Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe
- Size 3.6MB
- Sample260819-2wva5avfpg
- SHA256 a3667fb6487ab20d4a39545cc74c1733f50e67038bb8273bfe55c33d3157c430
- MD5 4c1e07fc99c2257b057a1fd7a1dfcea4
- SHA1 511d248b5ca80789fca806233055942b2d08ed03
- SHA512 41b29a7574898de900e3c4232e1d1e51a8e538530a51e948cf67701075ea03f00144bcfd6a8b8e5667405957547e312707b39170913a9646a5f0bdb2837a61d8
- SSDEEP 98304:CNmN+tqJNLc1PHyN2oawRPenm/0OZ3L/OrbjoYo:CYItqJdcpSN2o1PsOADVo
- TLSH T11D068D2236C481F9E34292708D98BAAC07ACAF7893FF54F777A518E949319C17525B0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4504 set thread context of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 set thread context of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 set thread context of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 set thread context of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\History.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4852 chrome.exe 1532 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316538013518917" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 2604 chrome.exe 2604 chrome.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 2604 chrome.exe 2604 chrome.exe 252 chrome.exe 252 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeDebugPrivilege 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe Token: SeCreatePagefilePrivilege 2604 chrome.exe Token: SeShutdownPrivilege 2604 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe 2604 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4972 2604 chrome.exe 92 PID 2604 wrote to memory of 1432 2604 chrome.exe 93 PID 2604 wrote to memory of 1432 2604 chrome.exe 93 PID 2604 wrote to memory of 1532 2604 chrome.exe 94 PID 2604 wrote to memory of 3076 2604 chrome.exe 95 PID 2604 wrote to memory of 3076 2604 chrome.exe 95 PID 2604 wrote to memory of 780 2604 chrome.exe 97 PID 2604 wrote to memory of 4120 2604 chrome.exe 98 PID 2604 wrote to memory of 780 2604 chrome.exe 97 PID 2604 wrote to memory of 4120 2604 chrome.exe 98 PID 2604 wrote to memory of 4552 2604 chrome.exe 99 PID 2604 wrote to memory of 4552 2604 chrome.exe 99 PID 2604 wrote to memory of 4192 2604 chrome.exe 100 PID 2604 wrote to memory of 4192 2604 chrome.exe 100 PID 2604 wrote to memory of 2112 2604 chrome.exe 101 PID 2604 wrote to memory of 4572 2604 chrome.exe 104 PID 2604 wrote to memory of 4344 2604 chrome.exe 103 PID 2604 wrote to memory of 4572 2604 chrome.exe 104 PID 2604 wrote to memory of 4344 2604 chrome.exe 103 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 2604 wrote to memory of 4656 2604 chrome.exe 109 PID 2604 wrote to memory of 3408 2604 chrome.exe 108 PID 2604 wrote to memory of 4656 2604 chrome.exe 109 PID 2604 wrote to memory of 3408 2604 chrome.exe 108 PID 2604 wrote to memory of 4192 2604 chrome.exe 110 PID 2604 wrote to memory of 4192 2604 chrome.exe 110 PID 2604 wrote to memory of 968 2604 chrome.exe 111 PID 2604 wrote to memory of 968 2604 chrome.exe 111 PID 2604 wrote to memory of 5912 2604 chrome.exe 112 PID 2604 wrote to memory of 5912 2604 chrome.exe 112 PID 2604 wrote to memory of 2084 2604 chrome.exe 113 PID 2604 wrote to memory of 2084 2604 chrome.exe 113 PID 4504 wrote to memory of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 wrote to memory of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 wrote to memory of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 wrote to memory of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 wrote to memory of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 wrote to memory of 4740 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 