cc0e22e862a9779906140193d5d53fb6cd93fdcb059ce48d260e79e0682ad4c5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
Size 3.4MB
Sample260804-lb7sqagg55
SHA256 cc0e22e862a9779906140193d5d53fb6cd93fdcb059ce48d260e79e0682ad4c5
MD5 dbc9c8acae88b0ef00fef47ab8e166a0
SHA1 fa3551bdc52d030a0908ff0c714a13d440a77ce4
SHA512 5d2d500be7a727cee6cc30eca0ebb7590b63d98bbb264004693a9f19d970acf60211ced1bd7a7cfdfe86fdcff5dd2af0f75a4c22a9c2cc9899c7dedb68deb910
SSDEEP 49152:H1gxn3ar2vWv7S/w2cFUFFgOxUjwrifdysdnpJfjZuFN:W3a8WvOF/KfdyO/fjZu
TLSH
T19EF52943E79600E5D5BBC175CE169227BB71385807F1A7A772805AD22FB2FB07A2D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1212	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303090984459039"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
2844	wmic.exe
2844	wmic.exe
2844	wmic.exe
2844	wmic.exe
2196	wmic.exe
2196	wmic.exe
2196	wmic.exe
2196	wmic.exe
5084	wmic.exe
5084	wmic.exe
5084	wmic.exe
5084	wmic.exe
1908	wmic.exe
1908	wmic.exe
1908	wmic.exe
1908	wmic.exe
1252	wmic.exe
1252	wmic.exe
1252	wmic.exe
1252	wmic.exe
4776	chrome.exe
4776	chrome.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
4776	chrome.exe
4776	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2844	wmic.exe
Token: SeSecurityPrivilege	2844	wmic.exe
Token: SeTakeOwnershipPrivilege	2844	wmic.exe
Token: SeLoadDriverPrivilege	2844	wmic.exe
Token: SeSystemProfilePrivilege	2844	wmic.exe
Token: SeSystemtimePrivilege	2844	wmic.exe
Token: SeProfSingleProcessPrivilege	2844	wmic.exe
Token: SeIncBasePriorityPrivilege	2844	wmic.exe
Token: SeCreatePagefilePrivilege	2844	wmic.exe
Token: SeBackupPrivilege	2844	wmic.exe
Token: SeRestorePrivilege	2844	wmic.exe
Token: SeShutdownPrivilege	2844	wmic.exe
Token: SeDebugPrivilege	2844	wmic.exe
Token: SeSystemEnvironmentPrivilege	2844	wmic.exe
Token: SeRemoteShutdownPrivilege	2844	wmic.exe
Token: SeUndockPrivilege	2844	wmic.exe
Token: SeManageVolumePrivilege	2844	wmic.exe
Token: 33	2844	wmic.exe
Token: 34	2844	wmic.exe
Token: 35	2844	wmic.exe
Token: 36	2844	wmic.exe
Token: SeIncreaseQuotaPrivilege	2844	wmic.exe
Token: SeSecurityPrivilege	2844	wmic.exe
Token: SeTakeOwnershipPrivilege	2844	wmic.exe
Token: SeLoadDriverPrivilege	2844	wmic.exe
Token: SeSystemProfilePrivilege	2844	wmic.exe
Token: SeSystemtimePrivilege	2844	wmic.exe
Token: SeProfSingleProcessPrivilege	2844	wmic.exe
Token: SeIncBasePriorityPrivilege	2844	wmic.exe
Token: SeCreatePagefilePrivilege	2844	wmic.exe
Token: SeBackupPrivilege	2844	wmic.exe
Token: SeRestorePrivilege	2844	wmic.exe
Token: SeShutdownPrivilege	2844	wmic.exe
Token: SeDebugPrivilege	2844	wmic.exe
Token: SeSystemEnvironmentPrivilege	2844	wmic.exe
Token: SeRemoteShutdownPrivilege	2844	wmic.exe
Token: SeUndockPrivilege	2844	wmic.exe
Token: SeManageVolumePrivilege	2844	wmic.exe
Token: 33	2844	wmic.exe
Token: 34	2844	wmic.exe
Token: 35	2844	wmic.exe
Token: 36	2844	wmic.exe
Token: SeIncreaseQuotaPrivilege	2196	wmic.exe
Token: SeSecurityPrivilege	2196	wmic.exe
Token: SeTakeOwnershipPrivilege	2196	wmic.exe
Token: SeLoadDriverPrivilege	2196	wmic.exe
Token: SeSystemProfilePrivilege	2196	wmic.exe
Token: SeSystemtimePrivilege	2196	wmic.exe
Token: SeProfSingleProcessPrivilege	2196	wmic.exe
