ef55d0c1789ccd7263bc64d7bad56f24362ef6b01a1676be72720ad15719a688

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Size 3.5MB
Sample260826-v2aekszzhy
SHA256 ef55d0c1789ccd7263bc64d7bad56f24362ef6b01a1676be72720ad15719a688
MD5 90df91b809aa111754a666e72afdee17
SHA1 ab1bd8a58267c0c12dbe96b94057c4462cbeb051
SHA512 be566ad0bffe8bd557b41411dcf007a2651a29f81ea9351687298ac0f4933e2a0900c44ed2b01cfa07e1c76778f508d2dee2bc4be27a39f804e17c8fc32e2e64
SSDEEP 98304:LehEYSHVilASORPenmS1W0ozi30F/yiW7VMki2:CGYSHVilYPmW0clEVMkh
TLSH
T1CBF59E1266C484F9E3920270DE89FAAC46ACBEB497FF58F7779118CD6921DC2312524F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3436 set thread context of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 set thread context of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 3436 set thread context of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 set thread context of 2672	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	127

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4288	chrome.exe
4824	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322389496853948"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
5328	chrome.exe
5328	chrome.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
5328	chrome.exe
5328	chrome.exe
1600	chrome.exe
1600	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeDebugPrivilege	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 5664	5328	chrome.exe	92
PID 5328 wrote to memory of 1036	5328	chrome.exe	94
PID 5328 wrote to memory of 4288	5328	chrome.exe	93
PID 5328 wrote to memory of 1036	5328	chrome.exe	94
PID 5328 wrote to memory of 6120	5328	chrome.exe	95
PID 5328 wrote to memory of 6120	5328	chrome.exe	95
PID 5328 wrote to memory of 692	5328	chrome.exe	96
PID 5328 wrote to memory of 2596	5328	chrome.exe	97
PID 5328 wrote to memory of 692	5328	chrome.exe	96
PID 5328 wrote to memory of 2596	5328	chrome.exe	97
PID 5328 wrote to memory of 4740	5328	chrome.exe	99
PID 5328 wrote to memory of 4740	5328	chrome.exe	99
PID 5328 wrote to memory of 5984	5328	chrome.exe	100
PID 5328 wrote to memory of 5984	5328	chrome.exe	100
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 5328 wrote to memory of 4904	5328	chrome.exe	101
PID 5328 wrote to memory of 4420	5328	chrome.exe	103
PID 5328 wrote to memory of 4108	5328	chrome.exe	104
PID 5328 wrote to memory of 4420	5328	chrome.exe	103
PID 5328 wrote to memory of 4108	5328	chrome.exe	104
PID 5328 wrote to memory of 1900	5328	chrome.exe	105
PID 5328 wrote to memory of 1900	5328	chrome.exe	105
PID 5328 wrote to memory of 4524	5328	chrome.exe	106
PID 5328 wrote to memory of 4524	5328	chrome.exe	106
PID 5328 wrote to memory of 5172	5328	chrome.exe	111
PID 5328 wrote to memory of 2076	5328	chrome.exe	112
PID 5328 wrote to memory of 5172	5328	chrome.exe	111
PID 5328 wrote to memory of 2076	5328	chrome.exe	112
PID 5328 wrote to memory of 3680	5328	chrome.exe	114
PID 5328 wrote to memory of 3488	5328	chrome.exe	113
PID 5328 wrote to memory of 3680	5328	chrome.exe	114
PID 5328 wrote to memory of 3488	5328	chrome.exe	113
PID 3436 wrote to memory of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 3436 wrote to memory of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 3436 wrote to memory of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 3436 wrote to memory of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 3436 wrote to memory of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 3436 wrote to memory of 2992	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	115