114 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 4504 wrote to memory of 2604 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 91 PID 2604 wrote to memory of 248 2604 chrome.exe 119 PID 2604 wrote to memory of 1560 2604 chrome.exe 120 PID 2604 wrote to memory of 6092 2604 chrome.exe 121 PID 4504 wrote to memory of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 PID 4504 wrote to memory of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 PID 4504 wrote to memory of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 PID 4504 wrote to memory of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 PID 4504 wrote to memory of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 PID 4504 wrote to memory of 6124 4504 2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe 122 PID 2604 wrote to memory of 5764 2604 chrome.exe 124 PID 2604 wrote to memory of 5764 2604 chrome.exe 124 PID 2604 wrote to memory of 3804 2604 chrome.exe 125 PID 2604 wrote to memory of 3804 2604 chrome.exe 125 PID 2604 wrote to memory of 5032 2604 chrome.exe 126 PID 2604 wrote to memory of 5032 2604 chrome.exe 126 PID 2604 wrote to memory of 4916 2604 chrome.exe 127 PID 2604 wrote to memory of 2652 2604 chrome.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_4c1e07fc99c2257b057a1fd7a1dfcea4_elex_glassworm_luca-stealer_njrat.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:6124
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵PID:3396
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x10c,0x134,0x7ffe1a27c728,0x7ffe1a27c734,0x7ffe1a27c7402⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,16062562095380958638,6698920549244147337,262144 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,3284551889423201446,14256873870216852257,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:112⤵
- System Time Discovery
PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,11724370004328683383,11266565647628691290,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:132⤵PID:3076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,202607899056160991,8640433593042365587,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,12934969004303332577,11272386464273220244,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,1048581574558960959,8023228507376584757,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,8002908913145923154,1581237228162002208,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:142⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,3968753184778993780,9530444827416277381,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:142⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,303517220261058600,11491160264125936792,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5444,i,18323576859151003157,6223140421268501792,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5676,i,17794320525860458004,17057588174693376391,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6300,i,10279238664703821789,13806903666428283018,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6476,i,10360812921755114556,7270590660869304715,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5520,i,14732974974417124982,4281920671169117199,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6288,i,17557888593969289185,1516723990713329447,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:5912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6080,i,14410937256859360969,9925675220874509709,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,15057416567222139754,18202509614007890188,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:142⤵PID:248