61d14147aafc588577749dbbe0448104ced9c005043936594b71a1af7191bae3

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Size 3.5MB
Sample260824-fcmahsysas
SHA256 61d14147aafc588577749dbbe0448104ced9c005043936594b71a1af7191bae3
MD5 9642ce892f49968975066930682347a2
SHA1 2e4dc073681093f0c16b4609ea748adcbca4e2f6
SHA512 128cefbf211886177be31b8048e786d807b9b6347ae13f85df346abb1082ead20d46672b69abcd4049536d26399b1e497b6f42d30030e77669a45bd54d87a880
SSDEEP 98304:dehEYSHVilASORPenmS1W0ozi30F/yiW7VMki2:4GYSHVilYPmW0clEVMkB
TLSH
T12CF5AE1266C484F9E3920270DE89FAAC47ACBEB493FF58B777A118CD5921DC2352524F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 set thread context of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 set thread context of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 set thread context of 5840	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	128
PID 2340 set thread context of 200	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	131

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1539260240\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1539260240\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping200_1343216301\_locales\ru\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7004	chrome.exe
4408	msedge.exe
6972	chrome.exe
2880	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320202555181858"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{A27B8CD7-F816-4F88-AFB5-89D0306D11D8}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
5716	chrome.exe
5716	chrome.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
200	msedge.exe
200	msedge.exe
200	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeDebugPrivilege	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
200	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 3600	5716	chrome.exe	93
PID 5716 wrote to memory of 6344	5716	chrome.exe	94
PID 5716 wrote to memory of 6344	5716	chrome.exe	94
PID 5716 wrote to memory of 6972	5716	chrome.exe	95
PID 5716 wrote to memory of 6176	5716	chrome.exe	96
PID 5716 wrote to memory of 6176	5716	chrome.exe	96
PID 5716 wrote to memory of 364	5716	chrome.exe	98
PID 5716 wrote to memory of 364	5716	chrome.exe	98
PID 5716 wrote to memory of 108	5716	chrome.exe	99
PID 5716 wrote to memory of 108	5716	chrome.exe	99
PID 5716 wrote to memory of 6520	5716	chrome.exe	100
PID 5716 wrote to memory of 6520	5716	chrome.exe	100
PID 5716 wrote to memory of 5572	5716	chrome.exe	101
PID 5716 wrote to memory of 5572	5716	chrome.exe	101
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 5716 wrote to memory of 2664	5716	chrome.exe	102
PID 5716 wrote to memory of 5908	5716	chrome.exe	104
PID 5716 wrote to memory of 5908	5716	chrome.exe	104
PID 5716 wrote to memory of 3812	5716	chrome.exe	105
PID 5716 wrote to memory of 3812	5716	chrome.exe	105
PID 5716 wrote to memory of 4744	5716	chrome.exe	106
PID 5716 wrote to memory of 4744	5716	chrome.exe	106
PID 5716 wrote to memory of 1940	5716	chrome.exe	110
PID 5716 wrote to memory of 5104	5716	chrome.exe	111
PID 5716 wrote to memory of 3008	5716	chrome.exe	112
PID 5716 wrote to memory of 1940	5716	chrome.exe	110
PID 5716 wrote to memory of 5104	5716	chrome.exe	111
PID 5716 wrote to memory of 3008	5716	chrome.exe	112
PID 5716 wrote to memory of 6464	5716	chrome.exe	113
PID 5716 wrote to memory of 6464	5716	chrome.exe	113
PID 5716 wrote to memory of 2812	5716	chrome.exe	116
PID 5716 wrote to memory of 6320	5716	chrome.exe	115
PID 5716 wrote to memory of 2812	5716	chrome.exe	116
PID 5716 wrote to memory of 6320	5716	chrome.exe	115
PID 5716 wrote to memory of 6152	5716	chrome.exe	117
PID 5716 wrote to memory of 6152	5716	chrome.exe	117
PID 5716 wrote to memory of 2104	5716	chrome.exe	118
PID 5716 wrote to memory of 2104	5716	chrome.exe	118
PID 5716 wrote to memory of 2356	5716	chrome.exe	119
PID 5716 wrote to memory of 6840	5716	chrome.exe	120
PID 5716 wrote to memory of 2356	5716	chrome.exe	119
PID 5716 wrote to memory of 6840	5716	chrome.exe	120
PID 2340 wrote to memory of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 wrote to memory of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 wrote to memory of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 wrote to memory of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 wrote to memory of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 wrote to memory of 5772	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	121