PID 5328 wrote to memory of 4464	5328	chrome.exe	117
PID 5328 wrote to memory of 4464	5328	chrome.exe	117
PID 5328 wrote to memory of 920	5328	chrome.exe	118
PID 5328 wrote to memory of 920	5328	chrome.exe	118
PID 5328 wrote to memory of 480	5328	chrome.exe	119
PID 5328 wrote to memory of 480	5328	chrome.exe	119
PID 5328 wrote to memory of 6056	5328	chrome.exe	120
PID 5328 wrote to memory of 2380	5328	chrome.exe	121
PID 5328 wrote to memory of 6056	5328	chrome.exe	120
PID 5328 wrote to memory of 2380	5328	chrome.exe	121
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 3436 wrote to memory of 5328	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	91
PID 5328 wrote to memory of 1336	5328	chrome.exe	124
PID 5328 wrote to memory of 3312	5328	chrome.exe	125
PID 5328 wrote to memory of 2880	5328	chrome.exe	126
PID 3436 wrote to memory of 2672	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	127
PID 3436 wrote to memory of 2672	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	127
PID 3436 wrote to memory of 2672	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	127
PID 3436 wrote to memory of 2672	3436	2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_90df91b809aa111754a666e72afdee17_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb676bc728,0x7ffb676bc734,0x7ffb676bc740
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,14066825340961464402,5109175937154963641,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,10653620107403746683,16425042592949067984,262144 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,16334430042264418944,15126208450727054111,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,11459999209540523643,18280977746680298391,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,195576168109905448,14914068072234577753,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,1473949526921268919,14394557532854572600,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,3491589740833103574,5974361301578929974,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,13162091699451810537,1787132102276581712,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,12792870081334183546,8848298955714591412,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,908327889728640238,17105239052203824083,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5520,i,12936131110718408305,1015938542461993582,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5812,i,14808321919712191500,12522069057806804706,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6384,i,4008933401395424544,6090029924330394405,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6648,i,16438909406736130753,16543503228037961007,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6616,i,17571750036568510732,12900064181295448935,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6632,i,2932911614239445000,10375622274385145075,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,369636052171953375,15617028923803103390,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,7717836870958868983,11152062025601432762,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,10762227467256585344,14717485758741876612,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6160,i,17186920197288071565,3528617999859480149,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4572,i,12362688151699631045,17474361955756899820,2097152 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:9