Token: SeIncBasePriorityPrivilege	2196	wmic.exe
Token: SeCreatePagefilePrivilege	2196	wmic.exe
Token: SeBackupPrivilege	2196	wmic.exe
Token: SeRestorePrivilege	2196	wmic.exe
Token: SeShutdownPrivilege	2196	wmic.exe
Token: SeDebugPrivilege	2196	wmic.exe
Token: SeSystemEnvironmentPrivilege	2196	wmic.exe
Token: SeRemoteShutdownPrivilege	2196	wmic.exe
Token: SeUndockPrivilege	2196	wmic.exe
Token: SeManageVolumePrivilege	2196	wmic.exe
Token: 33	2196	wmic.exe
Token: 34	2196	wmic.exe
Token: 35	2196	wmic.exe
Token: 36	2196	wmic.exe
Token: SeIncreaseQuotaPrivilege	2196	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe
4776	chrome.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2844	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	91
PID 3364 wrote to memory of 2196	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	94
PID 3364 wrote to memory of 5084	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	96
PID 3364 wrote to memory of 1908	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	98
PID 3364 wrote to memory of 1252	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	100
PID 3364 wrote to memory of 4776	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	102
PID 4776 wrote to memory of 1216	4776	chrome.exe	103
PID 4776 wrote to memory of 5932	4776	chrome.exe	105
PID 4776 wrote to memory of 1212	4776	chrome.exe	104
PID 4776 wrote to memory of 5932	4776	chrome.exe	105
PID 4776 wrote to memory of 1696	4776	chrome.exe	107
PID 4776 wrote to memory of 4312	4776	chrome.exe	108
PID 4776 wrote to memory of 5704	4776	chrome.exe	109
PID 4776 wrote to memory of 1696	4776	chrome.exe	107
PID 4776 wrote to memory of 4312	4776	chrome.exe	108
PID 4776 wrote to memory of 5704	4776	chrome.exe	109
PID 4776 wrote to memory of 1424	4776	chrome.exe	110
PID 4776 wrote to memory of 1424	4776	chrome.exe	110
PID 3364 wrote to memory of 4776	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	102
PID 4776 wrote to memory of 3740	4776	chrome.exe	111
PID 4776 wrote to memory of 3740	4776	chrome.exe	111
PID 3364 wrote to memory of 1216	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	103
PID 4776 wrote to memory of 5132	4776	chrome.exe	112
PID 4776 wrote to memory of 4128	4776	chrome.exe	113
PID 4776 wrote to memory of 4128	4776	chrome.exe	113
PID 4776 wrote to memory of 3088	4776	chrome.exe	114
PID 4776 wrote to memory of 3088	4776	chrome.exe	114
PID 4776 wrote to memory of 5464	4776	chrome.exe	116
PID 4776 wrote to memory of 5464	4776	chrome.exe	116
PID 4776 wrote to memory of 5264	4776	chrome.exe	115
PID 4776 wrote to memory of 5264	4776	chrome.exe	115
PID 4776 wrote to memory of 2024	4776	chrome.exe	119
PID 4776 wrote to memory of 2024	4776	chrome.exe	119
PID 4776 wrote to memory of 2480	4776	chrome.exe	120
PID 4776 wrote to memory of 2480	4776	chrome.exe	120
PID 4776 wrote to memory of 3800	4776	chrome.exe	121
PID 4776 wrote to memory of 3800	4776	chrome.exe	121
PID 4776 wrote to memory of 5064	4776	chrome.exe	122
PID 4776 wrote to memory of 5064	4776	chrome.exe	122
PID 3364 wrote to memory of 1212	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	104
PID 3364 wrote to memory of 5932	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	105
