sectoprat | f9e5167d5adced0124cd4149ce339ee0ee2036dfb3bd89484c9feffbf7884650

Analysis

max time kernel
120s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
10/09/2025, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HomeMpeg.exe
Size 1.8MB
Sample250910-v1hdsshj3y
SHA256 f9e5167d5adced0124cd4149ce339ee0ee2036dfb3bd89484c9feffbf7884650
MD5 c73098893e41026d7d4d7f99f250f3b2
SHA1 92cabdc184a2ce41b97169d16fb66d9fc88f4cdd
SHA512 18449f9e4efd7294e298f175bc2093d04b3f3a4a0410eb4577f425ffad568d0b0cd3cbb636f7dbdfe278b119834033b3a072d4af6494f0efb18402f9c1116e59
SSDEEP 24576:EVDwFklDYgXbcuXUpuZ2jSr3n1SJyDZ17igqatiFj6wml7OdPm2x1YPW3ZC9udhH:EVfHBESr31S4DbgFfNY+3ZbFo1VStYAb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery sectoprat rat spyware stealer trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1948-83-0x0000000000400000-0x00000000004D8000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4084 created 3644	4084	Jewelry.pif	57

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4084	Jewelry.pif
1948	RegAsm.exe

Loads dropped DLL 1 IoCs

pid	Process
4472	HomeMpeg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2008	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\VerdeSf	HomeMpeg.exe
File opened for modification	C:\Windows\FetishNightlife	HomeMpeg.exe
File opened for modification	C:\Windows\PointedLebanon	HomeMpeg.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HomeMpeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
1948	RegAsm.exe
1948	RegAsm.exe
2672	chrome.exe
2672	chrome.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	1948	RegAsm.exe
Token: SeDebugPrivilege	2672	chrome.exe
Token: SeShutdownPrivilege	2672	chrome.exe
Token: SeCreatePagefilePrivilege	2672	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif
2672	chrome.exe
2672	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4084	Jewelry.pif
4084	Jewelry.pif
4084	Jewelry.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3972	4472	HomeMpeg.exe	82
PID 4472 wrote to memory of 3972	4472	HomeMpeg.exe	82
PID 4472 wrote to memory of 3972	4472	HomeMpeg.exe	82
PID 3972 wrote to memory of 4024	3972	cmd.exe	84
PID 3972 wrote to memory of 4024	3972	cmd.exe	84
PID 3972 wrote to memory of 4024	3972	cmd.exe	84
PID 4024 wrote to memory of 2008	4024	cmd.exe	86
PID 4024 wrote to memory of 2008	4024	cmd.exe	86
PID 4024 wrote to memory of 2008	4024	cmd.exe	86
PID 4024 wrote to memory of 1952	4024	cmd.exe	87
PID 4024 wrote to memory of 1952	4024	cmd.exe	87
PID 4024 wrote to memory of 1952	4024	cmd.exe	87
PID 4024 wrote to memory of 3064	4024	cmd.exe	89
PID 4024 wrote to memory of 3064	4024	cmd.exe	89
PID 4024 wrote to memory of 3064	4024	cmd.exe	89
PID 4024 wrote to memory of 1492	4024	cmd.exe	90
PID 4024 wrote to memory of 1492	4024	cmd.exe	90
PID 4024 wrote to memory of 1492	4024	cmd.exe	90
PID 4024 wrote to memory of 4084	4024	cmd.exe	91
PID 4024 wrote to memory of 4084	4024	cmd.exe	91
PID 4084 wrote to memory of 4728	4084	Jewelry.pif	94
PID 4084 wrote to memory of 4728	4084	Jewelry.pif	94
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100
PID 4084 wrote to memory of 1948	4084	Jewelry.pif	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3644
- C:\Users\Admin\AppData\Local\Temp\HomeMpeg.exe
  "C:\Users\Admin\AppData\Local\Temp\HomeMpeg.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cmd < Hash.vsdx
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set EkrtC=AutoIt3.exe & Set JJqGP=.a3x & Set yLtJUvAdCvOAAjznvefYusmLipWkDiNvlowteB=300
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y Atmosphere.vsdx *.*
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "border" Accessed
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\471680\Jewelry.pif
        