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,7961689943400235269,12186295864800496835,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,11872586895837925354,3263692218793549621,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,10250451416304718260,517297872909329313,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,14488908263695904447,14439000950845306566,524288 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5412,i,10092595494100716962,14478300522856473333,262144 --field-trial-handle=2052,i,17086997212088934886,2657315130223952523,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ca418b14803a57aa3d728e267f602e0a69d13ce613b3bb081533537b3168132d
MD5 36f773ab65b24f0861df4a2d2bae4e1b
SHA1 1492ec2c3a3b351c1ceeb0e7799ba68cfefd323c
SHA512 5e95f92a9a4ae8150a0ce3ce2400ece3a0cee677a718d8d56a6fc910963ebef7fa41d0557d9fa17df9bd5aa66ba277432a228bedd5a77538e03ce4261529af8b
TLSH
T1ECE02BE5D821AC6708FD075864500646E74413573A429A9FBA3C80198FB8677069AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 ef3edaa3d0ec1158a2285b971124992f59c92552d8c6fe149310796cce5de3b8
MD5 1a1e7ff750e0d2ba5eed033b75a84ccc
SHA1 d1914867090746d8f6a8615416b19aa0e5998442
SHA512 e3277554063a77a1a85dbf525b671a140c4eefeadda1358005e16ab7e0185b1c8a4bc5af7d0682d1b0599d350eece58001d471a1bcfa3c58e2e8a8a07b518f78
SSDEEP 96:fNDCEmrm43b/LuaLNW9WjWbflz9xyc2tDM7lCpGl:tMW9Wqbfn3zl
TLSH
T17713240F8E6D3E62E0CF92368890C6D60E79035892DB5EE819B820D16DD1D44C0B70FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 320B
SHA256 1e9473071b95ef9a9da89bb9c5a3c8804c6b4d5e1665f46a908fdf1eaf4fd080
MD5 75b69b3c75c43c1a899bab7d5fef2278
SHA1 2c26ce951c8cdbf6da7d4417ac4bec7c0edb242f
SHA512 4c43165eefd3445d0d213d9c32206f1a7b65acf27485e2cde8a533853db7e10ad5cc3c306919efa00bb04facca1a713f2e06a68ae3a402ac8968eb3cbd3eb8ad
TLSH
T157E08C9A74ADC2EE2858D0A3E3BAF30DC6E43908E7C87C565B19E89831915087290BA4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 324B
SHA256 292e71e996d3540d744752fb9f9537474333b47065679e3a079bf0e8ca147c12
MD5 aa807b0bd9fe8fe0a8dbb11590d7524d
SHA1 9e3c4b8e8d4c1a0fb9e5355ec0a28638ff4e52c0
SHA512 ab318bbdec4bb93dbee2b2970e818ef317d97b6ff1070dcf46a4e7ac30bccec0e49db5136c4e5086ed7e498ca4e1595f4e96d856f8e7442fde3cfd9f9e39fb41
TLSH
T18AE0869868ADC1FE285584939377F30E8AE03908E6C8BC5A5719EC9821959046590F50
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 01c83d779784974c99f94218c670589caf2da8509454ecf079ce75107991dc51
MD5 afc7d482600df268de3b136293eb11bf
SHA1 fe12c5f109bfc6d9a5cf2f8ea2639b7f3aa75807
SHA512 f439f1857f8978647d13a2506850cdbbfd14b9fbf7fa5df02530f3dc8dd5a537220ca3a31c87b50aca41f9ef5c235940ab40fc1531544c4213b52086d3807c21
TLSH
T162E02694258CC1AD689894A3A27DB34C8AE03408E3CAB846470984C42282D046180364
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 665B
SHA256 992088b6ffdbf2a48aa5ac5a24e777e2fb6d66bcc42f7c876cd33c2c25d1fc1a
MD5 b27cefb465e08700666412a7d399e93e
SHA1 e80669831c442ff108d0b44228211453a08afee8
SHA512 cfd924e8ffba747783543709d643f4ec9b2c6b6bc6657ed05df12e399c35eede19a55994dc08d9c582432d154375cc2d401bdca9c2bc6a02da3741aa1c3bf8bd
TLSH
T10C01DD8C37C0FA03DA7A4C37EC8623132EB842921DA1984B63F84DB21EE6B55071B097
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 267B
SHA256 2814c6f94786becb06c2e91916ceb85c760bc0dd1b1d07629be617874abd4220
MD5 82c8c99535a06b8e42a22a61a47afa5a
SHA1 945ee9b4753828da73b75ae976d1db2e6d201e7d
SHA512 b6bf392bd8c0a2f66d2263d471caf755179eba78a80431fa1be13106336e9c26ff5a1ab00ccf2effdef173fdad30db584bd97a08801ec9a51cb498156fbc3f71
TLSH
T15DD02B5726D8C66F1644C0E71A25E34ECAE86444DBDE254A0F11F80814CA80CD0D0786
MD5 SHA1 SHA512 TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
Size 52KB
SHA256 1f748422e0b9d41d3258e470a35524c6fd146106b80b841e65f4ca49bd07403d
