mercurialgrabber | hxxps://mega[.]nz/file/RmM2FDDQ#9wIer7YrFXPSrumWmjIMLXxa0X9RM0W5U1mVD9RlXyU

Analysis

max time kernel
45s
max time network
38s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04-04-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/RmM2FDDQ#9wIer7YrFXPSrumWmjIMLXxa0X9RM0W5U1mVD9RlXyU

Score

10^/10

mercurialgrabber spyware stealer

Malware Config

Extracted

Family

mercurialgrabber

https://discord.com/api/webhooks/1224888260678127748/654kdgF-cPGmQsIA5MzxYpRPKCj_STQpmzXvuUzgSMyJS0teUf9eJkH6RZ56X-2tfeof

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Executes dropped EXE 2 IoCs

Processes:

KrampusCodeFixerV2.3.exeKrampusCodeFixerV2.3.exe

pid process

1016 KrampusCodeFixerV2.3.exe
572 KrampusCodeFixerV2.3.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

14 discord.com
24 discord.com
25 discord.com
28 discord.com
29 discord.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
13 ip4.seeip.org
22 ip4.seeip.org
26 ip4.seeip.org

pid	process
1016	KrampusCodeFixerV2.3.exe
572	KrampusCodeFixerV2.3.exe

flow	ioc
14	discord.com
24	discord.com
25	discord.com
28	discord.com
29	discord.com

flow	ioc
2	ip-api.com
13	ip4.seeip.org
22	ip4.seeip.org
26	ip4.seeip.org

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

KrampusCodeFixerV2.3.exeKrampusCodeFixerV2.3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	KrampusCodeFixerV2.3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KrampusCodeFixerV2.3.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	KrampusCodeFixerV2.3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KrampusCodeFixerV2.3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133566670178791372"	chrome.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

KrampusCodeFixerV2.3.exeKrampusCodeFixerV2.3.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	KrampusCodeFixerV2.3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	KrampusCodeFixerV2.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	KrampusCodeFixerV2.3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	KrampusCodeFixerV2.3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	KrampusCodeFixerV2.3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	KrampusCodeFixerV2.3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	KrampusCodeFixerV2.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	KrampusCodeFixerV2.3.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe:Zone.Identifier chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3632 chrome.exe
3632 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3632 chrome.exe
3632 chrome.exe
3632 chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe:Zone.Identifier	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXEKrampusCodeFixerV2.3.exeKrampusCodeFixerV2.3.exe

description	pid	process
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: 33	3000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3000	AUDIODG.EXE
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeDebugPrivilege	1016	KrampusCodeFixerV2.3.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeDebugPrivilege	572	KrampusCodeFixerV2.3.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe
Token: SeShutdownPrivilege	3632	chrome.exe
Token: SeCreatePagefilePrivilege	3632	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe
3632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3632 wrote to memory of 2536	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2536	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 4956	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2260	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2260	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe
PID 3632 wrote to memory of 2552	3632	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/RmM2FDDQ#9wIer7YrFXPSrumWmjIMLXxa0X9RM0W5U1mVD9RlXyU
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa52619758,0x7ffa52619768,0x7ffa52619778
2⤵
PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=320 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:2
2⤵
PID:4956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:2260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:2552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:1
2⤵
PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:1
2⤵
PID:1708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:1096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5196 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:1376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5676 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:2600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5720 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
- NTFS ADS
PID:1884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5164 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5672 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:8
2⤵
PID:4548

C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe
"C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5360 --field-trial-handle=1664,i,2358434906855088762,7415191875401724882,131072 /prefetch:1
2⤵
PID:4836

C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe
"C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8ca7c0a3-a045-4f7b-8114-347a2b219761.tmp
Filesize
130KB

MD5
dbadd20bf94d7c6de7a6ba796eb28396

SHA1
a3ce96dab91e2faff0ed40f173fe440bd4b3353d

SHA256
3a4e78382ef410391b8b63b600eb1268dfa39d3c549236d6cf797395f882f652

SHA512
ac2b100e8cec4404d77d5e7b3642eb240d6086569894f04c27e0ae9b0bb201f4549a0d2f750235ba060a5468f6c6edc7ef048b9187f0a10dd1c66e75a4d2498d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
a6f57c7c519ffe41d1b335a36141fe9e

SHA1
89bf13cd0b11f13bf380f5038067b8777862e4a5

SHA256
475002f0a141f0e36c74ff0f713f8ba8ff8160a52ae680e078ff0b1fe97592a6

SHA512
68f68a6469fc9a2696d3cc78bcc87c5dc9ec3adc2f1e4f1ceee649ca394e6e434a7f67be6453fa26eef097358eeb97bbbad388e62e97c3f9d9b6809d3c612797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
538B

