f808d0ed91f5297d966ee19e33a6589cad1b916ff6c719186e09d607b1e5ede71d049dea6cb6ca20e4a7b4862ce9eff4c20385ff21f366388
SSDEEP 12288:/FARQatzBxxa0bVuov0RK95IHxE8asvVh1yKT5uxFqhR9nm0JaXcjo0qr:/qRQYBrrvSgWHDasvQKToxFqZnfJ08oD
TLSH
T121E423371CAD2A43197CE06DE783240F58A515BBFA47582CCD7CFA67AEA70802364DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromPublish.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\ConvertFromPublish.docx
Size 17KB
SHA256 fef4ee94ab38f7457c3da4d47bc29053524d4524912bed389aca80c3867f8487
MD5 a33983aceaaacc7c5f68bdc405d23d2f
SHA1 e90c1819e3197e6b5ab05da42eb57731511e11c8
SHA512 b44c041e546f49236bf185e4349f8a8e02d994f41108b9b4a850869bf24e8b25962b55f323ca715926d2c056ae3b5aafbe6220403e489d93f3ee83035b3d0bfc
SSDEEP 384:a9h9KVgySB5E2NNdNxt/ZtNN469FIFHyS/bBQUX:ohWgySPE2bxllN4CItzQ2
TLSH
T1E172C039D5286821E741867CA00A61F1E57E904272DBA087355AFFCF635EFD7072368E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportShow.pdf

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\ExportShow.pdf
Size 1.0MB
SHA256 3742d6e52330c2478ffc1dbe5184727e4660e05eca9e7a58dbfa1f9d728dcd41
MD5 6002072757c411e0c09b03d60a5a0d76
SHA1 bcd43bcff1f5a03f41c87a2cdc6e6a380fae95c3
SHA512 e447f2754b1a56b33faafa1022ba8945b80c0a9675c27caa568db187f23a28b65a895233e8e49e7dd3f1c85d99d0c0fe2e5a08f22b0249959ab7d01ed4242f62
SSDEEP 24576:IeRGxW9LfFHMP7uXGLusxYxzvoGxl3obYBqs+Tf:IGtquWJ+xzvXP3PX+D
TLSH
T19F3533C25D5A909CFEEFDE4B0D93A3BC18756D0F5AFE4B98891CB4E676B07300254648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindClear.pdf

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\FindClear.pdf
Size 1013KB
SHA256 5b9c1ab4087cd4b68eb8ea3e52d367484ffe6ebc231d57033d9f84a13185bdef
MD5 70bd8b7cca1f0298f6989fa9e5bbe882
SHA1 4a96806c0e8a2b508b22d9930b1112b4b872218e
SHA512 dc8a65a18192782cabef69a0b359c4600b075a255b761bea21fc51dfc6d138548220f223dd8cf7add36eb58c7f651e817526b8d42afb5994ddd6e1076e066670
SSDEEP 24576:cSB4/ds7T9urw5gv73yVVSMrYnvQX3xs4KOAkVIszT/Wm9w3Q3:cSqd/vQmaB0OAlEjm3K
TLSH
T17A2533860CEB73A1EF87D5633A6CBE79E67B0D4C5359725F4E024DBE5862989CC00394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantSubmit.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\GrantSubmit.docx
Size 750KB
SHA256 bcd0f50cfe108eae3895e89db416accfa687e0dbd534580d6227175ec5ccd2a3
MD5 99b1ded299833410e66177a3418f11ee
SHA1 f7a627bcab2a653a465a3fe719bc1a3d8fd3429d
SHA512 9d923f17aa3b0d96a233e652cbf25340dd7dfdf7dd5e254270e82c0c0cf721889a5299753f19e17046c7df50702f490bbc17f5baa2d4d661b75901b4e58caea3
SSDEEP 12288:JB+nACynwvlPG5WTEzBFxlF+D3qXv6tMx/EBYgl5OSKi6mcpll5mwIUzdCoHOL5x:JB3wvlPeWAV/H+D3qXytuWhlMS3Fcp9s
TLSH
T16DF433C3F2840472505A19AA3AFF46D089C76CAD34CE6BD3B799377F97CD488A18A447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountDisconnect.png

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\MountDisconnect.png
Size 420KB
SHA256 588853b0502da4ded9a7a18828e4a4c9b3f802690b34417fa504d10ebfb375ae
MD5 a1b333657439e0f17b7754baece171a5
SHA1 847f0fabbb16d69ed184a629fa26989f334c587c
SHA512 c3b7d0798c6758aac5f18454b62fecef5e3965d6d7eddda327501cf31468df4d3a56c562e2e09fad392da61838314d3e44d8e60a57807ddd9fe8d6c17ca505e7
SSDEEP 6144:AP/K1UwkazNWrv0sOdCWCKnHfcLnr5ehiKygBSF82K5vdmWdBBlkx3fey:5Kw/zeOcEnHMr8pyggF8raeBnkRr
TLSH
T14E94235A3C923CFF2700BFA7BED128A15549522F78761941932D813CDDC2A893CADD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingTest.pdf