MD5 8b5918e8869494c27e10b44b373d6e82
SHA1 c632ba43618d1e2884c6f05f55e1bf7eacda1a32
SHA512 9106b4c3dda7724d90729ca96cdd206f6ac3d2a7cdabb47740e735ca780e170ac2d10354600c34ca96151f3df35f7bb31863adca60af8b5e3acad770f16c34b3
SSDEEP 48:TudHYzydB+M9n+8dv/qALihje9kqy2WOT/9F:WHCydB+M9n+8d3qAuhjspFWOv
TLSH
T1F4334EB375176133F816E67CBEA8199008663AC58DE1CAE4DAF00C302FD6650E71F9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9e46ef3ebd3eedec08f94a0a681864e4c535a8555b9c946f093a8515df8bd2ec
MD5 ef92d5aac0ec385adccbc8f1c42e06b1
SHA1 131f63a3940e12be3301dac0f41287bbf9fa735c
SHA512 2049cfbcea3dde58ea06b1c7ab4d728b34d0852b60631ed5daa233d039ace96124e38be060b476619d5cc9176dc582333c48a5cfb15feb751b27e88a96df15dd
TLSH
T153519DFBD3D4897D851556F49B217E1FCD3E0A29122C3D2288E8AF5B57E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 3c0e68a877c6d442d005246356baeecd1219fdf45c7a3e78f93eece898b95495
MD5 185ceb168e22e5a50c2aee079414cabd
SHA1 e84751825220864a67729383a2ffb0bd2051e9a4
SHA512 9f4c95e640f53d6521d98b84eba596f570592a0d442d8fbebb121f44cf629fe50c07eb6f0e86f70c45203cfc119e9e6081ce9cbf2f19158f425231c0c02d553e
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOo:OIEumQv8m1ccnvS6NG
TLSH
T1EBF2E0FF0B197601C0E49674D6810ECFFD2D051D4B9BBEC09AAC09F3AB865B3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 901b1651f7b59a5580277ebe235b29e807c2480fcab1b4718c2c32ee6a12b9a7
MD5 40757be797409b3467aea43c48c0fe33
SHA1 318a8f5ae6d3aa85c54af82785f87a7d3de63b7d
SHA512 b5a9bdbef571f02d8a8fb132541a053c9c1a62cbe67165a5a1ec40c1449adb55eb154b9be762f29d3dac81275a780b85bbbc6565babff48001124275a1e07286
SSDEEP 192:OR+sgb4sRv7sAPRp2X964Hsb+WNnXk0iKo5ea+9LVyIsnAUgR:OR+rTBBXUbwU0Q0aCNR
TLSH
T16032963EB964697B6DC6C21AFD257B93E7F5102221E42E84E7F8892C14E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5f5317e09f643665df4e02ab3c3f770a5180c08ac1218d25a510ea42eda62529
MD5 8dfbfb65fea525c95ee73c42c37d475a
SHA1 c7124da45bc242f1c4aa9d8a34a224d2b5d4c9cf
SHA512 ac7c43c357e440f11b838ad1d818d323854309ad26fa225e26bc8a78671cc93b81424f95cc60888af481e472756eb5cbbd99bada8ae63d935e0371c600c3269a
SSDEEP 192:OR+sgb4sRv7siPRpQX964Hsb+WNnXk06Ko5ea+ZLVyIsnAUgE:OR+rTBPXWbwU040acNE
TLSH
T17042B73EB964697B6DC7C21AF9267B93E7F5102221A43E84E7FC892C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8ac0eed86e612f299e711b1aae94119a66b644686c1920e5c36ed9e7449af0f4
MD5 fa43f863ccfb57ea1f568746c115a087
SHA1 7b99c1c210d1bf389ecbd1b123f3afa2905ac539
SHA512 f71216df3a183efb6e10eea8fa297ec28d61fadd4eb0f07160bbd81c9acd8db5c8f432fb28008ec5b80d90ea93ccef3a7c8f6bf3983fe1071b31c716cebe8e67
SSDEEP 192:OR+sgb4sRv7sAPRp2X964Hsb+WNnXk0iKo5ea+9LVyIsnAUge:OR+rTBBXUbwU0Q0aCNe
TLSH
T1A232A53EB964697B6DCAC21AF9267B93D7F5102221A43E84E7FC892C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 d4e0872a4672dc45e1733bff6f2ecc5af5112a94cca41e09f2cac21f3fe9ba1a
MD5 c112e6e64b5a5f1e13c563ab13ab7f6a
SHA1 3d3e3c95a9e76e78e66a7a210bdfa7c9305eed0a
SHA512 7cd4f64b185e7967a76148dfdfd625eac9bcdf1ec7830a97a2a7ebb0e98819575398b116923aa91fe6f72a7a533e511e947dfd4332c90a2bcbaa839ed760e1eb
TLSH
T194E08CA4248DC2AE2A59C06BA26EB30E87F03504E7DD6C8B1B02D488268A80862D03A0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13432238943347456

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13432238943347456
Size 2KB
SHA256 28d83b0ba8aceec407d20d57f0f2cefa388c4f3039fb07067f559bb17930f771
MD5 584bda89e14cc66c9a571666916b5d9d
SHA1 71f34be341d33f26803995416999d807791f6249
SHA512 08ea96b13d846c97750de270bfc5b68cd1dea0d691adc19f0802ab410d6faba7d1dd23d2daf23139fa88e1433271b8e14fcc6df636ade5b7432f8b51f67e57f9
