Analysis

  • max time kernel
    301s
  • max time network
    295s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2024 19:18

General

  • Target

    https://github.com/expl0int/EulenCH3ats/tree/main

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://gemcreedarticulateod.shop/api

https://secretionsuitcasenioise.shop/api

https://claimconcessionrebe.shop/api

https://liabilityarrangemenyit.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 10 IoCs
  • Program crash 18 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/expl0int/EulenCH3ats/tree/main
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffff0fe9758,0x7ffff0fe9768,0x7ffff0fe9778
      2⤵
        PID:4756
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:2
        2⤵
          PID:1476
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
          2⤵
            PID:2800
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
            2⤵
              PID:4480
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:1
              2⤵
                PID:1560
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:1
                2⤵
                  PID:3540
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
                  2⤵
                    PID:2596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
                    2⤵
                      PID:1896
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:8
                      2⤵
                        PID:2076
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=744 --field-trial-handle=1852,i,4021130000245523740,11068883078035991950,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4268
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:4172
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:4496
                        • C:\Program Files\7-Zip\7zG.exe
                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17653:94:7zEvent14581
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:3700
                        • C:\Program Files\7-Zip\7zG.exe
                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap10744:94:7zEvent9969
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:4132
                        • C:\Program Files\7-Zip\7zG.exe
                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\EulenCH3ats-main\" -spe -an -ai#7zMap30431:94:7zEvent7029
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:3116
                        • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                          "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:3776
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1152
                            2⤵
                            • Program crash
                            PID:1188
                        • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                          "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:748
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 636
                            2⤵
                            • Program crash
                            PID:4520
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 1068
                            2⤵
                            • Program crash
                            PID:4392
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3776 -ip 3776
                          1⤵
                            PID:464
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 748 -ip 748
                            1⤵
                              PID:3780
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 748 -ip 748
                              1⤵
                                PID:2056
                              • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:3912
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 1096
                                  2⤵
                                  • Program crash
                                  PID:764
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 1088
                                  2⤵
                                  • Program crash
                                  PID:5020
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3912 -ip 3912
                                1⤵
                                  PID:2968
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3912 -ip 3912
                                  1⤵
                                    PID:4516
                                  • C:\Windows\system32\taskmgr.exe
                                    "C:\Windows\system32\taskmgr.exe" /4
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:372
                                  • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                    "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    PID:4936
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1092
                                      2⤵
                                      • Program crash
                                      PID:2760
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1132
                                      2⤵
                                      • Program crash
                                      PID:1192
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4936 -ip 4936
                                    1⤵
                                      PID:4244
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4936 -ip 4936
                                      1⤵
                                        PID:2160
                                      • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                        "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:2076
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1160
                                          2⤵
                                          • Program crash
                                          PID:1472
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1096
                                          2⤵
                                          • Program crash
                                          PID:1728
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2076 -ip 2076
                                        1⤵
                                          PID:2564
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2076 -ip 2076
                                          1⤵
                                            PID:1624
                                          • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                            "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:3192
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1120
                                              2⤵
                                              • Program crash
                                              PID:2388
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1100
                                              2⤵
                                              • Program crash
                                              PID:960
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3192 -ip 3192
                                            1⤵
                                              PID:1640
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3192 -ip 3192
                                              1⤵
                                                PID:1896
                                              • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                                "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:2968
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1120
                                                  2⤵
                                                  • Program crash
                                                  PID:1772
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 628
                                                  2⤵
                                                  • Program crash
                                                  PID:3096
                                              • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                                "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:1196
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1068
                                                  2⤵
                                                  • Program crash
                                                  PID:2356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 716
                                                  2⤵
                                                  • Program crash
                                                  PID:3200
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2968 -ip 2968
                                                1⤵
                                                  PID:4388
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1196 -ip 1196
                                                  1⤵
                                                    PID:3468
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1196 -ip 1196
                                                    1⤵
                                                      PID:4000
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2968 -ip 2968
                                                      1⤵
                                                        PID:2736
                                                      • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                                        "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4552
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1112
                                                          2⤵
                                                          • Program crash
                                                          PID:3128
                                                      • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe
                                                        "C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4352
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1176
                                                          2⤵
                                                          • Program crash
                                                          PID:4728
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 620
                                                          2⤵
                                                          • Program crash
                                                          PID:2216
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4552 -ip 4552
                                                        1⤵
                                                          PID:4744
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4352 -ip 4352
                                                          1⤵
                                                            PID:876
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4352 -ip 4352
                                                            1⤵
                                                              PID:3812