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,17867078611708121875,3045024875764152816,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:142⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,2835546745939026324,3510530650723743391,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:142⤵PID:6092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,5642890819278868440,1365077565864500870,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:142⤵PID:5764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,10293658238500887679,6918327291697711381,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:142⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,1362809634031088013,10267956360725393929,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:142⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5608,i,14365048528755754154,12282571202277557682,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6316,i,593847884108372326,5736894621024706877,2097152 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:92⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,1698040289163699725,9808577328765491396,524288 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:112⤵
- System Time Discovery
PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2308,i,1671618145166163337,5337802591251904622,262144 --field-trial-handle=1896,i,8857944143875373756,2182733692044137375,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:252
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2088
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:3060
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:6076
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5740
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4544
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
- Size 1024KB
- SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
- MD5 34c29bdb9e41b1f47f2d2786762c12ec
- SHA1 4075131b18c3487e3e848361e112009c897629c7
- SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
- SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
- TLSH T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
- Size 28KB
- SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
- MD5 faa1297eb819d33082266d374c1d492d
- SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
- SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
- SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
- TLSH T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 5aedb36c424ae8b613ee4cd330da04bf13c9054e823552b2f8fd55cbea3f8e21
- MD5 40269b497e58f1ed7fe78b54c803997f
- SHA1 7844d0d198166163bd7557fc77323f0e5fc17d1a
- SHA512 acfa5cca0b6135da40ee3c00d697b8dfa7a5e124dfe1ad089bc44adeabed3e4ea73591736710aba0fdc3a81bac7c7f61f7248abceb06ad35f4fddcc76df405a1
- TLSH T17AE02BAAC921AD371CFD1B1A9061174AE791131B3A40494B7E3DD40C8FB0536854AD6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
- Size 4KB
- SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
- MD5 262c0580bba9c2d102a813b38f64fff1
- SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
- SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
- TLSH T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
- Size 44KB
- SHA256 5123d6601b49c953426174daa7cdf25bbbf9d35356af9a5db45476ce8474aaf5
- MD5 19542206e2ac324a07a1eaab20f05d32
- SHA1 d1b28a4f1cd7b29aafde35feeb9c5fbaf85e6cb5
- SHA512 f9087bad70fa6b3ec3447b17e89445db68f59e2f6b6cbf07597d0a256d29ef119bed5593b9e8c4d7f8837cc24f1da0c090b920ecdd5648576442130675401bfc
- SSDEEP 48:/JqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUqz7xETK5Q4L:BCEmrm43b/LuaLNW9WjWbflV/x2K5Q4L