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 2340 wrote to memory of 5716	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	92
PID 5716 wrote to memory of 1824	5716	chrome.exe	125
PID 5716 wrote to memory of 6396	5716	chrome.exe	126
PID 5716 wrote to memory of 2024	5716	chrome.exe	127
PID 2340 wrote to memory of 5840	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	128
PID 2340 wrote to memory of 5840	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	128
PID 2340 wrote to memory of 5840	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	128
PID 2340 wrote to memory of 5840	2340	2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9642ce892f49968975066930682347a2_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff93279c728,0x7ff93279c734,0x7ff93279c740
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,16147355603654069494,16185575139040524260,262144 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:6344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,707625046958672422,17273457240212806499,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,12016485789545914545,1581219381254103011,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:6176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,278751752937056367,16772159023558113439,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,10075878629030200632,1329902656795915774,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,11006390052206369682,13025258456344181992,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:6520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,8454647934528793724,10299481429472281285,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,994893771453682806,8084797207691891960,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5876,i,12025432987964523458,3766034262920259969,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5916,i,9980541124302140561,16361355114066747235,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6220,i,17165636684318834655,13315683994938069799,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6252,i,1236492612900812030,12119159046503822187,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,13054647092746694020,8414504006272075628,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6524,i,14524860565546863750,16719515467621556607,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5900,i,6999300961911848861,11814736639639490617,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6820,i,9393077557967824395,632820072058169761,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6592,i,17059457381040425995,6936530609817105169,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,13399227856477882874,3135993143138615293,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,11678179263668501980,13214047713435510560,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4792,i,6582434153831100831,10148029451602998517,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5632,i,10398257599324992350,6925845467279291623,2097152 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
  2⤵
  PID:6840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,10221802131198621275,12006316082855400512,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,15672623031177391471,7135686054766768503,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:6396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,57563567883904291,8864495809418276243,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,13891398357812609253,4469062364767696352,524288 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2304,i,12601242279398030697,11437562122205657472,262144 --field-trial-handle=1912,i,3475488993119312070,16712617859510893213,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:10
  2⤵
  PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff92cbfc188,0x7ff92cbfc194,0x7ff92cbfc1a0
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,2008416211106760959,16336214449587176090,262144 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5339628998929507928,46661847608863485,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,10131006479152268100,7015705329946391267,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
  2⤵