TLSH
T1A651CD1B95ED113FE27F4179467615E3BEB5BA5131819D1F606041100D73A822FE1DFE
MD5 SHA1 SHA512 TLSH

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
Size 20KB
SHA256 4fb062fed1dd79dcf475ebe91ac5b2a6a89dbcb8fb3282f19c7ee3f97e178063
MD5 0bbd477bb50e68eeb24bcccd9e680f47
SHA1 e804e6926419ed21997775290fc2598396dc89ab
SHA512 e30cb2cc82feceaf1461204476d87eff44a0b55d246be94fbce9712327a03c16e0780d6c04cc8125e7ba270c59d0518fd7c89110aa5b3f20f2301f57f1c89e6f
SSDEEP 12:TLiNcUMskMVUsLjCTH3EfxHQSOaQlvsdFxOUwa5qgufTJpbZ75fOS:TLijMnYLjw0JQoQlvsd6UwccNp15fB
TLSH
T167924E426E206021CA5F4B3A4581D6E95FB6D92C4E43FE138DE44C146FB4580655D699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 ebdf8c79707a235f14342a8705f084df239ef2985b382b506b11dd7e73e79134
MD5 f3b9effee31aec77c73d74990c08e1fd
SHA1 5f321422aa7a236f30b0f6ef00e0cb24952f6a6e
SHA512 6941dfb7de209798cd12a6d1797acb507dca5c121b9600c49f2a8471650fd4b4fabc3b3f3d85e746812b50deffe194d299ded68a1b83891611585d95996dee53
TLSH
T109E0DFB42ACD876E2885809B63A9F30CC6F17403E7DD955A6F06F0C5E28944471C2361
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4f54e644c71e30bb73082b6465cbdea0362ab2424ef8d61d013ff49dd0cae8a6
MD5 1b94cbb1f70b801a7ab0cd4abc434602
SHA1 1e6d83cebb07ffdfa18762b2e68f2acaea811c35
SHA512 0db85859f92a0c7904e5fc4ca865236dbdc8b4fb6ba10bd456c3dcfb7aec75d21acae76ac6da3794c88a0aacb7963df3d850d4d3ffebbbf33491686c7172e4ec
TLSH
T1B8A00270C2C64913DF2042BC7061174163F5482655A5534354D305CF987B2C6A906640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5b5e2c0f752244255ac39456a1d925a4b3ec05d31f6e5aeffe6ceb6ab1d5e972
MD5 012d8892a9060a1bf8e1a5fd3ee4a46b
SHA1 60b767e3952c027d6cf3b0c3d5a5973bc629f6fd
SHA512 f635a28b323bc29a00df1a24c1fb8f75767fd38d05fb10902075d1c5e3efb22feba84dc8d387c07d73691c3fcfcc4cf9562f95029aa981b2c8f2db03b9acff61
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fd170dfa-6bc2-4a13-a173-1a327ac095ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd170dfa-6bc2-4a13-a173-1a327ac095ff.tmp
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
MD5 d3c18b5df876d89397c233263de4d4ee
SHA1 8ddc51297582d13332d57893a998f114ee504115
SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 7bb6a357d3f8659966c358709e35a8614ef19649cf3303ba3a838b5f3aae65d5
MD5 88c09c4978f51b2df22a05a61ecb4119
SHA1 50bffcc9e00037eb401ed7121b3b883d0d149808
SHA512 ff26533fd7739db077e93356e579ba18b3797e1fe6cedef77a3004903cbaebcac300146a78431d7b07430e9acdd979cbd943014db26087423af3b642ca34b8a4
SSDEEP 384:QER9smsdGr7GbYKBX+IsdGcGWSesdG12eGksdGTdGQt/DQ0IIIrb7MIM6Bcow:P4wzJpQ3w
TLSH
T111A2E757B3B11B96DCCF9BFBAD458C2E0773FC89E4561005A59396BE28B3E074841389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 a2e633711fda4faf51d9fd3a1769b957070d128604789c2d5452ab58b5388a3d
MD5 f3542a065f677217c48f17925d71599f
SHA1 b2bba55c7e81d9fbcf39268503fbb564cbe8aac0
SHA512 4587c93a039c01e910c800d9a258ad4e938e771c29a73b3085553bc50f8f1cfd16c9efd42bd3cef596186a9fcbcaad9f08f3005e6e7238cb1bc8a675d6547da7
TLSH
T172E086E079CDC1EE79599097216DB34C97E43915FFD8648A2F01C48863C66047195391
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 1052c895345e6157f5608174fd43c67352e88c288c344635c43e4f1a0f00a542
MD5 a05122f9053fdf54b5f068d2014083f6
SHA1 6d8655b65de67ff96bfa58d8c1ec5840af190009
SHA512 330fbc07fa42bd1a3f01954225a5ed4d50700e674a4b5611171625bbca61cdb105258aaa41be75d48822c189b9c67ad0d4865bc1d7665af1471be79bd49343ec
SSDEEP 3072:p4qgx/+TGpTef654Cs0j+kbG9XkkP0CiZ5qeiOqQM:pMx/+TGpJPj++G9b+qeiIM
TLSH