- TLSH T1231342438E383C65F8CA8B3749C98AF70F3C4368965B5E64A5A884734D8260584FB8FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
- Size 320B
- SHA256 1546e8181015c80388f55b980c7f29a4ccb70df48cc8586c717b7985e189c314
- MD5 fc910a84376abc435f4c07163ae4ee82
- SHA1 a0e0228426c749f4d4b2a1dde9850abb6dd48f48
- SHA512 c9887ad3d1f1d45f884f3204c5beaf66b8064b3095426c3ce2e8e53f550df8a97f97252e1cba0b37617370a3549b50723bc91f330eead0b8cb3ba5bfbc55acf0
- TLSH T13FE0864874DAC6ED68958467D375534CDBD0380EA7CC7E0217459494618650563F1265
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
- Size 665B
- SHA256 40cc9caed60a80836147aad66a15cc208a4435791bf1c0048f8d190f8625a771
- MD5 03edaf231c5e3ed5a8eaba24c19f4f02
- SHA1 f7eaafce0c98b1f3a07953f7142e4f281cfe3ba4
- SHA512 99426a4610966500df73c72b6259a89c94c2feed7becfc6fdf37b4e964e0c98b8123a475e5c1f48e387851279f5ddf75f8a64d510f02cfc6aba635806d29d3cc
- TLSH T125017DCD5F407B67E67A1972AC03134E2F7169A1429029824BF82DA27C85E629B37440
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
- Size 267B
- SHA256 ffdbf33295a949e9b4b48a596e3b499ee16c1670857ae256f7c5cc047559df7b
- MD5 293c6bcfd2465cc6075a4f8b1bf8a0b5
- SHA1 8c9da116c8b353791e49d6d3d64a9ac3bf926dd7
- SHA512 3ae72e0698f1ae015f20a3f868909707c09717bfc34077714b12137fdfbcc9e218f4e5a80909d883c6bf4a8cf0b2bbbe5c9fae2f4a505ca8b5faeb21b52e2b2d
- TLSH T12DD02B0A24E4CF6F2580C0D75A30930ECACC344CDBDD36160F00E40850CA80C92D2252
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
- Size 52KB
- SHA256 1f748422e0b9d41d3258e470a35524c6fd146106b80b841e65f4ca49bd07403d
- MD5 8b5918e8869494c27e10b44b373d6e82
- SHA1 c632ba43618d1e2884c6f05f55e1bf7eacda1a32
- SHA512 9106b4c3dda7724d90729ca96cdd206f6ac3d2a7cdabb47740e735ca780e170ac2d10354600c34ca96151f3df35f7bb31863adca60af8b5e3acad770f16c34b3
- SSDEEP 48:TudHYzydB+M9n+8dv/qALihje9kqy2WOT/9F:WHCydB+M9n+8d3qAuhjspFWOv
- TLSH T1F4334EB375176133F816E67CBEA8199008663AC58DE1CAE4DAF00C302FD6650E71F9D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5d007d23-f5ee-4bb3-8ddb-3c053b4ea192.tmp
- Size 2KB
- SHA256 fd2cd5fd36766212cfca0ea36d1eaec9d2d2a533fb7bd3b58df345bc893ed7ab
- MD5 247a1a56ea47f38894de793cf3648020
- SHA1 1294553021397cf739505e066404b9418826b415
- SHA512 a1db87155266b9530837b266f133eb20889e357dfae829d466d6ab768bb5a62523334a76428a8a76568a37a76f8f7e9e8c1b616d8f5286647603b602e116dc52
- TLSH T19051A9B7C3E49A6D851152F49A21BE1FCD3D0A24521D3C6688E8AF5F93E2972D20079E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
- Size 36KB
- SHA256 3b8dfd5dab3afc8cec5b3eda4f63fee1233707f39cb0f23031ff4992fabe513f
- MD5 af7175500337fcfc2113e4002f8b4ca5
- SHA1 083a2b3ac27deda3c6992d16b313b1f4521b02ee
- SHA512 2a8d992b8510bfd1ebaafb49bcfbae08ee668ae689058e496df6c05071410b57797bb609aa87a56d2fa002c4a325c9da645a8684e4240479958af0e7fe90cb29
- SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOF:OIEumQv8m1ccnvS6gG
- TLSH T12CF2DFFF1B197601C0E49674D6810ECFFD2D051D4B9ABEC09AAC09F2AB875A3A538259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 070fd069ff00b49d864ee06bb1d3ddb3236597f80d67ef950de9737879a893b5
- MD5 7d9319515f75c5659d3393b462b6d136
- SHA1 7a8cc909fe8ad8b703ff66dadd3e9fc8c9bd8894
- SHA512 bc0741e26efa7a039d9ce6976f7ee47adae719f3fa9fef8f0dd04326ff300a0c98473d7f90daa715bfd020be907b678db7b385f08c38d47eea40331b9b5213f1
- SSDEEP 192:0RalAuQv7JQAPRp2799Hsb+WNnDe10McKoUaaRScxVyIsnAUgR:0RalRMPXcvws0JHaRR
- TLSH T16B32B62AAD10383B5DDBD629F9227753E7F5112631D42E84EBFC8A2C25E79CC121744B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 0e5813675b19705ab63d9346e08bc7ed32504d41f1404cb1e6f0222f9dbf2f9b
- MD5 bffd66657f2edbfe8e77874389f40427
- SHA1 3602ea3ded631563f66877456c8cb1977c903c20