  PID:6852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16581069792284561721,6243433592469315467,2097152 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,4975820100867011434,15485647413326902170,2097152 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,960558036113749450,5294662762929821678,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17291394960628700186,1527962896319688163,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:6396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13769487593218351768,2031394395954428826,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:7112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13769487593218351768,2031394395954428826,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13670732132705666857,13962965849274059690,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:6508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2648169452428038011,7237548622304920502,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,15280339383702408865,18293528850821273007,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,18344468140875959710,8464456387716865121,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,7817104425813285611,12171723451711916321,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16225089206181518291,13443132827619519050,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13502811976194737632,5833082623454475091,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17417470324748211164,16636069739214088244,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,7016283450822635249,7800838351247883019,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:6664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,2545382387750961341,560340590342224419,524288 --field-trial-handle=2268,i,10621932647589195423,14763427598976236642,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 37b15d4aa0a40237ababd301c98e81c309b1569b68acdb61cdf06ac7c4594f5b
MD5 350d3a3c9905ac42fd7baa9d6e5c75e4
SHA1 e71f4a55ee7b0110bebf5f70e6116dabee68e486
SHA512 5f661e68fbabfa4c409daf6b26f30558c342529301b975d46b93bede9c3fd14b9c725219d2a0da6adf25d8fdbd7bead7571fbef652fd09049766a74f78d8e791
TLSH
T16AE02BA9CD26EC3718FD0718A1580743E75123272A90864F3A3D85089FF063F86C5C1C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 991b842554d6cbcce1d1f6dadcf4cefc31a7900cc7bc62a92ea9ee7649b522b4
MD5 31c341ffebf9f6b72e782d8c4664ee7f
SHA1 678a8e61c93720fa80540754ea9f4fbdf8371ac9
SHA512 353b5ea5324076694a2d9032dfe22c2f7be33ae34c615801b41a5e639c5d0cdfd8c648164ddc52fd59ba7a2eb2cf79479acaebd5a7e4a21e1711ba7d0699722e
SSDEEP 48:fJqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUEx6Z:hCEmrm43b/LuaLNW9WjWbflHxg
TLSH
T1771383078E242C61D4CAC2379DC18EE71F392B5C935BDE6D59A808750D9178491BB0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 320B
SHA256 d4950a82d334cbecd5361928cd9071dd3cd76b78e6480d78845a9c4750f3d4bf
MD5 fd14c0f9ff605256f7b71b1cdc682ea1
SHA1 a49bc6ae735e79b0d181a3af3423ce97cc96c929
SHA512 fa32dc70aaa3a74f66596117431c3a83170cf11ce0a16d170bde2f1b13e8ac5f9c9de47843ac082fb62e706b6d0ae40029ce1b6ff0325a1a8f532c9fcc082fcb
TLSH
T130E0269627E8C56D2164C0A3E6A4A30DCAD2342DF3C8B642070898C420A00086381AC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 324B
SHA256 e7143bb0fd66f0d80078156bb41a6ab316193a03f99d706bd30927d029ef19e2
MD5 d633fc59889efcbe6ad8c3bcf1eec18d
SHA1 290f608a8667eab327b6f88cf562efb806789817
SHA512 3d644ee89e608abe86e5da133781c292fb815ed6bf754ede1affa50afd9203131fb8e5eff16b0417ae9367accc4126e3ccf87ac54ffa0cef35435ac2a2ce02ab
TLSH
T165E026082AE8C56D0024C4A7AA70B38DCAD13409B3C9F9420709DC8420C41046385EC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 05c1e7fe72f1ec158418a313dcef05a4f1aafde3010c71d63badd8bd8d17a74d
MD5 209abdf520877bd5737cc2f2aad1ac43
SHA1 78070da31ec25e650e7ec35d2df9b351012fc7ab
SHA512 816ce50838df857f79b71b7ce3c133b33d16276f76c218ad6227e9bf656824584d5cd698181183b98c4050763ce9145540d9d257a0ad40b67e797be0065a161c
TLSH
T1C2E086853AADC16E647584A3AA68630C8BD27619E7C97A42170EDC542291904A291ED4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 665B
SHA256 c28ef106145c7aeec7da092eda2f68c99d6d15f7c4f5e44b8e3f6463be06e3c1
MD5 d3fd0b5df2abd5e8f72bf319969e6cd1
SHA1 061dd6e01b41b39dbae60effdedd287e7d797154
SHA512 341a04720235fc1f524e1fb25fc87ea4ba8a19d42000436ceb1ee2d6ccda6a71288bb2eccbc9f709d98d412b7b277fcb70e54771d793bbaf4b4c8ec46d2993b1