PID 3364 wrote to memory of 1696	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	107
PID 3364 wrote to memory of 4312	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	108
PID 3364 wrote to memory of 5704	3364	2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe	109
PID 4776 wrote to memory of 2740	4776	chrome.exe	123
PID 4776 wrote to memory of 2012	4776	chrome.exe	124
PID 4776 wrote to memory of 1468	4776	chrome.exe	125
PID 4776 wrote to memory of 1376	4776	chrome.exe	126
PID 4776 wrote to memory of 1376	4776	chrome.exe	126
PID 4776 wrote to memory of 964	4776	chrome.exe	127
PID 4776 wrote to memory of 964	4776	chrome.exe	127
PID 4776 wrote to memory of 4928	4776	chrome.exe	128
PID 4776 wrote to memory of 4928	4776	chrome.exe	128
PID 4776 wrote to memory of 5956	4776	chrome.exe	129
PID 4776 wrote to memory of 4420	4776	chrome.exe	130
PID 4776 wrote to memory of 5956	4776	chrome.exe	129
PID 4776 wrote to memory of 4420	4776	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_dbc9c8acae88b0ef00fef47ab8e166a0_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" diskdrive get serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" nic where (NetConnectionStatus=2) get MACAddress
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get ProcessorId
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bafcc728,0x7ff8bafcc734,0x7ff8bafcc740
    3⤵
    PID:1216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,14407738082127925509,9058982135414629639,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,11723926992450926155,7965084978816334654,262144 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,8094133745611832604,15734674308528138017,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
    3⤵
    PID:1696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,6201781625571026175,7598037889477422243,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,9613403156629088232,13230931763826439813,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,17009317190626716145,9766467005086714434,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4456,i,15283848975110346044,7378436216238495555,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:3740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,2096472800051095906,17743537714780048573,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4972,i,17180489403990421973,1198173652803885830,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5352,i,3836398124768670793,15280940474632432727,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5724,i,15490533065734943086,5014032367614130241,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5676,i,1453367407968683983,12201401023572440831,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5472,i,11414107281567805448,3623882096725758399,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6012,i,11821275163565430043,399104293203907131,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5464,i,14925255159031375556,3890043063053663674,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5796,i,736038964662107777,14602584765850051871,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,8574960773127346597,5352237586449486551,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,547959995991370066,4349357443997484843,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,2208729356801685305,2628926543328351752,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:14