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\PingTest.pdf
Size 829KB
SHA256 3f45dcbcab3eff6b4cf4c1e9cf60c72df112257b7e68a12cab9f567607ca9446
MD5 f63dad4a97f27e35657f8014f7e0dc75
SHA1 76e2a50326cca7c27f395e3027b0b730c7d42d6e
SHA512 8a8000025c21ef009d2f87514033076e1674bff68da4fcc26ddc243d223ee3e413d98e065065d917b10f8712fb89bb55cb4004b7427e7c14b602c50853f82f7b
SSDEEP 24576:65CmET8UyAX7hsRuVmftMTnMqe3Ep6so7PwugZ:65C/T8UtORuVkKrbejM
TLSH
T1760523DF5820ABCC1DCC5869CE4E5F48606B96CFA609B467924CB6CB51C0B9F440EEF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameMeasure.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\RenameMeasure.docx
Size 18KB
SHA256 3c741f5f038de7bcd5c612cf954ab688747380b4c0e58cbb98a88178e66e53bf
MD5 fb9045e7109ec5466f94a1e4abf4ad10
SHA1 3075aac179de367185f9f383b261fc73c4c4f4d4
SHA512 bb5e07e8f8e390ea8401deb093601a5281187a163cbca178ac5820997a7ddc34e4290da7bbe6134f77d624a575ff445fd0ba9bc8b3b1ff2421e6d66fc15da08a
SSDEEP 384:aEtbtCQKxapdd/Yuvj+X6Ur/ojTdqFYdNxt/ZtNNHBjIFHySCWNJxqP:vRCZxCTQuvor/ojTd6kxllNhjItlNrA
TLSH
T1B392BE3CD35AAC00DE57867C905E22F2F21842433742EC9A34ADFADF822B9572767746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectSuspend.xls

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\CommonFiles\UnprotectSuspend.xls
Size 1.1MB
SHA256 1df572d32eabf69380b66648c399796a026bf8e62b8544b5428da61f269f769f
MD5 3efaeb7af4d1c2f09dbe13609009c114
SHA1 8543ea3d7ce997cc1e5709ccee23e4e966c49b80
SHA512 d279d0a12cbfd2f72720e8845480daf1d7d28973641534da0e97631fcbed2e4b2fa553278e8f4d7a2f5f42ed5f1b467e4efdc2005fe0ce5bac058c7b9a43ae4f
SSDEEP 24576:kqktwmdwejB7thP/zrYb1RlhZzux0Q1lQzzckOPsiOZne:Fk4AB7XzrYRfixDUXO9OZe
TLSH
T1FE3533A2A72273E0CCC249D7463800E4383109C33AA737F9F57D9B7FA927A5949D59C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot_20260804_092444.jpg

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\screenshot_20260804_092444.jpg
Size 158KB
SHA256 2b18b92272da8407f70a0ace16fff661d24e1ce92e5cefb008dd2500f5aa58df
MD5 6e75b15bb753a89e4f35647973b43ffe
SHA1 d798e3f3777fd741d5e8b65c3105c3591344fb90
SHA512 8bc3f385de98c57d99d267f540f30761d4c02362de588d31181f6b5ad1d46c6c13876b2ee750607587a90b75af0e4e5681da2ea68db662261bb26d31a801ed24
SSDEEP 3072:mis0uHu7DL6Lrk+GcEMDwwx/0BV8JhxogTc:uXm6rGcLgIO
TLSH
T1C9F3F85BBEE4E88B006753BB64BE934AA7177373D52B7798D04F8E84122E1C11A67CD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.json

Path C:\Users\Admin\AppData\Local\Temp\[GB]RlrXnp8OoLJMTuCVKWLOIWTdGk\system_info.json
Size 4KB
SHA256 688f034de53aba8507ba9b6315d0144f33b46827163802c1a586a2f556bf6ad1
MD5 4ca1d020b3562facb0cec644fe08ea13
SHA1 b940a11cd0e691a6a48331b1b642c28161d195f8
SHA512 19a89061e75339a1ab6156577b071ae499d51db2c96a684284379b12b47f5dff59e2458e5f2b8ddcb2a550fa149afb2efbb3273a3140371ff6d3bb7b9ea2164a
SSDEEP 96:1LiMkWvhdPXadQz3vefbF2lj3sFCyVHoB4XkFXnoJtGIsRP5BflnnqIfhv:1LibkOEmi46XT5qIfR
TLSH
T1BF81FC3CE8B14D535489A178787D1A073370A29B4EE43C08BF9DD14E1F8E21E5A796AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download