TLSH
T18F01998C6B856753E53E48325D8313022BB4619081E41C83B3F0CE611CD8E9143A3098
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 267B
SHA256 5e2459e17666b52da0013b181613794495f8646094f1d9fc275111fbf72cdcb6
MD5 e91f1e8d1ab02e519b4b7dba40f9f59b
SHA1 e58667f570c19478c034fdd8f282a4638975064c
SHA512 8629fd94874851c77e984048b2a2f4aca491074ba10a285be29e731419165a52811081c5c78c2038014dc9199df1c39b82383c685461fd2025d41171769d6e6f
TLSH
T169D0120669F5C7AF156480E76A20A30ECA986449DADD66465F00B808218A80CA591ADA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
Size 52KB
SHA256 1f748422e0b9d41d3258e470a35524c6fd146106b80b841e65f4ca49bd07403d
MD5 8b5918e8869494c27e10b44b373d6e82
SHA1 c632ba43618d1e2884c6f05f55e1bf7eacda1a32
SHA512 9106b4c3dda7724d90729ca96cdd206f6ac3d2a7cdabb47740e735ca780e170ac2d10354600c34ca96151f3df35f7bb31863adca60af8b5e3acad770f16c34b3
SSDEEP 48:TudHYzydB+M9n+8dv/qALihje9kqy2WOT/9F:WHCydB+M9n+8d3qAuhjspFWOv
TLSH
T1F4334EB375176133F816E67CBEA8199008663AC58DE1CAE4DAF00C302FD6650E71F9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ce14b47e7d232a282ba054021b4fdb057f799165833735822777d6cdb971979
MD5 f716b87115ad32ed274f40919d6dee39
SHA1 def6620c2c8eff1d2200a83170357bc82e19d9cd
SHA512 849416cbcb63e4878dbe19a5d39e67795c3131cef6d5855852da645a4d43cfbc53ca4462055334fe817a3ac89f5ab6cc54b5739a3081b582d1711d9c6d8c07ee
TLSH
T1C2519CF7D7D8C96DC51156F49A21AE1FCD2D0A18121D3C6688E8AF5B53E28B2D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 409b2c0f816a89d67219f06875b5bcfcae43e526dba25cb7fdd4f4309430a19c
MD5 1eb4648da9acd65d264b8bc69c833a32
SHA1 9a8723b845827601181f7f228943f73ff3f933b2
SHA512 575ee4c9c26dec35552efd5279e0c3473d1273e3c3bab2ce687a62b0325db0c752f000ae8bb18a243ee9cfa0fdf467ef9303a0eaa0a30c7887ad1457604540f8
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOx:OIEumQv8m1ccnvS6cG
TLSH
T194F2E1FF07197601C0E49674D6810ECFFD2D051D8B9BBEC09AAC09F3AB865B3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 62543ff6285bbbda76cf6b4af1a061260f5cb0a2d263bfb0b4950b323211e4d7
MD5 c82e1e39b831de112d5099d9e0efda28
SHA1 fdefbfb296239ed37926dcefc82c8b42b8975559
SHA512 9d4cd6cdf9cae539584f964ead72de1de0d31a1396bf57f0c41c4e68196c8b7342bae00353f9dd96c463f60ca71a37327f3ac153d23128092c3d74de2b9793dc
SSDEEP 192:5RajRVrv7F8APRp2c9CHsb+WNnlS0hae42pvVyIsnAUgR:5RajDT59Xfkwc0+2pJR
TLSH
T1AA32A56ABA15697BADCBC21AF9613B53E7F5202531D42E84F7FC892C15E35CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 11cc7f77d8095d5921860743735b75a4cc03442acc9e4ee12760c2d902ed5983
MD5 660e1942a511e31f4d3d6d02582ed476
SHA1 f3d2f9a970ae44d465840f7192315e7d00b8746e
SHA512 d8862f0ed56d59bf8f070d0e0f0b34bca965c81331f3fadf1d77a0b147949d6e919a3ad706ee23037ab594300fd2ea048c48b143e5826da1d962e0ea4f656575
SSDEEP 192:5RajRVrv7F8GPRp0c9CHsb+WNnlS0Jae42pnVyIsnAUgE:5RajDT5/X9kwc022pBE
TLSH
T1BD42B46ABA11697BEDCBC219F9617B93E7F5202521D42E84F7FC892C15E75CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d891a0e43ab3771b0749e011d1d3aa8b3b60faff7bb3e48f57854f9a4b164c45
MD5 c098a14fcc0926b4ad10b4e8ab945754
SHA1 05c9ed642ed47b0436393d06e8f230b131d82411
SHA512 6f40d7fc491c4b34026f55dae641d9bf18c647548d4d9f7e2874fe9d1b779a107455244f0723939199b3d6beabfa8fa2a87a73366d2cf72358d8acef0d84d09a
SSDEEP 192:5RajRVrv7F8APRp2c9CHsb+WNnlS0hae42pvVyIsnAUge:5RajDT59Xfkwc0+2pJe
TLSH
T18032936ABA15697BACCBC219FA617B53E7F5202531D42E84F7FC892C15E75CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 d7e7d0d554fec5e724b138db0a513e7e4b3ed584311ebca033abc70beba343fc
MD5 645f0f618d6642410ceb118463d7fb10
SHA1 aabd415629e1b3c3c292eea1d05813289b33f964
SHA512 614a66a7417629d7786248a8c2d9907ae479dede44456a827c902f87df5c98e3d73abe0f9717adcbc689fb0ce35ecea04b6ce665de9ed74723dcb85e37f14188
SSDEEP 384:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmXODdc+ErU3mcHGh1X4G4dkP:BLbC7KxkXqKf/pUZNCgVLH2HfgsPsOZe
TLSH
T1A852F867648D9A3F4FC8DA8CDC166F4FACB5025766A80D2493FB5C0803A57CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 0466b0b7bd8643353873f44e95ef77f7f37d9049e7633de4cbf3e3f2d258b3e9
MD5 26f9cbf14e1efd29f0f9261cbd76e35f
SHA1 2248cb43efeeb84574e30b63015adf179c4a4bb0
SHA512 0c96518303c2581d70df2867d2ded98b336f7521f37ef9e3d7fa41163be3dde5ce1e805473bd2b0cd04142c5c57e2631883072a028423c087a285c7fb0238df7
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKN9enQ1XdSGJ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNm0