    3⤵
    PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=896,i,6216324514117843043,2102070875752431346,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=1168 /prefetch:14
    3⤵
    PID:1376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,9069824523974801431,3991495258909833414,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,2340996793015076604,5703275661167185786,524288 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:14
    3⤵
    PID:4928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5884,i,2632959839452482408,1974636093983055016,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:9
    3⤵
    PID:5956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4936,i,8235849109183857476,1463212736167405606,2097152 --field-trial-handle=2056,i,2691702083570971908,15495977712298292134,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:4420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dae30d05-cd14-4bc1-85d3-209f30b56c85.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dae30d05-cd14-4bc1-85d3-209f30b56c85.tmp
Size 2KB
SHA256 06025943bf7df7d4014255ef114ba5c5b39bb6ee5ee3304a10bfd93e2bd5c9f9
MD5 9b6b9fb299ec2fca7d210638bbd13f26
SHA1 310ed5d15b1b3833365d8db19ee39d234ea5b9e8
SHA512 67da199b82f09ae7ff411bec46f8df2fa790589a42323afbed326d19c0ad952a9e2d352a7a83393e9633a9a7877fa93e719c56a7c7bf239fbc93742e174f9e27
TLSH
T146518CB3C3D8897D891156F4DB256E2BDE2D0E18132D3C26C8D9AF5B57F2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a199d966f841144a31c525a1925bf362ea4c6f5eb17e5b01b6004416eac94a45
MD5 ff2355678babb15c0a6ea2ed138f9deb
SHA1 27fb70ecbdb276634da041eac9af0121827fba0f
SHA512 289f2ac82c4d5fe7c18ee33c8e4adbe898da180b4aa38ee268765bb363f93940bae7b5b66d6d43f038498477906758bbb0482a1b4a2e24416533fb8500f48dcd
SSDEEP 192:exRc4f7p+a9ZjMF+v7pAPRp2o9XxHsb+WNncgAr0UeZW2/feM1GVyIsnAUge:exRc4f7p+WZjMF6AXjfwcrr0Ue02/Nee
TLSH
T1C532962DAE24793B6DCBC22EFA657693D7F6202121D42D94E7FC952C11EB5CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a85475319b46c289a1d5a555f27ea32590057bff5126057ad146e73bfb7629a5
MD5 3a46e24663cf31341644bf91aae9de9b
SHA1 7f98fb4d73ebcd7183d55b9a53914b11d35bb9de
SHA512 65807d9ba99e0aea1f10a9428d2e9a61241adeae9b74f6fd25c88bbb0e3e216f84cced71c672938195ccf67a912b2a4e5ffe254eed3d8deab773eebc1f6bf6a8
SSDEEP 192:exRc4f7p+a9ZjMF+v7pgPRpqo9XxHsb+WNncgAr0U6ZW2/feMTGVyIsnAUgE:exRc4f7p+WZjMF6gX/fwcrr0U602/LeE
TLSH
T1D942962AB914793B6DCBC22DF9617B93D7F6202121E02E94E7FC9A2C15EB5CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6e209ecc37847a99d57e198d41ec2f980247a1f0810f7d944857c9fc3e13f930
MD5 d3fd5b1e7054aac77389fdd8cf67fb5a
SHA1 d34415f631b61dd398cdc60cd7996af7cef834d8
SHA512 ad182be4da751afbf7283260e39b815c4b2bae1a18b46928c8ba85798238ec8a2ee73e6299ed1a560ed7dff60f49213ffdef8d820e1561e68ca01129fdbb5073
TLSH
T148A0021042D01B11CD6092B1706207426293485817B6470755AE44968D5F5D24501601
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b26be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b26be.TMP