- SHA512 1fb7332cc6f0764fbd70e7d7d9b7f0af941ab21ccdd6a146d88e023481bf6b8c2638ed985f128056258c6291f1108b24e139a1581bbe286f5d3ce0f98b8fd4ce
- SSDEEP 192:0RalAuQv7JQAPRp2799Hsb+WNnDe10McKoUaaRScxVyIsnAUge:0RalRMPXcvws0JHaRe
- TLSH T10C32C52EAD10793B9CCAC619F9227753E7F5102671D42E94EBFC8A2C25E79CC221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bbf9bcac5e2b5c20a6b483c3a6d8e0e787187c0388c4b4e11c4b232f7050b628
- MD5 67b2faa85366e2b05d8d18b9c3540324
- SHA1 074a4029d1e512eca214ee84c0065ff176e4e452
- SHA512 91d6c7817c83aada21c590b9b0787368211dc3fb1726120e877c6ea9cb84b7f6b6d0a3c619211f706c72db28e3fd7239689ac48f6795426637c578e12143ea21
- SSDEEP 192:0RalAuQv7JQmPRpK799Hsb+WNnDe10MYKoUaaRSczVyIsnAUgE:0RalRMRXYvws0jHa3E
- TLSH T16C42C62EAD10393B9DDAD619F9127B53E7F5102671942E94EBFCCA2C25E79CC121700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps
- Size 33B
- SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
- MD5 2b432fef211c69c745aca86de4f8e4ab
- SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
- SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
- MD5 6560bcac7a7f731129acf32fe41d855d
- SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
- SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
- SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
- TLSH T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
- Size 270B
- SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
- MD5 70ef71dd0fed6c14b2b6e149267a2c2a
- SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
- SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
- TLSH T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
- Size 317B
- SHA256 60730b897070344385941d80cc55cd5ce851d1922d06a591c61d023c63b444e1
- MD5 612896eff07829fb8cb4b3bf403eb79f
- SHA1 84f1fb028d2c6889a356d9678d9cff8a4205a4fc
- SHA512 a9b361e79cc4c528b21ab5cbaccdfab5796beebe0ad0abec9eb881e7bb6708e8b1f40e5415348649a1707477057110744a325a11b14353312528e93acfb6d5ae
- TLSH T11AE0865935D9C76D2994C077A270630DD7E1380EF7DC79421701D488328651963E17E5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13431653797416626
- Size 2KB
- SHA256 f6969617d0509949b22bbc577384de99bd894be68c86e335d58e1f953993b51a
- MD5 f6c94f9f91599a2c1e072d925d457bc3
- SHA1 870f870f3789a8f2027befaf6088e8b524a3faab
- SHA512 7d9004c4e66396ef30843e35d1df29b2d21840bcac2ff8dd61c02f29b2d45d108bc5becd45318f7922cd95276847e621bf1c69edab79a1222cb6daa1b5aabc1e
- TLSH T13E51C05659E4113FE23F8139C7F622E7AF36B64A20418E1F616013240DA3652AFA1DEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
- Size 20KB
- SHA256 4fb062fed1dd79dcf475ebe91ac5b2a6a89dbcb8fb3282f19c7ee3f97e178063
- MD5 0bbd477bb50e68eeb24bcccd9e680f47
- SHA1 e804e6926419ed21997775290fc2598396dc89ab
- SHA512 e30cb2cc82feceaf1461204476d87eff44a0b55d246be94fbce9712327a03c16e0780d6c04cc8125e7ba270c59d0518fd7c89110aa5b3f20f2301f57f1c89e6f
- SSDEEP 12:TLiNcUMskMVUsLjCTH3EfxHQSOaQlvsdFxOUwa5qgufTJpbZ75fOS:TLijMnYLjw0JQoQlvsd6UwccNp15fB
- TLSH T167924E426E206021CA5F4B3A4581D6E95FB6D92C4E43FE138DE44C146FB4580655D699
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
- Size 345B
- SHA256 cc6298666f57e682e52eb16f3aef12c98e610f0a04eb94a8833bc897f97d8629
- MD5 fd5a014cbe1d00b789e16452f0479de9
- SHA1 2e3c86dbdbdef4f73c637da5537361ed9141c117
- SHA512 1f82da2591222719daf76a49cf433d62d039fd5b64d978f0c2e9363cea93a63084d8e97560de1bfa579d0ea8bd87a467e11e4ace9ab82bae20994517a020010e
- TLSH T13AE0D86835CACB6E24C5405BE230E34CC5E17809D6ED65311B08E68456C640CB3D2250
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 0270a8205c4eb7f771745de4dbcd63deda3ca953097fb287d856aaead0fdd02a
- MD5 0bf71de34cb1bc02dc52b1ba1db38ccb
- SHA1 6496e5b9164756c7da91d4725bb3a832d92867bd