TLSH
T12C32E927948D9A7F4FD8D90DDC126B4BBCB5029672780D2497FB5C0803A97CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 a37669343b05af4e993b9d889902aacb5a1a038c110fdf2b1b411db75a748229
MD5 7e83e385cce29823f207106896b27184
SHA1 2f2ea020a2c1bdf985cc60e7d38400f499c3ca5b
SHA512 c3404348bed69d56eaa10367d0b8c7dcb767b97d0df1bc4872054d4b098931170897f0453d9029a1fa65b9bea2a3d8f09ea86274bd291891d687e8f3ce7051f7
TLSH
T17EE0CDE836E9C17F15A4C1673674730D87E0B509F7DC69425703DC44E38540472D0ED4
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13432020249603630

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13432020249603630
Size 2KB
SHA256 d1ee3d90d9a4df1388a1cc9554e8c06b8d7b456a5339d4b5ab7d8e60e5878843
MD5 14f2f1e1ebcf5aa2bcbc9d9cc1ff6724
SHA1 0d0eda6ccf8a7112a3ed2adf1fe6389f57c9d6b8
SHA512 6e515bd27e7fe35fba30b6e97068fd37fb717321e8b728937116848c800dd4589855f764231e54ee66fe8ca64066cb79173f262081a52c3dd17be3aae9145fd9
TLSH
T162517C16B6E48C7EF23F827982B615E26F35F94120818F0FA0E151040C67B4B6F62DDE
MD5 SHA1 SHA512 TLSH

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
Size 20KB
SHA256 4fb062fed1dd79dcf475ebe91ac5b2a6a89dbcb8fb3282f19c7ee3f97e178063
MD5 0bbd477bb50e68eeb24bcccd9e680f47
SHA1 e804e6926419ed21997775290fc2598396dc89ab
SHA512 e30cb2cc82feceaf1461204476d87eff44a0b55d246be94fbce9712327a03c16e0780d6c04cc8125e7ba270c59d0518fd7c89110aa5b3f20f2301f57f1c89e6f
SSDEEP 12:TLiNcUMskMVUsLjCTH3EfxHQSOaQlvsdFxOUwa5qgufTJpbZ75fOS:TLijMnYLjw0JQoQlvsd6UwccNp15fB
TLSH
T167924E426E206021CA5F4B3A4581D6E95FB6D92C4E43FE138DE44C146FB4580655D699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 7228c5bca58a8bd5ac56bd62f54712a6012d69f438625e71111ea69ebc49bcbc
MD5 297d5741427809bd2d4c87dbd1938586
SHA1 1a0b28331fa9860e86b24912196534ebf0b6f100
SHA512 bbcda028f6ff58706d2e4501933cdcc906e5daff8d9fc9bf913fbea4e84805f44a0d5a905b27e6f4c87ce0a26fef145e97b11aa9b61f0a24bc7060d394b280e6
TLSH
T14FE0DF602AEDCB6F1096A09B7220F30CC6E1B40DE7DE55522B0AFC8462DA80872C2AC0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f9b2176197b4be9bf51fc8481afbbeb955125a2aba20fc33b6942fde7f804784
MD5 c1f3ac7e45dff76d688ea4df1347db8f
SHA1 8a784f078fa1aa1ec2bf446c958d34b83b89f623
SHA512 9cddd7c306be21d8e5be12c1a6416f4ff89a1f7e73be62adfb5d29beec06c10e8055e6004de6863f18d76ba56d969bb5ccde1a5e2bfc82b66d0ac0b94cb3adf7
TLSH
T1C8A0022DC1E19976DD15D3B0626655427672C895266A834375D2044EAB6B1C59101580
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f7c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59f7c4.TMP
Size 48B
SHA256 7b22d857d6fdd837b88521de5d28ae433bdaf03b9de4f4c27c05621bbafc9998
MD5 9294396b2ec4790f970b272d949d2c4c
SHA1 cc74682f119d389d09c303f4351bbb7660b1f8ee
SHA512 12b1da3ce1b985194904024eceba7313ae11ab18274297dede85e5ce3c2a78b07a4b966c58ca6f47ebe42eeb5a4d63972ae721bce9c2d975b9762169c2f97a78
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
MD5 d3c18b5df876d89397c233263de4d4ee
SHA1 8ddc51297582d13332d57893a998f114ee504115
SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 db11b8592263e8d35b085e8169f648ccd460a2485dc10d259c9424da555d7297
MD5 de634f8da75a5d43886eaa04d24e6def
SHA1 3694617c379636a96d88767a79131fe5f523882a
SHA512 9f7463f925771b2386dfb624ba4fb05faf92cabcc152bb969bcff87678bf75d8738c6424925fd0922ec9d8f9d241d70fc26b9657e2a180b0ec0417c785a0c32e
SSDEEP 384:kWvQsdGtaTMq26Mx8sdG2Aj/3sdGYR0w8JsdGhdGakQ2IIIFbVMIMIBilG:81B9RSkQEG
TLSH
T1D6A2E797D3B01BB1CC8FE7FBBC55DC2E0772DC8941960041A09B96BA2C63E074981BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 df64552b8d88ef40f84e383d44b60653226ce455bbe5df974c813e92655dacaa
MD5 e365b94888b21c44bd801c2359ed3c26
SHA1 d738789f37d67cf3674e0dec1e3193fa15ccbb2a
SHA512 dfd07d886ff07dae7cf9c85c45c434da8d86ac726ead4f4d5591d921ed643b63552007b6ac6113e5471fc1088013d6fe6f2b48fd33e86bb283252aa9af9c807b
TLSH
T180E086507EE9C2AFA8B580AB3964A34C86D07A4BEBD869C61F06CC8852C6504A190AD4
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 e3c72e42229109618dce67bcca12297aeb74bce48eb5cf4c5ce78a11e6e09dfd
MD5 66ffd949ad9e90b21a8786bd5f7f573f
SHA1 1bf5978c71e3434c990301e736246ba513a5b410
SHA512 602f44bbf297bb29f1347c81be29c43a2fbba0954c7f377818a6ab2b3ec65809d72a0935b13bf5c9ea768a20bd1009ee9c82a5843ae15c89df620e8317faed7b
SSDEEP 3072:P2iuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLH:PUXs6p2+TITPP6BwCoLH
TLSH