MD5
e4a5c1fb370a01f0fb94d686dc0af582

SHA1
9f9dcce334f35c201dd0a06d8483c2c138532594

SHA256
4067e52ec9475eb34031bc573db15231b26cc71581c9b1a0fb905fd4b96ec8db

SHA512
7ac071b00f858764ed8c4f3a6f323c0422193b74efa69d3f1a031dc38c3a440cd55bbbc73c678cb39442af6eebf43f4d25d428c87836cf58973ae7c45cb5fb0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ef6f13847e33dfc22aac3b392d6f70cc

SHA1
e62b62ffd25c1f634eb859a77a1187783f6920d5

SHA256
f5ff5dd8bd514cd7d4f0c9a3a3883ad2e5bcb61a95a27acae11adb711ceebec0

SHA512
c4d0a30270a9a9711b24ca8f323681b00216ee27e8eeec7847a20aa82b7bc0d7ae995f0664ba3f24f0a2645cb8e66737a27c21cfaa44590473bc8acbf6a52aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
e9aa93254130c95d88cf1bd2ceb18719

SHA1
c0b57fafdcd82942ffea7f5ca5f97f87605ec78d

SHA256
05d261f2382926c6c5e6a1d3654f4886c3ac36a96f78d5d2ffce64001913bb08

SHA512
ba24fef21297f5efe8806bbaa77db0055427cb2f850d21ef88de7266cb3c25e5fb60d9c985a63213ca9e9edea332e2384f4540a4c89836a797841ee1fc5fa54a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3cf53f97f9bcb7142e4871077499fff5

SHA1
8066ca043d9282c7cf6a3d54dfc75bfcb84fa65d

SHA256
fd02193e694305366691b6d193fd1003f8906e8f0bcd863206f85192bc60763b

SHA512
d50af8552e2ece601a099b9584580deaf46ecb2e0a6df43bd4483f896dc610fe4a2b449c1c6344c09c7f6c97f9eb72a20aa6d2a21a61f7cfd88ceefa3df9862f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
b9f6416d064ed08a89f642dffa8485b0

SHA1
6cc919a866cf10ddc3771138525ff066cee2ed97

SHA256
41545a744f8f91b033416426a8d5de19f34e28d6346c2f1916833ee34673acce

SHA512
316a395b5264ec7d397f9f0f14fa6c6fe25c1070c70af93b69261ee4069e5b851fc20c98ba58fc3b0bc9387abdaf63a4c8b1f352d0fa9f45df69fc49590bf1f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a940.TMP
Filesize
48B

MD5
e74bb85d6e6837938f73e4c5eb9a8ebf

SHA1
e0846c31f0b9cee577c0efe476a9b3b9c5c67d5c

SHA256
5ec46683ee3fefc824bd64137dcb51719f0064be481435f604f45c594caacbce

SHA512
4bf81b4cd41c81468a57bbbbf4328c72d497c2e0ba5489ffa0fec395c51e024ac32af430971f684199690cd85dbfb549a2153b9dfdda4a40c4220cd23b7de6a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
e87a167ee61b06e0cf7580676f1f7aeb

SHA1
80424a28e10aa7850674f8e9476b0525ee77011b

SHA256
9ff40ba56cd675a4735c5c15d5a76f7869bc56647bb13df5dbe7df09a9b809a1

SHA512
bed1f8ad565540591ad886acf70dd8a7f5d347909fa388b2faac276f1e962b1b83ff77d80f4a8d3d72a69ba293cd2f0e2598b0644846203ce724e7799a710cd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe
Filesize
45KB

MD5
ac7f33c23569ae7e3ba963d6a5e55fd0

SHA1
2d231e29c5b5964efa91c7d1c6364caea2fc20a3

SHA256
b2a1e1a0dd89bcb9d7580e9bcf525309f5475ca79f4a616915f9c11c0603c3d8

SHA512
af2ed21937313aa210284ceec3a6af05faa0cb5e6d8830bcd805af760d9a8302ac47f1337e4750de7549e58bc06c07aaec3521ca6cc3453811ed5c1f8384876a

Download Submit
C:\Users\Admin\Downloads\KrampusCodeFixerV2.3.exe:Zone.Identifier
Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
\??\pipe\crashpad_3632_RELPJSQAPGRZHPLM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/572-224-0x00007FFA3E4D0000-0x00007FFA3EF92000-memory.dmp

Filesize
10.8MB

Download
memory/1016-194-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/1016-195-0x00007FFA3E4D0000-0x00007FFA3EF92000-memory.dmp

Filesize
10.8MB

Download
memory/1016-225-0x00007FFA3E4D0000-0x00007FFA3EF92000-memory.dmp

Filesize
10.8MB

Download