- SHA512 70033e2997cbe9c6937b07d07e01fb462f5771ebf1264dfe2faff8f370be4791986c71cd9b4c29ab24af01f4d5ba322d4fde824eddd46d66d7b09bbdd6a56922
- TLSH T1FDA0021285D06551DD444671747559C6626798252A51C347E5E54C588D5B2D04125904
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a5574.TMP
- Size 48B
- SHA256 9b2be1193828ae7864f5552193404c98eee06344f9ae8e2fb4580b2e4e7dc3e6
- MD5 bc631a23a46ebe511440a3a209fcd4da
- SHA1 a7a8060624feb2f41b0d04682bbdf231305aa258
- SHA512 435ae8b12a3646f6866d199b3c011f345e87118df3f1b1e319803d282b3323b38342b5cbdbdd31fea856b589f0897b57c8730e7b8f91ca942d2b27910658aa8b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 7e97c5d0ab81f6d1d42f4667a4742ac2f99c2158db32edb7334ab4e863fb11f7
- MD5 a5b1d2e3b69e641ffc467647b0ffa7d9
- SHA1 31e678409581cca39bac75ca8c9416362fb7aa90
- SHA512 5df56f3941e06fa2c186ef3e3af1fe814a0e8315734ae3b92c7f78ff514923e380bb4694563796cac8b74b9cf41da4b2fe94d7caa13eb51529a29e3a6ee9aa76
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OPblVumFnjG:1nbZeMrv/hGtjPnjG
- TLSH T1B9D3974B3A747102EDE58A761CE054BB5E3CB16D8F15A5D428B720588EF2863B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
- Size 40KB
- SHA256 c9e7256c5b6ec03498d794a545de2281ec6ae0e9e55e71673204ac80ec765ce0
- MD5 4a46c3c743c55a9b4ed64a8230cdd00b
- SHA1 ddd4d8ffa44f1f8e424d3bf048e545692325647b
- SHA512 2d52bef9c1d473711b4bb53ac03871c9cf16d1061ad992ffb0a9b91fa961401cacbda72684c0b64b5b37f4fc35962c2fb38881e6da0ba265b875b85273c1f8a0
- SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBulLULBVL1L6U:f7doKsKuKZKlZNmu46yjUuZU
- TLSH T15A03408E977840F3C0F2C13EEEC246E6FC7C6A0CC7263DD111E903B55E88036616466A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
- Size 16KB
- SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
- MD5 d3c18b5df876d89397c233263de4d4ee
- SHA1 8ddc51297582d13332d57893a998f114ee504115
- SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
- SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
- TLSH T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
- Size 22KB
- SHA256 3d3265c0b9214b7144c2be2601a67ec44d4046d02c26a614c8e9d7ec649c197b
- MD5 fd87fb37b86a882f7da8219868c18ed0
- SHA1 b2bfb2edd1fde97f07b858828cc92b2ec5ffdaa8
- SHA512 336434e658e59ff2cc40f513270546481033c9f1b367d7aa49d70d354e32360fde7f890033f1437ca906c093915705a23cc9c3c73857ddfde40640bd73adf30c
- SSDEEP 384:zqirsdGzUY7HyatWesdG2yroLo+sdGz5IBcsdGBdGD2QtFIIIibSMIMJBKzcI/q0:tWZN5C2QC/
- TLSH T1E5A2E8D693B01B81DCDFE7FBAC478DAE17F29DC650560001B4A3E6BA6933E07485178A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
- Size 317B
- SHA256 1143056415d8ac53717f8dca7964940bfb7f4f67a06b3241078a3db656816480
- MD5 71b46e2cc7886f975d7890da3c9c552b
- SHA1 27847933f4b7e95acade448e5f2d924d0f35a77b
- SHA512 60f13b6b45973c5bbe0dfabe2665c3594846dd58ceedfb4dfe9c5a17efbf57cd95107393ab9e783040f9dffd508f7c8812bdb00a2eb6acdc04ef38a34c9b609f
- TLSH T150E0264478D9C6EE7895C02BE138D30CD6C03C0EFFDE35060F04C44C5082008A2F2AA2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
- Size 106B
- SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
- MD5 de9ef0c5bcc012a3a1131988dee272d8
- SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
- SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
- TLSH T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
- Size 13B
- SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
- MD5 43ef949d3c6e9956545979ace65d0085
- SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
- SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 129KB
- SHA256 fd897532b71bafd3ff21e06db5ff4ce5faee6457bde1783aac6735c99f1afa52
- MD5 460028cd161d00bddf1de658f1b711e0
- SHA1 45f2fa18eea8e89c2cc45fd1c72e2539f6831f07