        Jewelry.pif f
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\471680\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\471680\RegAsm.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw"
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2672
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffcee32dcf8,0x7ffcee32dd04,0x7ffcee32dd10
        8⤵
        
        PID:1040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1972,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
        8⤵
        
        PID:5068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --field-trial-handle=1876,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
        8⤵
        
        PID:1588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --field-trial-handle=2152,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
        8⤵
        
        PID:1936
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
        8⤵
        
        PID:1492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
        8⤵
        
        PID:3064
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3660,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        8⤵
        
        PID:4468
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3696,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:2
        8⤵
        
        PID:3972
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3704,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
        8⤵
        
        PID:4920
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3756,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:2
        8⤵
        
        PID:4100
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4316,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
        8⤵
        
        PID:3232
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw" --field-trial-handle=4532,i,12405564641581813038,10064460546945404978,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        8⤵
        
        PID:3864
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\NanoInnovate Labs\NanoCraft.lnk" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url" & exit
  2⤵
  - Drops startup file
  PID:4728

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 415138bf1f49b6b8627f0bdefe6e1ba4b46d5b9ceafb62c8457e0b58a8f85a16
MD5 47c094a260f0c759236ed31cb9ad2ac1
SHA1 4c32d44c5e4e276f6bd48d8b2792cc51c33724f6
SHA512 8132f78819d02f380aa492556530f5ad2a0fa5a94a3faa127ac1843f4e95a4be8affc4e090b31ee8d5abf39de59c2a146e841148cc5020e436dc2ff6c951275c
SSDEEP 1536:4bXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMr:CXjM4rTmN5eWvStRNoV8cWK7XF+TwMr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 83d2ee773a289d6c7a246974c38dac9ccc1069b08b75109a07901baa65cd53e0
MD5 b88203ecbc6a7ad738436acfc8162565
SHA1 d05c5ebe7708e094227ddc799b63e2f9b7423e29
SHA512 e97c3fe69199e0b8a2f28b4a3cde837ff0aa6c72636e6c236b215ed426ade1f7006b9026c6b22929161468712b02920941f17c1ec93dc3c52c59fdb7149caae0
SSDEEP 96:rqONkCyUf6pgsY5ih/cIVURLl8RotopLWuBgPIvm1mrCLRcprKsAe4mJklhSDS4t:uONbytg0WiRUAyxECeprKs3kK/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jewelry.pif

Path C:\Users\Admin\AppData\Local\Temp\471680\Jewelry.pif
Size 1.1MB
SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
MD5 7ac9278876c83c9b597fae68acb6fbf9
SHA1 18150c9b96bffd20c8203ff98a4fc153929bc2c9
SHA512 ddcedf90c53c148d85e36e039fc25712e242e9256ea8791d6cc15bb862b6b85a19a5583b5554f1afda9406affc4e953c4f8a2ddad6fe4d959a9fd5395dc870ee
SSDEEP 24576:r2XJHqX/Rr2YU9EPqYlsgSsJbD1tiP4+kUrp5B:yZql2nuxlRV1t1YrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\471680\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\471680\f
Size 1.2MB
SHA256 6082a2b5abd480fe40eb11add3cb54cc389d028ab78d4069254cbcab7ebf27dd
MD5 a6aa955784b84cabb3501bb375f08eb4
SHA1 47c849a6ca2738e4e91ba3fa32f5da4512793512
SHA512 b8103d561bc590869f48cec2bfede548ec4c7316f7be90f5f5b272e1434628f9e83098bdb88be0a8578f63e3939533f3c711af93f2dac81ad1db1892648685e4
SSDEEP 24576:C9umhBXCY701LvSt6sY6e16bcfXTuZ2jkr8MFSHy8Z1gHg2RCylCiDY6GaJ:ASI0KtnveAGMEkr82SS8bQl7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accessed