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              d5bee06667e7aa655b359d52ec0d3301

                                                              SHA1

                                                              efc1125f30c175ca7503a1ef1d92748e2f7bb93d

                                                              SHA256

                                                              6b1cc0671bc672a81391f7f938374410c4b80db491a26ffcc28e46a08213c60e

                                                              SHA512

                                                              a5798278bb20c00a7a6c86d6141b1b2d59eb93f0fc61616adac71bd5bfc8f1220e82b60449c9a20fc4dd7930a491b0bb6c2417689ec551c66af2cce50b08259f

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              a3b9ce5c61846ff24e80fbc8fa923c33

                                                              SHA1

                                                              714509858668d3cbdc247197d6515e2bd3d7f25c

                                                              SHA256

                                                              6f3b2e15f038aaadeae32aed2460ed97809b6f58bf2e2af9fc8f62ab95c06aa4

                                                              SHA512

                                                              40b4c663eb2a2aa422f26416969e17fbab97da3e5d9e8f7ee268e371460b5ff7eef833bee71c5e38b569b34dba53e2d2e58bd9a37f78575dd9cacbfc095febf2

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              eff09f2dcd2368974ad31025571f58a3

                                                              SHA1

                                                              4db7b09e6574bd53059564ef7a9f26330fe307ee

                                                              SHA256

                                                              d32500e14da67f98426808b4850d09333f8ba101698c670fe515497ee6967bc4

                                                              SHA512

                                                              0de2e2ffa396cdd5882f47d652ec757fccef437dc5798d5b7d627a16f5983825aa85cbbe011cbface03894ba9820197acc30b4db4cb1fbd29d13cc4dd1b3c660

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              a95eb84344c7aca576fb16b1e2c003de

                                                              SHA1

                                                              88393452e0c6c5f5525ddccb91fb37e39ceea584

                                                              SHA256

                                                              897dca5aaeb3e253684664b0077fbb1ae7c65d437dd897a104e2d894de4491c5

                                                              SHA512

                                                              df30ab32bf6c3aafe52e40c5dc4c3a4cba91afcf78a65e928651cd6ddd376f1373f3df82075ffe2840c778864f801e0e3db768e08f6a8e89a53059a073482c8e

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              390a34f9ed12c28b518006befaa4bb24

                                                              SHA1

                                                              6bd6efcbf459c21aa6d0d426c4b7f803999581d8

                                                              SHA256

                                                              e011966f189ddcb4c62d39dd5557a6f77dadf60b465f6da835dc5856efe06bc6

                                                              SHA512

                                                              f1f9ae5929760c60d0ff3fbe2b77490028a568a4a7be06fd37b53218b2dd1cbbc31b734368e2605fa5b516007087441c8d628401beaa057f9a132f7b603a4719

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              101bc1995ff37a2ee7219bab0f52f53a

                                                              SHA1

                                                              2d43332564f10dadb98033779a76f809722b81c7

                                                              SHA256

                                                              66c146916fbc9ddb87cb6f61aa7a0358069a6f77a4680f56cb2032534f154f1f

                                                              SHA512

                                                              1d1418603031645f5d16ccc5772d16ea6d83fb39bf7ac6feb060c483f1c625758813c283ce7d2623e89c2de31978b649190fc4deea760a4d2a07126d22f7c3e9

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              1d41eb9014d17f8df1b5971a9e95cdb1

                                                              SHA1

                                                              388ae540f66ef313905b9d166d57ca8f10bc6781

                                                              SHA256

                                                              009eeea7eafd69a6d0bfaf77b59238b17c1f4f36c2b54592dadf1322d9b7000e

                                                              SHA512

                                                              3f7a1333a6f72c107be5535fd3c1279719528637dbfa40f5b6de4103fe52236b7e070848a4f7736427b6211baf70cda9417fb99c392643520bb48e4046ab175a