T15FD302B2A9DE5D6F02F7858CF10B1E178DB42237E932EF5E0BB45E1502984DC1617B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 eca5dc0a67115f5e455a033f818eea25f2c47075929505f878ee520e0c3b7f8c
MD5 76218de8e2173fc8aca2ff01b8fbe396
SHA1 3a631ccc75a5796597b82373d07aa1fca78e5354
SHA512 9352606b8ae8b70ac34fff49d40fb7fa6c583cb54ecc1101c193764b8fb17f69c85ed95b235675f20ba9d8730d065c33008b0ce81382b492a1637834076e505b
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5GVD7B6xGyv1T5t4pqbKv4a:MkC01N2c6AGDDUDKF1U5AqbU
TLSH
T117A10832586E9C7788B2C549B6522F03DEB8712BF921AF94F6ED4A0C11B70FC1381A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 e390e28cc7bdc594e3d733086685c6202e45a8e0d1bdea0b0639629245667747
MD5 9697f81213e2ac930c8e02ad7a546531
SHA1 27fb744bae9291b0165a5becf789c28a719519e8
SHA512 ee0b0023956e9949aba7b5b29a8d1088ac427b37ccc5698f867a77be70254fcac8098ed299267f791914a97642e667c0337e9350c4d26c38cd496703a731fb30
SSDEEP 3072:DiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLH:5Xs6p2+TITPP6BwCoLH
TLSH
T1C7D302F2A9DE5E2F03EBC59DE11B1E178EB42235D5329F5F0BB04E1502984DC1117B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 562b908152567f5e942490f4675787ace609977b22bb7627666b51ce107a651c
MD5 01ff25d5bde1b27e71a7d3795c57c139
SHA1 9000f20f8ec85fe179c99f3cc2cf1f7e5d880293
SHA512 b43f6b9af991431f824eb90cb5b113120722ebd13af853c15517317e8c0d1c0ad8d2c620b405066652883fbdfc5d0ac186ceb21e0286685c69b105aaef84ba3b
SSDEEP 3072:SiuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLH:oXs6p2+TITPP6BwCoLH
TLSH
T1DED302F2A9DE5E2F03EBC59DE11B1E1B8EB42235D5329F5F0BB04E2502984DD1117B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 6cde504ead66054a4874b95fb2b3a5becfe0acb96bb7cabd25670337107a759c
MD5 1b1b25f5242ac13209d794cdd697c79e
SHA1 16c11180d05c4fab2b187361fd9c6fcb9d5921f5
SHA512 ee56df29d382e626c5e95f8ba19d9148b0180ee78ff41d92c1b02ac7bbeb0611fbb03feda8f0be56f028ff2a6d39572178b62b976092723dea0580df404e760d
SSDEEP 3072:riuCTcrs6Wumx+9JjMu4jtYsymwusCbDFyVBvoCAFLH:BXs6p2+TITPP6BwCoLH
TLSH
T1A9D302F2A9DE5E2F03EBC59DE11B1E1B8EB42235D5329F5F0BB04E2502984DC1117B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 05b776a0c836c7612f3efac8880019defb387831afef45ee7666fc8d30d352c1
MD5 c1a9666b61c7ceb06429f5a049425ff5
SHA1 95d5fc61898da618ec6e5b0664ea9846fe040ed8
SHA512 132394784d384f0c249431818269ad56e8e72b2cdf2d57b3c1f418524e2cd6b043760b10d24f9c7a8def87cf994caa49b55ebe3f4b0c5c7b878b5579a0fd7efe
TLSH
T1B6E020AB07FCC1A60A0299C7FC5993584410B42FD76CEBD97A04B08C673C1455155DDE
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ed9213056ae74bab1723509a60f5bff2d26eb586bac34d2fd71f1ce6e2853860
MD5 a743c3d6de41ca00ccb2cafd2fb5884f
SHA1 f457b825e75a96a9d306a3be49238c0b20ec0e44
SHA512 7edb56dd603f7d38bf5dc4235910af5ad8db833164905db50591542be6a6f2b5ddc6d59e79a0b535a1ab59473a1802e677bd8870886ae79d59bdbf14a68a774d
TLSH
T1B7D0C2A8A8ECA94ED6E409BE97A5F0100F6402820416DA120160F9C136A52E41BAA020
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d38325f5abb57804d5de36f76c424ba200bb8a6096f843069ff201229ce25aa1
MD5 3659684eab69e58145d815d02a49d11c
SHA1 dd5fb264636258d698427e64a4aaf86d4981eb3c
SHA512 8b797e612daed26fec6a770a65864b4dd61fb1ee0637a11678ef431afc29333482179da64854f666e96a4753bdbcc1f93819885ce290fcbffd9eba2d5a851018
TLSH
T13CE0E569C821B82759FD1B18A1644647E750131B3A40884B3B3D812D8FB0A3B438B85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 487f333ad6f21b80ef6941f270d5d657428242e125c7c6fa29bf7790545db362
MD5 4fe9f27b27908fd80d81114dba776090
SHA1 62009fe138bebecd0ef23727b989fd90d41d6ba1
SHA512 161f978623c544f4be0ae8c81287a0097d60b6de4d4eab83766954558822a6ebbea5a88a3a67a4fa83d209aebde7604f4ab374344bdab356e77ebbbf49bd6474
TLSH
T1E671AB19C6962881CF41D7B969DA0C4A29F8E38A518F07DBC0985FB46C5FECEC9E14D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab3e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ab3e0.TMP
Size 1KB
SHA256 c30fbc5ce5484bde6c0493c34f27f6f6b964ef2668b5de7ce9ab569b3e510c77
MD5 95ad7f6162f236c3cd38861e7f2e3481
SHA1 4f21fc5961964bbc99b0287c782af60b75d253a0
SHA512 7f6ca0faf59c24f0fac3b3e91914963e262631cbf3951c9401dd7c78fbab8741502981cfedadc6b74530cb30f3f5f562bd7db3c3f2a3ff7660c97388fec4c677
TLSH
T17331211C836248C5DF6563F6AEDE8CE97EF4889942CB2BD2C4D05D744D2AF1010F2463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 dafcbc4b8c778de0cc0ed5f4367b5b85ff416575b73303417886866c321f7131