Path C:\Users\Admin\AppData\Local\Temp\Accessed
Size 405B
SHA256 0db925cd11829e5e4bee8628ee119f962036fb58b3437957221a8e5fc64e3cec
MD5 a40e3d5d13a7c5f1bf018f4ef4f5b34a
SHA1 5b036c1522d16bc9e858377518a261d79e76fb0a
SHA512 510199b0cb412bcc8d7317bd9a3111407c1c7b30b571883761d9307f8835ecb7a187cd5f52fa9ef1da28f0f414d44de88674016e167119cc692abccbd73a09d2
MD5 SHA1 SHA512

Submit Download

Atmosphere.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Atmosphere.vsdx
Size 533KB
SHA256 819e36604e5550bb0fc7025667f1f9fd1e18e87862627f18b7f23b401a310b0f
MD5 3648ef7a2eb809ddf1ce3916af06a132
SHA1 af4df2f760c0cddd1c758c76408f3c28c84f9970
SHA512 61dbb7fe33f76b7ab14a0fc7e7462bc78b5b5ed4c3d0d293a9591ce0150bbbc3daf2e6e558704f657627c3209c8b704094800991c31c7e6b35e2f30e60ff065d
SSDEEP 12288:xWIVexiUan3uSowHllPEyrHcoZjs0yviL:xpVuiUaeiln20bL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Calgary

Path C:\Users\Admin\AppData\Local\Temp\Calgary
Size 131KB
SHA256 c472d46e978b0722ae864f7a66a8bfa1ecaeddb53af2bddc293a714c2037cc23
MD5 8a6fbe74115b2930511841451e9f00fe
SHA1 984528e8ecb52fcce7a5fb54cb2a9f69b619e6da
SHA512 8599019dbf7ac1e1022255d587067464bf88824ad2bb85a28ed51bd3410ec46256811c74080429bca35593f0606f94f0857f253c65e36f3d407f8fce90e5e802
SSDEEP 3072:N36sVtT6H04k5h6m/Fy0UhMsqu5OonZkFNrsjeiw:t6snrZ/FfUhMsqu53mFxsjeiw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Centers

Path C:\Users\Admin\AppData\Local\Temp\Centers
Size 127KB
SHA256 f0e3125db75399342a83e76b91103451a67c2c6fabe6f1103a7470c0daf6d919
MD5 e8376f02fcf285ff6d267f8eeea31705
SHA1 6b52639c4ec373d444c5874cad48814c7ed880cb
SHA512 e1a3e516f95bae3e4bd6ccc791b47e43a8789fe7dcdf43b4ab9a4e960a42df174d25b3eb23b80092be5ed73d98f853a99eb47d107ac3dabe0b9df75bc47b1806
SSDEEP 1536:R1iNBTCUXIH42r7snyuXG5egqzIU15AG73prFCtNwFqGqUqHHM/cZ+nVzM:7iBZ4trwnNX51zt2wQGq/hoVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Eh
Size 110KB
SHA256 3ee22a06321c6369a2b502c67646eacb58bec2306189c7c53edcb48468c91aae
MD5 22f7b01c610232458f9e36c8963f1065
SHA1 bddd5b57a2603455a2901bcb3ec4805d38a49768
SHA512 14ec31a4ce009e46399cf9acf6c1d376152cb9812f6051dd927db9c08dd31a7e7d0f04d3c9f764ce31455ccc48afbeee62157beb0d675694d80a8d4b86e630c4
SSDEEP 3072:ZRMsKz50/0DIPEXbeTjDiNyWEfGxciSvbDb4w8:ZRS505EXoiNy8xciSzn4w8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emily.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Emily.vsdx
Size 219KB
SHA256 ca8d6afb89daae43de486a9eadceb89213da61659c144833778d7135d42b80ec
MD5 cfab8e128a6b57a37ac057aaf87ec04a
SHA1 78ce87cc9a6897514c14ddc24ead60d0ba5038c1
SHA512 60309732736e4871ee0686254315e0510d02f6c5c7353dee43239ab3ab5bc444a2d811fb56418c30d619b3834624c991818432b98c6698b89c93c3e5b77ba1f7
SSDEEP 6144:S+bRWJj7vdGIHT7GfZVQjB0pCGzQMVKQr8qZui8p:S+bcfXTuZ2jI+ir8gui8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Exception