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              9355e196cbacc31c93d9d2fbe97173d6

                                                              SHA1

                                                              63551a5b3bcc9e1bb624f7ca27b3bcd807538099

                                                              SHA256

                                                              d5652151b7205cc0b5aca977c1f77f748920ea0d907caff5f2c7a6f9a427a0db

                                                              SHA512

                                                              43211aac97147bdd1d7639914942b7b362c5ce0048b8c7c94832c1ce5d65ea8dc5dc47341cb7885e3a75fece940c6d24f6893eca2a8e2eccfad13409711621db

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              3056aa9759a4cffa2d514d3dd195255b

                                                              SHA1

                                                              bebb32331ccfdc65f65f9f0cb57bee9569a8909f

                                                              SHA256

                                                              7ed8ae2c939ced4c9e339d7e7662a897bb538c24283afee857a9fcc616c6ca72

                                                              SHA512

                                                              865932445c1a6ca9fd7f8b60864ed0f579f94de2009ff68697c2c823bbf993624e154179b42335e096577d676e51c4dba9c223b824412a6c0a081ea13c0d46c9

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                              Filesize

                                                              130KB

                                                              MD5

                                                              8e0a3d48bbe9b38c9affd7e46140d9e6

                                                              SHA1

                                                              6cf2a637a61f21f4afb209c64caa94c3cda5f344

                                                              SHA256

                                                              2e59ff55b5336d6f7e9a3b066acd40d737f0d45861527e1bb6a42736a1703864

                                                              SHA512

                                                              b2aae26bb81c1138593cf36253404674b140afcbecfebe9b637fbb67cf35cd0750e2552d5e3049c62733084f50757af9c044a84f6f907b76d4a38c07eb9a750d

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                              Filesize

                                                              2B

                                                              MD5

                                                              99914b932bd37a50b983c5e7c90ae93b

                                                              SHA1

                                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                              SHA256

                                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                              SHA512

                                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                            • C:\Users\Admin\Downloads\EulenCH3ats-main.zip

                                                              Filesize

                                                              1012KB

                                                              MD5

                                                              fd7d8264aedca99b0993640204c9508e

                                                              SHA1

                                                              7a6febefeb6a337a2f33e3a56ba08ad2a95de2ab

                                                              SHA256

                                                              b87457606eba26db8ff83137a1a40d96f10d33fadd6728fdbcfdb248f6a03968

                                                              SHA512

                                                              d48c41078a7cab04ea22a94f8ebae6eb6ab6c7e1a147fab344a977d860f02945331f6af049706ac6d2a667f36a8d95b8a4a676cc35e1a77afb6673021823896e

                                                            • C:\Users\Admin\Downloads\EulenCH3ats-main.zip.crdownload

                                                              Filesize

                                                              516KB

                                                              MD5

                                                              60078848bb829962adaaad92b2117d27

                                                              SHA1

                                                              e4cb1688eef1f97b85274dc0f7909fcc7e36498d

                                                              SHA256

                                                              4a965fe0bb90182c9ab828610a278b4a2e9707fed38fc6e1a2c3ce086de8638e

                                                              SHA512

                                                              8715ad5232bbd3e65db1f091b633c67c684803dea64fe5cf05f27746e645857ec7570a3294d7ba6a1a75b537892548fc64ff76fa491d0e071fa063d6939c0e1f

                                                            • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe

                                                              Filesize

                                                              690KB

                                                              MD5

                                                              9ed99bd8432a2265d1f5fb611213168b

                                                              SHA1

                                                              e215f6bfcbc91ed8828ef54cb6840eae1dc72cd0

                                                              SHA256

                                                              dde02744526968833651a9f70be666ceec221599b03272c9c5fc5d729667dd72

                                                              SHA512

                                                              f75b9ad6823ae8c4e4f5c84202893ba60c9256853d8b3924d47d59a1668e979e485a920b43414b470c5e5fd02975ff81edea3c9a2ed3a16140c13170224f2f28