Size 48B
SHA256 cccb549cc19aad4f85db8158aadf0e15aef00b50a8fc02e66338f32d3c19224f
MD5 cf7534c3391293ca9ad107fcef8b27e7
SHA1 2d1a378b6e2ae64dc6d59bbd8c8be16c2c256465
SHA512 13e308f9c7d4670cdc53d932c6848e2623f302ee9512bd50ba1643958dde4f9d89d6e9f220173932cf0c64cadf41957aaed2395a772301d79c8bbbea3ab4a662
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 cba42eb2c40982eca0de7452c05e3f06af6a78c5467120bafcc0143f5bed1497
MD5 68e2673fb064dc266aa9b059fd99bfc8
SHA1 dd39a27e6ea698c81c4a18d52cfb47cfff1769ce
SHA512 79f98da69832e087dac4b142f9b3ab4e31a1a5acac74cf0879226b9131c7731987765e374312fc28243d64c696b273af84511df81532f8a8bd6b6005811796b8
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oa1phVumSVn+a:1nbZeMrv/hGta1psn+a
TLSH
T147D3884B3A747102EDE59A722CE0517B5E3C716D8F1595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 e272d0fef654e7347303290d1aa5c47df658deb64f0702c327b15b6531f2d656
MD5 16c379b4306952657964a72dba0e41fb
SHA1 7d037e6c9a921b91d54f3c6c6894c04dce128584
SHA512 4902989b04183772f7bab9d8cd36433091cb16d43d10e297cb6992dde9432a9b78c092f7287dd51293a57af8fc316a12e07096a727f77aa71d843a8ca04517e8
SSDEEP 3072:tFUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUy:zecyezIAG8tUj01r
TLSH
T105C3123168219C77C5B40464B22A7A47DCE5A686C689F7D8DBD82B5E198B34E0E8B033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d402292535fe877ac10ad7c560a22acbc80c1096eb77a6972b6fc5c3dfabda2d
MD5 f121400defa9ce9f3787d398a1246b8e
SHA1 831e5ef9694e1fdea38bba795c6517cb3cc181a3
SHA512 a4feaa53bbeaecb66f87413d31301b4e784e755a2e5e60cf59c975a25c35bdab78f15fe4e8b6636150698864bdd648f49faf01cf06ac11a54207804d71820949
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5cdmDcbB6nGyvn0b4T814ybJv4a:xC0ITo+TQ0InDUDcmclPPb4T814ybl
TLSH
T186A10835A0285C774476D446F1622A43CEB9706BE9B2AFA0FAD90E0D24F70EC1352A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 3edb9053c942155c68d48b07a878558b3bf9a8b6f4226c963d7c4dfeffe2bb42
MD5 09434e516e3ff17cfad65396071b4917
SHA1 cbd66d9ff1b35cc3299ada57eccead02b4aba393
SHA512 450c1fcd439f4d6fe408e9aed56d5bbf79ae411f16b1e6f245dc1ef5b3201566e0ff013880c3b41c0a25139662e812ff2358f7e73f1671c6a589768f1615c62c
SSDEEP 3072:zRFUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUy:z/ecyezIAG8tUj01r
TLSH
T108C312316822DD77C2780161B33F7E47EDA965858689B3E5CFD52B2E198734E1ACA033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 46f3d21154a0fc11a2a4c511c2671a65d95607d265b3f9dfbbb6e1ca65bfd820
MD5 3a78199be469bcc8a5cad9f0face8eb8
SHA1 d7dc788bb64dd949627cff80048d12a75b2cda66
SHA512 4abd8b71a3650ce0f08efc7c1156696397d98d301ced7fea4c051e820149545a9c3b69491b8052dc391a4dcf250ef55887c199fa76b28d6745bc122f80c2bb30
SSDEEP 3072:SRFUpqC0rlM+fzI07Z4sSmmeaoOiG5jNC0WrYyrUy:S/ecyezIAG8tUj01r
TLSH
T149C312316822DC77C2780161B33F7E47EDA965858689B3E5CFD52B2E198734E1ACA033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_downloads

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\temp_downloads
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_downloads

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\temp_downloads
Size 224KB
SHA256 5339e213212614b42a50177dc480748841065e9cf2416abd213cb2c562cdd7a2