Path C:\Users\Admin\AppData\Local\Temp\Exception
Size 56KB
SHA256 2620694dd68ce37e0f3635be022b34dc0b1b2eb24db5b3c30520787283d1ee4c
MD5 2443cd8773b0718847895f4c5130d7d9
SHA1 cde911724c458139ed42ca418471412e740a6427
SHA512 405e6ddca2de93c5ef363b94ac82487068dd14ede3832bf0eb693ecba30b3d7ff76aacef2ace45cd0268e180911c0302be7bd11b3d4b4cd78316bdf27415b36f
SSDEEP 384:yXoSpu88888888888888888888888888888zv888888NfU84444QnooooooooooL:yx/Sm1fI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Footwear

Path C:\Users\Admin\AppData\Local\Temp\Footwear
Size 145KB
SHA256 6d25c1b0db2b0dfb7e100cffb41feb59221a02c7137bb6093848f423bc41a180
MD5 d23e431aa6859f9a6191b32d4d6bddfd
SHA1 856b08c060b13611a24e33b94c7a74fedf8e6b8b
SHA512 a91bfdd4e25a0f41ef3324b44a13b291ee1f950c604c90ec1944036cb134f8c9d1e836d3a8c83abe7f5f1a2402ff28457aadf209e897d1ab2bac0d8545bfcfa9
SSDEEP 3072:lzxsPR1yciPWprowM3Qm23DjOH4IoVcfIHaAtri:xiPDviPWprowbzxIoyIHddi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hash.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Hash.vsdx
Size 28KB
SHA256 6eb4ed45d1cd7c0747e7bec09425c347b9deb0f831ffa62a69d084ac4da58697
MD5 120d5103199290a8b075f86f6fa423a6
SHA1 1747a46f63359184128a6fa929a2997951586b60
SHA512 997a2ff8ecb878e799b249607d365958c06ea27317288bdee6110637dad72d7333e94dcb26dee12d91f4e894a253432e93ed370177dc93eaf763f5581eae52ff
SSDEEP 768:qaXNmMhd6ytl8rKTxmQgEJTqlVjUxj3Nx87uu:z9VAsTQQg9wxj3NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Highland