                                                            • C:\Users\Admin\Downloads\EulenCH3ats-main\Loader.exe

                                                              Filesize

                                                              645KB

                                                              MD5

                                                              4cd0f11f37b1c910b998e1c78d7fbc1a

                                                              SHA1

                                                              9b1cfea8434e44a7853d392ec99a532c8722e803

                                                              SHA256

                                                              b54eac653edbbcee1b2d5fa082d618b0a582ed6f54aaa835e6509363aff6d106

                                                              SHA512

                                                              823ce10362882fefda9a7dfa72ba98e9ade4fc64db512cfe40e71d12314cacdf6748df259ffa48338cc20e6819a00ad432b50de1334d7c81ca4767e6f75fba27

                                                            • C:\Users\Admin\Downloads\EulenCH3ats-main\README.md

                                                              Filesize

                                                              779B

                                                              MD5

                                                              8dea87a2d66c58832a0d82b7b43540c8

                                                              SHA1

                                                              d5151a05efe6978f634bf5d5e330ffce9694414d

                                                              SHA256

                                                              baad6357cb00130d3d25c8077ecf053c50ea9860e712207ebc72bb4bf351b6c0

                                                              SHA512

                                                              3dae0f7f7a967670fc59cc2b3b9688b5cbbf9f0f541e7503511cb95d59e871dd5b7517db7657aa56ae60dbf147a61ed8174e43d6cdfe53665bdf080f38cc7e4f

                                                            • \??\pipe\crashpad_2512_IYAFMHMWAKAOQCTP

                                                              MD5

                                                              d41d8cd98f00b204e9800998ecf8427e

                                                              SHA1

                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                              SHA256

                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                              SHA512

                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                            • memory/372-307-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-309-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-310-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-311-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-308-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-312-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-302-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-301-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-300-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/372-306-0x0000023FA8690000-0x0000023FA8691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/748-260-0x0000000003070000-0x0000000003071000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/748-263-0x0000000002F40000-0x0000000003040000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/748-265-0x0000000001380000-0x0000000001417000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/748-255-0x0000000001380000-0x0000000001417000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/748-261-0x0000000002EC0000-0x0000000002EF2000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/748-262-0x0000000002EC0000-0x0000000002EF2000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/1196-360-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1196-362-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1196-355-0x0000000000FB0000-0x0000000001047000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/1196-366-0x0000000000FB0000-0x0000000001047000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/1196-361-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2076-333-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2076-325-0x0000000000B00000-0x0000000000B97000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/2076-334-0x0000000000B00000-0x0000000000B97000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/2076-331-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2076-332-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2076-330-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2968-364-0x0000000000B30000-0x0000000000BC7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/2968-352-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2968-350-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2968-351-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2968-345-0x0000000000B30000-0x0000000000BC7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/2968-353-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3192-336-0x0000000000EA0000-0x0000000000F37000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/3192-363-0x0000000000EA0000-0x0000000000F37000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/3192-341-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3192-342-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3192-343-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3776-250-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3776-264-0x0000000000E10000-0x0000000000EA7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/3776-253-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3776-252-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3776-245-0x0000000000E10000-0x0000000000EA7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/3776-251-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-297-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-299-0x0000000000150000-0x00000000001E7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/3912-298-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-296-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-295-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-290-0x0000000000150000-0x00000000001E7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/4352-377-0x0000000000650000-0x00000000006E7000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/4352-387-0x0000000000C00000-0x0000000000C32000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4352-386-0x0000000000C00000-0x0000000000C32000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4352-385-0x0000000000C00000-0x0000000000C32000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4352-384-0x0000000000C00000-0x0000000000C32000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4352-383-0x0000000000C00000-0x0000000000C32000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4352-382-0x0000000000C00000-0x0000000000C32000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4552-367-0x00000000008D0000-0x0000000000967000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/4552-374-0x0000000000BF0000-0x0000000000C22000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4552-375-0x0000000000BF0000-0x0000000000C22000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4552-373-0x0000000000BF0000-0x0000000000C22000-memory.dmp

                                                              Filesize

                                                              200KB

                                                            • memory/4552-372-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4936-315-0x0000000000AF0000-0x0000000000B87000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/4936-322-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4936-323-0x0000000000AF0000-0x0000000000B87000-memory.dmp

                                                              Filesize

                                                              604KB

                                                            • memory/4936-321-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4936-320-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                              Filesize

                                                              4KB