MD5 392ffd1412839f591ac0d42627c3c797
SHA1 6a705d44697c675b761c002c6ec7842bb653e2dd
SHA512 d655bdd1378d1c36080d83f14035ec682e83b498b838973ada3331031e3a5bfc465b869e650e22508d257fab29c7b4bc7eaf5f40c379ba11569a30cd68efc092
SSDEEP 96:baLFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bpH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T17524EE4E5F343722CDBD913668E744A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Edge._history.txt

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\Browsers\Microsoft Edge\Credentials\Microsoft_Edge._history.txt
Size 167B
SHA256 de3a7458b20496d5e53a098bd40eea04488dbc9c9bf5afd38364f92117c941ad
MD5 0d41e8f5554c439c6a22992be3faabf7
SHA1 adae83a531f08aeb317551070f4f65ceee6274db
SHA512 2d4cb4eee198b51bd0bf91fd3c9c757131c79d6ae30af243dba27ab9c6667e7de61002c6cfca6a781fb0398ed36e93cfef3d37fb24b3f2df4a6331b6ebd95266
TLSH
T1E2C08C44EE6140E5122BC2F478877124D967F20F0284452569C11851E40A33686CF8FA
MD5 SHA1 SHA512 TLSH

Submit Download

CloseSync.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\CloseSync.docx
Size 874KB
SHA256 5138fa6ce5de4d84a61dd50ecb609c53a62730f07c75ba80b72fa98578e5475c
MD5 2f1bf8db12ae9d266746fe15979d626c
SHA1 22b0722d1c5f8064ab289902a2c0c2e29b1053e9
SHA512 311582a99c50d024c86f77211f2388a1baf5ec964d7ec2f73c02f2840ee08f7724c107f40da6414c781a8d3bca4d569547f3bb95bd102b4cdba753b0e3d28d0d
SSDEEP 24576:ubtHJrEa5LngqroXc8B/QKuBNYqhWMH3B8:YHJgIhoXcA4biqhWMx8
TLSH
T12815339304B46A2FB56D569405F22CC33EEFC37C79A4433B2EA27A44DD292A043E535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableSync.pdf

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\EnableSync.pdf
Size 1.2MB
SHA256 76a51876dfe57f9a7494612d39f19cb44f0152118737d12d6a41244a290a7541
MD5 c62b8f17632456f00c53282db8bad656
SHA1 36077c796567e2901c9ef793822cf25cb53300f4
SHA512 ef55184ece4f0037f67cc6a57cd035627c9b301838cf3a7307b40d973caf0b7097789faf39cc49852abf9cb416c25bbedaf6c63348dcf8803de88bbfe905df53
SSDEEP 24576:lJczWv9+5BMMJa6XoSBLjc5XXMDrTJj64HJp9L/BDTMk3XAUe5ZRl8awHmWDk:lgW1+kEVXoCoXMDrTsOxLRTMk3wUe+HE
TLSH
T182453324D51BDBCD2F928B4C49AA1DEF2F4F01B10A0F711729BF17997324E2EEA40582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterShow.xls

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\EnterShow.xls
Size 630KB
SHA256 2efdbb4e593a29347e7b1562f77560fe68d43ba716de46452eeadbf81f1aa92f
MD5 b75c378fb02a60f77f090a878640d32d
SHA1 bc57b9d7a8becf3a974e6eefadeeff7ec2d6904a
SHA512 765ccf288d9b7fa69469e250ca58346205a75152b406a6d708b52c663630a7186db76b63ae0c61b7ea8f390ee8ee953da82159714b772f21a7107ae81293f619
SSDEEP 12288:pzXQqD5epHdt1dUc5vYtIqz6V+IfvUUj5YbFAE3e6Z6oDYuT82DBSk9uA:iqE1dxrqKfb3GZNMuTSk9T
TLSH
T130D4233C49F87794BAB5E1B90B9139C2F639C153DB8898086C5CB90FB4EB64190D6BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinMerge.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\JoinMerge.xlsx
Size 310KB
SHA256 cc8e9681830f40624b0d2156e564e034f7dec7bd5fee02e4895840a457ac2068
MD5 5ba0e17bcbc1e73e4a282bbc750aee7b
SHA1 4dc81f9d65a938f1f5ae27edb56127f72842bc31
SHA512 2de908ddc72d50029d6520ffb594fe34e45d700354376c370cf0dd32d498a9b8ae45d5ea9aa4dd20148d5ca8386837f7ec943aa1de85e89b2426df96535c4fd6