T1C9D31273B89E7DF512BB7090F00F75AA9DFC055F4F8DD69044E66A1008EE9489E0AD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 565f838d754f57aa7bd1184000a389e7f59b90b91eac2081f0b59d02c0fb635a
MD5 3d5c1136d0b151ea964e8edfee1fb019
SHA1 d446c292fc28563a6294034d6c1d03dd5cbf73e4
SHA512 efc470c034f844e6adfbb84db96d186a75a00b297050a5ce307636c2ae2af429cc655031b2e91eb32afa15f187c8f833bf12a3707614b18e11e468f5ea609388
SSDEEP 3072:R4qgx/+TGpTef654Cs0j+kbG9XkkP0CiZ5qeiOqQM:RMx/+TGpJPj++G9b+qeiIM
TLSH
T181D312B3F4EE7DB552FAB060F40FB4AB9DFC055E5A8DC59041E6652048EE8089E0ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 d2b2827a383f27c0debc34fe9b9d31e4291b144f6914d162e80970cdb3220514
MD5 4df48d6e3c37fd9585d824b3ebca3b6c
SHA1 ca51e2a508079755707a1789cc390c242e3c01d3
SHA512 d0f475f6899d3633d3d2cdb9fa6925360072ee117bba51ccb6fad066533cbe7f08539749a0a364258adda3d6009b35aa95d01f5e19b869604fb10cb6a3484fe2
SSDEEP 3072:a4qgx/+TGpTef654Cs0j+kbG9XkkP0CiZ5qeiOqQM:aMx/+TGpJPj++G9b+qeiIM
TLSH
T171D312B3B4EE7DB552FAB060F40FB0AB9DFC055E4A8DC59041E6652048EE8089E0ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 04578c05882a8b81ec544a572edc7d29a6a6949520842e0d5f4ad29403bbd1f6
MD5 61684487f729d2b61a9d19c6631f8455
SHA1 fab871855b4dbc0ac4de49ffcb8a4b8a648cd5aa
SHA512 8d1d8f2adec162987ef7d427fc93314258e1bb0e353297867a21b1a7f30d49d0aba4a662c846134a3dd81055fe0c1b1651248ba4a36a937bb895194039970934
SSDEEP 3072:F4qgx/+TGpTef654Cs0j+kbG9XkkP0CiZ5qeiOqQM:FMx/+TGpJPj++G9b+qeiIM
TLSH
T195D312B3B4EE7DB552FAB060F40FB0AB9DFC055E468DC59041E6662048EF8089E0ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d86aa170a4beb195323c3eb90a68e0122948badfb9487f608c8349bfd65adbdf
MD5 b7459402a615143b8a8a46dc4ddf00f8
SHA1 8f43a28322d1ae9e515ad3df5e570246c4d4e5c1
SHA512 4ec109bc4119964f9f637af447a291630811ccfddfedf3a3205862595fa21204a46db44b229926c97d3841279c857287385dcfdbfbb86ef1005ebeabd13fdcab
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok50CDpB6/dGyv95Suhbb2Jv4a:gC0LA/TE57cDUDPvUweSuhbKl
TLSH
T17CA10971B4A95EB75DB5D544F9827E83DF68A117A9227F80D8EC1F1C10E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IQJpw4.7z

Path C:\Users\Admin\AppData\Local\Temp\IQJpw4.7z
Size 17KB
SHA256 87d194b966154950af26e92c3c8fcd538d924f9aa292925f5cca0529f89a332a
MD5 3698fe72a8b92c9ab58000aa5b5526d1
SHA1 d6282fa1b59107ad532a363dcf1a9acdb51cc260
SHA512 cee3c58bbf07bcaeb3b2e11c4d829f4b5a3cd793940d504973f756686b6fe3ffb6d91d1d09a2f434dfd5d8a1f3b0c2ef62fa7d34155cbf7de98bd1e3ae8f67ab
SSDEEP 384:L9eO4QGARt79GWNHutVwVJhAo6pc+Rk5WV6Dr/4+44bIzpHw4ZCnxhpS:oO4QGMt7E6HaChwpFB2/4+4L9JZCzpS
TLSH
T1C182C02DC63F6EC80C26525539AE530FE9DDF39135C00467E7847AC46226E2791B11CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5328_1737295937\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3436-5-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-4-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3436-3-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-8-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-12-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-601-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-125-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-218-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-499-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-633-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-0-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3436-2-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-1-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-679-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download

memory/3436-681-0x0000000000D40000-0x00000000010C2000-memory.dmp

Download