MD5 7a3f57560ad48a7be54bea0a067b8dcd
SHA1 6d7a0eaf893a2cebaac1fa5e492163e66bb4eee0
SHA512 6703ce71385dfa23acd75ecce9cb57360f7c92673ec93fafb91931d65e166e8fee190d214ebfabcc5dcfd6f141295c3fe9fd0a1eb3d44bdb245d00554ba2beb8
SSDEEP 384:sxR2nernt/f/susN/RIpGjO/5N/oy7SsGQnp8jX:sceDt/fvGW5/5xx7SsGQnpi
TLSH
T1D682E71665349D3BDDDBD219FA467FA3D7FC1223A5905E44A6FC8A0C04E66ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4965ffa92be5999106198906999dd9cde5960e771d2a3c840751c81af45603f6
MD5 21fc739b9aab186b54e874890571ddbb
SHA1 a09c6569525f637b9b39b67d918407c344b290ab
SHA512 7ab0fb760bdc965fa5f0b2f50fe11ccf4ba80e2085c262aef617e0a454705618a6322a6c8b54671f27c13efdfbf7949676bc8e84c384f744644021e633f95944
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCobbDwzroM4C:Ob4YZnE7yTWg1NfwBu1jaJobHwATC
TLSH
T160E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b7ee0e7f-1e9e-4112-8fd9-7d44d7dadbc1\index-dir\the-real-index
Size 72B
SHA256 743d4a90b087c0283a07a8f05edc67fac99a1fb925616f4fa8565b37a080a3aa
MD5 2cf6d688f6dbbe4d182eca42f457049c
SHA1 fdfcb5f0fd44b7d8b3640c34249ffe9706dade9c
SHA512 246b9874a1e43867bda4c9a2e3ace7c7ab799f1515f5540dd32e26ec0379619a6e30ede3ddf635a9ff579f78c4cf05e7e2a998f151a165d8400dc15058c80205
TLSH
T120A0022403847041C40262B4279A25652764CED47242134F55D0014ACD58F998F8514D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd09275e-f254-4587-906a-d81b796226ce\index-dir\the-real-index
Size 3KB
SHA256 8704488c3ce966c95eb7a771b8b930facd825246bfe7d68d377e8d1f36950e00
MD5 486000c7ad3af6bb9f564b19688bfb8b
SHA1 271f16d2fe0cb71993fa1c3b83b6be1361742fb6
SHA512 1cbd9b95b0e58a619186e276bf7843c47f870fb5c27be7bc5dfc47a347b68402ee802ee2dca7bbb94fc68a1c57bb2023a657a59ec49d907add3f841b55eaa60b
TLSH
T1C851A58F8D8B2F55C9AD01F320FA1842737428FE57544A07659CB571B8C33292C1EA9D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad4a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd09275e-f254-4587-906a-d81b796226ce\index-dir\the-real-index~RFe5ad4a7.TMP
Size 48B
SHA256 4b9c2eaa5a2140dc86dca6ff151e44345e2649835dac29fd4fcf9e2c9de1237b
MD5 e54c83a9f894773ce93bfe398df02af2
SHA1 8d126da9ea4fb41ff69c9ab386a721902c7065a3
SHA512 a220ceff48dff0beda1a4478b02a2c5a463fc54ec8da12b1d1be5bfff223d71cd92ef919cb951a92368d0acb9a7ba3023baba9f292ba52a81b208b3b3e3c5aaa
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 5e56eac21f0cb270617fb06bacecca4469dcae07b7ef02718dde040cf522fbd0
MD5 28f2d7d27fd702e978fc3b186543345d
SHA1 be2893c1fbee56c46f1bf9958c3c30c471beff75
SHA512 5afb547079df1f2b42d569418414a393ce4558a61f2411e63255c92ac4e30a0dbf719b1956f0e056d7e81e2832e51eb17e58bc3c41c4c658118e2fd34dc79d2b
TLSH
T1C5E0D8B72DE71810F97A93D9647144D945057C689985BC8F6427A3C724F17152419C26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4b271462c9803a777d88a4b59b4ea7dd662ab600dba58aabe48d3d0555cf78e6
MD5 1e17f973669b5c63425e49bab903f434
SHA1 0629489dcca275bfbac7272df03e822159899147
SHA512 e2bd2dd31699e923b7c0c3a9fa5ac3e099bdad743016de67d70bd21e3a1ac7465d3fe54e68a5ef19bbf697d0d422d64db5a6bf4e1e2096d9f0105efebc7dbb11
TLSH
T10AE0DFBB2DE71810F9BA93D924B144A94101B8689985BC8FA42A93C724E27153449C66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dd3327fc25765b17707061730c0e0a425dd20620d0010bc7ddd41aa363c33d4b
MD5 41f6e0cd00d9c587fad63c755f59e81a
SHA1 0ef580b5bac1ce119a87c5bf41be887a2ed16476
SHA512 7387347fb4c53541a32dc70762eff1cc68b86a0af50d2c651bf61115e77717d8e2164364bcc174a3b17641fb5e765599841b20cdcd832e94f722391969306b36
TLSH
T105A00250DA969001D16442F0317A02952254CF9897E92232B0ED404ECAD5F6995D1590
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 472f2ef7093a11d7af0117ee97758fbc82056a5a50ecec14cbdaa6831591a11e
MD5 2d889ad41aa444d072e24a8e0d881530
SHA1 621d9a9f5fac7ef2a3f71ab20e582ae1641b9678
SHA512 6481c8ce99ac65387eabc1d50a971d0fa00702399757d1162fdec7d0cdbafcb10c100c746f591345b93ff1bc6cf70310f3ceb4ffe9cb85018afaeb38a1c75b8b
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9pFd:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRc
TLSH
T110B26C11713F4690387EB90C91B9981F86C2B4633519F52F7BA802A65F67E138DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4f05809df7c3e677cabf58b692f57d58b59d25f52e90e6e817b920cd79cf1efa
MD5 2e68c4b621d6bcdb7ae1cec4385ac3b7
SHA1 c1f47113bd31a0563d5d0de33a4504733fb82d6d
SHA512 99f6b0c836f6bae22edd45aeef0e6c3ca2f670bbd99bd3c9abb4ca6521400c393ce621934fe5b5c14263628e6664d0522497988b17f27cd540cb4b50b7bfa14d