SSDEEP 6144:z+W0x0SuVYe7rYeKiTii+s6oTuqKoZ9ljFY5ZjbuQXzx6Y4i0i1P4p6h96uYQlf4:ZYeANqiP71aZPjFMZfuHoPQQ8Vqf4
TLSH
T1866423A35463F366E6C72665806CD53CE7A069A35474D8F152D0EF48B8CB3E109B8DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\LimitDisconnect.xlsx
Size 11KB
SHA256 d97d53612beccfecde66b2c297e0bd83389bf35b9d17b7226693e37638bb2c00
MD5 c48ae23c9e362c6ba78ee5b741ed101c
SHA1 d72d16b9666edac2a5f399d86d5f78d2cefbaf08
SHA512 ce1e85c502723624b51a35519317316aac4b224e15e210c598d5a016c7009736d1eb5c060cd06538e7389d2d254a046fc1b57147568c430b3418807544f84280
SSDEEP 192:wc8mVqkCMb3U2npXaFUlbVvevUqzQXpS0EBBUBrMaXDes7jG+aoyc:wc3B3HKUlM9z6p8PUBrMYes7ZaoT
TLSH
T14C328D6DD130952DC6BBC43EC14D01D1B36FA1C28B922588AC24F6AF12455D783DF2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchExport.xlsx

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\SwitchExport.xlsx
Size 14KB
SHA256 43c6c13fba47aec3b6fe97e83dc9ba461fa17bcae6e747e62925d053c6993456
MD5 a51c809b48cb5439561fe8fc89f0723e
SHA1 1a99f994929c07ee68c41d471e45dfcbc59616ff
SHA512 71f0c09542a7d9075e4fdcb5ddcb55cd1eb381c9515503ad0c8a3dceb61e04f2627f4e528761168e2a118b85dc45868751c3f3eb0762dd4097d754694481068e
SSDEEP 384:wc3zr36BtNh3I0UlM9z6pEbMP1ICSnjjaL4LDqao0:wSmXNh40xWpEwgnjOLrf0
TLSH
T1B4627E7DF030A05DC13EF2BF962901D7735AF0C1864D398D955AF5692299EE7136E280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockDismount.docx

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\CommonFiles\UnlockDismount.docx
Size 14KB
SHA256 dcf72c1e20be5ce6d936a79913b6fedf83d827052a7f4650abee1d4af3476f0a
MD5 1b68518ff8168bfa7578ba3ba065eeb7
SHA1 9ffafb8b0063a2ebd9dd9f1d1457c481fda7a622
SHA512 2b96b7857a97139fdd287e622959c1ac5bf88be386e769b67fd7ef0347f3c5992f770bda8b61d640ee5451d974fb99a3bcccb8896888772503cd0af3a6c5edb2
SSDEEP 384:afPMo/EfLFwdNxt/ZtNNwUcZIFHDJmsp6N7U:YPF/EfLqxllNwUQItDYA
TLSH
T1D062BF31D2452020E5B30ABEA52A51F6D05E54437F62A887309EAF8F83A3F43539789E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot_20260804_092454.jpg

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\screenshot_20260804_092454.jpg
Size 121KB
SHA256 edddd0e77b565a028860386f9859b9cc2064f148c9eb9d8a9f3cc19890623730
MD5 9b71a0249dc77b1fef77d23c8159e474
SHA1 904511b7c6b80dadcc423d3abc8533715170459c
SHA512 85a1b6af1673c7b761a25b67140a61a06c9045766174a2e82bbbadd728e8cc176ae2038813f113f477557a6d48f6aba82ed297fc2d60eae92444ece6938a4d6b
SSDEEP 3072:Q9i1931VQVvryg/+Q+sPgpLLGLUGz/pjn3oFCFMdqkthJ4pX:S8937QVJW1sPgpLLGLdtj3oFaMd74N
TLSH
T13BC3C7139C048B87A06D87E4FE034E9D2F196B0CF8923EFB55625FC63A606671D9E02D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.json

Path C:\Users\Admin\AppData\Local\Temp\[GB]8OliZn2FJNefS3UyRZfp1ydeRW\system_info.json
Size 3KB
SHA256 1c90d44740a3aabc19e33001a799aa4fb8d07cd85f8811aa6f5b4a148559dfb8
MD5 2e94b8e517db4538e00ae0794fc9ead2
SHA1 d746fc53ce808bd80b6a3e4d2bb56117d958ec1a
SHA512 412556102540d87e95c6a7b5ee50a5016d02160ee93eb689c2b1e03c43b0cbf24b10097a28f69e7c92f54834e24ae51faf9b5db3f2be17bbc960dcb3173b12f6
TLSH
T16581093CE8B04D639448A174787D1A077370A29B4EE43C087F8CC14E1F8E61E6A796AE
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4776_804923429\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download