- SHA512 e34deca94fdb2a88794a6400846b75716d609168ce08b09affa759448a5da03e1e8e2ed60c28930a5530f8743630c1735a7526c1b538368053fc96f9193c758d
- SSDEEP 3072:iYYwoljpk7ESq1wZi/GqS2LrkG3ClDsD6RXwV1rUd:iOIO7ESq1wZOXS235yldRXwV1rUd
- TLSH T1BDD302D6D84C1B631698D35CF30A3A2B0A9EC44796C62F7643C6AB0D10CED6E4396D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 33e2dde6a0154c3cd1a5c2c80a14617b62e560a801fcb1813f0eadbc851605c3
- MD5 18dc0f75e561e98d098a15260ae1dd67
- SHA1 70f90f0a94023512262857615e6ea960a84f3e8a
- SHA512 f44262c287eb34d9bbcccf7f35e3fc804fa897272f421cf03be5856d2214b9991da91e439b40d31fc57b31a5e66b1391d2d7e40d372855290cea86174a8f2f73
- SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok574DBB6vGyvk54ELTboRYv4a:5C0Ngjf5ZKSNqDUDq37qELTbog
- TLSH T172A1F9B1E4694DB394B6C9CDB1426B43DEA522ABA561EF80E8DC1F0C50FB1D81382623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 129KB
- SHA256 c83314b7ebc59afc3c2fcc942760ef41dfadd4f2ef06631b5566337ea33a9e13
- MD5 7c23037b84828f95b602d1ea65f9a160
- SHA1 09f2731e3f42564076c0db843fa9265a69769a34
- SHA512 f36938f92fc556d93189eaecee9aa30e6237a63dae3705ce291c294cafc39cf372bacff6a4334c077cc8686e6f599329d8faaa36a8a3f3fb6940e7467eaabe69
- SSDEEP 3072:vYYwoljpk7ESq1wZi/GqS2LrkG3ClDsD6RXwV1rUd:vOIO7ESq1wZOXS235yldRXwV1rUd
- TLSH T1C7D302D6D84C1B631698D35CF30A3A1B0A9EC44796C62F7643C6AB0D10CED6D4396D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 2b9799dcc5480407e3ae820d6f7368a34c871cd9c28d713658bafc3cad27f6a1
- MD5 a90ec7aea97d745a843dbdf5c5422c21
- SHA1 e3e5b50cf0d683acb586b6be2765f82ef8284d56
- SHA512 c05894b6ecb54b6db54971c1341016d9e131ddc7f246f22e950bf90078e9816b5575d575f1561cf16c509951323fa95565d9a87009cd1d320ef4166ababd2c39
- SSDEEP 3072:C/YYwoljpk7ESq1wZi/GqS2LrkG3ClDsD6RXwV1rUd:2OIO7ESq1wZOXS235yldRXwV1rUd
- TLSH T161D302F6D84C1AA30658975CB30A7E1B0D8DC44B9A8A3F3A43C5AB0D00CED6E4396D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 129KB
- SHA256 069bde95f16ffb234e23b6fa2112f0afcdf431dd493ebf513100ce9d8e365ccc
- MD5 45b44e7276bd7a2597d3a7d5be9b359d
- SHA1 b86b6b2a4d342c3da9f6ae33e82f1e776f7e439d
- SHA512 019af974543444ec8ad58b4b55d18cd33ed0bfc4dc06e83220b3cb304fbbb7470fe6d266aca04e6b56ed3852b870c0d17fa57b6750ee8fee06b267201492980d
- SSDEEP 3072:xYYwoljpk7ESq1wZi/GqS2LrkG3ClDsD6RXwV1rUd:xOIO7ESq1wZOXS235yldRXwV1rUd
- TLSH T149D302D6D84C1B631698D35CF30A3A2B0A9DC44792C62F7643C6AB0D10CED6D4396D79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
- Size 86B
- SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
- MD5 f732dbed9289177d15e236d0f8f2ddd3
- SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
- SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
- TLSH T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
- Size 48KB
- SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
- MD5 6323cc327b22cd2420df109845ca78e9
- SHA1 f2074121336d4247965376aa31c81a521651fced
- SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
- SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
- TLSH T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2604_944744290\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\zSvjKb.7z
- Size 18KB
- SHA256 573767643c3629aa0c5c6d2908ef49e0d1f6fd1f54ba43f0ae3a597ecc696170
- MD5 4111e33e902ad6db2ceb94d0afd560d6
- SHA1 548d9ecf9d558e7ea070af56f5fdbb3deddc58f4
- SHA512 76aa0f109471cbbeec4394f26b8db6cfe1c3f452242e2bab16f9aa1890b619b6cf7db4dac0f7909767cd8a84fd5faf2707f88d5d7b41a09facddb491235e60a5
- SSDEEP 384:SoAtWFawsvh1f9sHZxTq0NUmF2VR1Hnz+6sBOIMnCuF5BW:C0FWvh99yrbUmY1o3uZW
- TLSH T11F82D013D95D8EE3C940E077A8E2AC99C64ACD3CAC17CA896816D4D0740A73652BB5EC
- MD5 SHA1 SHA512 SSDEEP TLSH