SSDEEP 384:nDiF1tNn/s3n9Sj8NLY8TUNTUlIRET0vuTrGMenf+GGeuXkdLMGejpP8LEEIzsNd:uF1j+9qQYwgluuNGeuUPejpid
TLSH
T134B21A32D855DEB7ECEA8FC9B70A7A46EEE4126384C99AD4E5D85D0C00C72DD074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b3084902a118f2ae8c638772a911facd14457fc0885534eef57af090c92b1d88
MD5 ed1a3a1ce4ea95a6dd92f8b93863ff73
SHA1 212f86c98b22e15a92dbe09c83923ec254b03d40
SHA512 a75142c754323db79361e8d6872c8f31254d3392ec4e8b41fabb6c41b200e90b1b2916ebd005c7704d4d38a4339f55a024674d337e57c3cba3267329a7441400
SSDEEP 384:nDiFmZcIV8NLY8TUNTUlIRIT0vuTrGMenf+GGeuXkdLMGeQiYph8LEEIzs3ee9:uF0VQYwgluuNGeuUPeNYpI
TLSH
T139C24A72DCA5DEB7ECEB8B84B7497606DEF412A385989ED4E5D89D0C00872ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 af7ff92fd679294552b90fa924a4dc0ba50b89593f4d273e34657888ab1ba6e5
MD5 e57b830767d97a9f34ab95cdcb61a5c0
SHA1 7efa28e576868f8d7fd7de19240c9de4873a6198
SHA512 a9ce61b8845ea06d605690caf5f16d17bea44e7454f3ab933c24ae6ec7e9f7df0e70e83c7935f661e1d51d592a8a8a8d84420ad0a0b90931288718f1c7a939ee
SSDEEP 384:nQiF1tNn/s3n9Sn8NgP8TUNTUlIRiPvuTuERenf+GGeuXFLXOObjI9G6w7tr8LEk:rF1j+9SXPwgUu5yGeuhX29MZM
TLSH
T16EC24A32EC59DEB7EDE68FD8B70A7A16EEE0126785D85AC4DAD85D0C00871EC0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0c1641febfaad1b9b3e12d2225c905e875c114384842a1702a7ecf3a2cf53a38
MD5 7b28fc13856ffde15288f35c2435b2cd
SHA1 65cfeaa840c680e029724bccdf06985dcc720f22
SHA512 f25de47c6b8e0f9ee7caf6f1781b213f753e70b22c5d29e9258de8f6b949448228dd5432067b4f1ef6bde5771bac365c0abdaba2380310e1ebed6de11aab910d
SSDEEP 384:nviFmZcIV8NLY8TUNTUlIRIT0vuTrGMenf+GGeuXkdLMGeQiYph8LEEIzs3ee9:6F0VQYwgluuNGeuUPeNYpI
TLSH
T143C24A72DCA5DEB7ECEB8B84B7497606DEF412A385989ED4E5D89D0C00872ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c2e976117a0748b516300035d421408d3d4e3f8851104a28eeb113ca5c8ea6a
MD5 127b59e3459fc50d0cd1fcb5e2eb5d87
SHA1 2e6e2912a61865127d38544f2b0f7d1649b201d7
SHA512 7964fa63d14d7553378a7577c9334bc106f0fc0f124baf650b472c86f2ff44ba7fe973d3a82b30d2fe7ba00485b549742a0f175316eb67fa483e020c7802ef79
SSDEEP 384:nEiF1tNn/s3n9Sn8NgY8TUNTUlIRiPvuT5oMenf+GGeuXkdLMkeOObjI9G6w7trU:fF1j+9SXYwgUuCNGeuUTe29MZM
TLSH
T130C24A32E855DEB7ECE68FD8B70A7A56EEE0126389C85AD4E6D85D0C00C71ED074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bfb36d5b82b13fc219527087d350367d70ba733a1aa56c5a7a5087faeb5680fb
MD5 7077c6f63244f9ef9880989903a8ac60
SHA1 ce817ff85c9a66439a3126a7c6e00ad18dd86d56
SHA512 b087f5af55219ddcdd0880b962bb762fe1e23a1ea02829a5bc006309c7d47e3ac7c770a8b4bb5d905674cb52766fd29a3474e73ca85af4b2bbc57777cd0e22e8
SSDEEP 384:nZmiFmZcIp8NLY8TUNTUlIRIT0vuTrGMenf+GGeuXkdLh+eQiYph8LEEIzs3ee9:HF0pQYwgluuNGeuUyeNYpI
TLSH
T166C24A72DCA5DEB7ECEB8B84A7497607DEF412A385889ED4E5D89D0C00872ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

6jo6Dt.7z

Path C:\Users\Admin\AppData\Local\Temp\6jo6Dt.7z
Size 18KB
SHA256 c94cc788563436f84d8636bdb31014329dcd91eb6472c3ee8bc29dedb71acfb2
MD5 7d469dc31c9c083956b7a8bc88186b1e
SHA1 898cd8a94d298075269d3abba3f9b479a90e0074
SHA512 6387f3994b883ed7f6e410ebc472613f3732b4c8bcdf257c9141023fb649f7d99f3a27e5dce604c947ced0bd932323469b4127ee90b5c9781c5e79add7f5e03b
SSDEEP 384:P76AclGhGdX4zMofc1gM9jYqlmyrrZ7Dd39cYWR9ls8t1CuBHn8ujs2:D6AcAMSzn4Drl7Do9R9e8t1CWHm2
TLSH
T10E82E072C856008E82C35642EE8A4DD5138F69049D4EBEA6F99CDE77506CE2CF239DF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5716_1881274418\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2340-8-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-473-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-1-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-3-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-2-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-21-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-208-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-1256-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/2340-5-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/2340-605-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-1858-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-1860-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-534-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-674-0x00000000000C0000-0x0000000000442000-memory.dmp

Download

memory/2340-1890-0x00000000000C0000-0x0000000000442000-memory.dmp

Download