Path C:\Users\Admin\AppData\Local\Temp\Highland
Size 73KB
SHA256 d8bebe65ed8106cd2c18dcbd120c6ce0ca0e3f0ba3e43fb3adaa9785cc2cc8e2
MD5 a32fe555134dc9187a13a17f00d3e276
SHA1 d11fa6b6a0b2784fcefdaf92aa6f9a38261a9dc2
SHA512 5058b46183240e0cb929e6c40e91128cddce3626db104288b9a543cabb860abe9c817d5f5446a203aaec8a0e56f8e9f91ccd92571f2231dfd306cef1e637179e
SSDEEP 768:i3T3Xr63EYr8qcDP8WBosd0bHazf0Tye4Ur2+9Bkk2TalOSVWV9+k:inr63EYrDWyu0uZo2+9B4u0SQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Latter.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Latter.vsdx
Size 167KB
SHA256 862dcf739fd5453a5584d021b73faff607037054308a7f4e37b956626e2a5242
MD5 0c5ee23ef98345d3c81bcae1d9b20faf
SHA1 1454b241e0062666110897790979cf3841676520
SHA512 2afe303c6640318e096f2c3deab07f2ca62ff615f31f2dd8c09fdab0e04caa17f3e52dd80d89c8f20f9b4bd9d03122f87b7daac34b55da3c8792df4279dc4fab
SSDEEP 3072:1e2Iw2nRS0VNGUzcqlN37sxiNeZU36JTdI64457yHHEPnRbSN:1e2Iwog0VkUwqlNLsxiN76tdlf57yHkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Licence.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Licence.vsdx
Size 287KB
SHA256 81a327e5a80f4ca2170b95f18a14b7e0e95e754785f64a39f977f9985582fbc6
MD5 8851737f0cc04239cda93ae36872993c
SHA1 5b39e98235adc90ac552a4408712137a5e86493c
SHA512 f56e7d79eab1018fb8c7033228309474e5af632d98586174d6025d38959ce85b8aff72858a3fba46ee8d7e80d8c1663ec9525ed7392dc5e05c5a0a138a861f7f
SSDEEP 6144:Cr3RKdHGhrF0St9yF9ayk8slhNg/MLh3JnvnwZk1u17xn4gNNhGThO8:CrBumhr1U0F8YL15vnwZ117NHjhwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Meant

Path C:\Users\Admin\AppData\Local\Temp\Meant
Size 114KB
SHA256 a27aba7030721814e2d3d8fa08fac3b0788a04173148cfd6d564e1b1cceeabc0
MD5 7d4c057994d5fea4333035d73f75412b
SHA1 034a633617f2607f9c0138e5245eb442e54abcc2
SHA512 7a9996b7fd6978794352ea7e495d4e6b9e27a3cb6b03f6d53c6aa81f4194033e7c2aa4659482c6cd2e737f0ac0ca63ca1e57a4de89321b8f48378c7472d45a4b
SSDEEP 1536:lvMp6EDRYJ7kIz8DkgIhPkN9KnmT1cg3ZDctGbKBXkWj4upDK9q4Dw3c61RG31M:6lsgIhs3kmTmwZDgGbDHVAc6jG31M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Montreal

Path C:\Users\Admin\AppData\Local\Temp\Montreal
Size 125KB
SHA256 941f5dd83c1aa71ff2540086c19504c79d7681c9211278de32645e8a3f31940e
MD5 7ef8a6d3bf8d0b6e959b13f0291fba46
SHA1 70cc95b80f79e12a6fff7b20aeaf90ed924ea87b
SHA512 43fe406603cde6a1da37b91f5eba9863135dcc69fc006a82aba9a3c1cbceac3ff6a52c8857396df4caac983f18634ac3b7c54e08ffddf29b6086d4ba159029be
SSDEEP 3072:OgNkSXF/U8QCgh+qLzxc9TvNU7DYrVUhijUvlg5:HkSXFsczqkC7aVUaUvi5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Outer.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Outer.vsdx
Size 75KB
SHA256 6758c76bf8373c23e9525014b74ff699daa4f77ad8d434a950f6df7de279f5e5
MD5 6dc0ffc6e1825003e90eb6d77fe43c05
SHA1 3b4616ece5386e49ac7c2342a935d5f6bc216a26
SHA512 c6fd6b13e19adc2a470a40b8fa6ffc6a30f06a95b76f0872a6838c9b8748ff28612936513e8b4ed5860b71d5f1bfe6fbfb31fec6eefe0f83b21d7c4cc79c61fd
SSDEEP 1536:biB5ezAz8XBEqiNcBQE2kY+D+mVoiiuhg99Luan8uga:biBVz8Ni9E7VUuU38Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reading

Path C:\Users\Admin\AppData\Local\Temp\Reading
Size 87KB
SHA256 f75beff8826deaae9f963d79ca669d8a91a794e7e6dd5693d80d6cd9d78436a2
MD5 eb90a67256866f9cf94351131101c24a
SHA1 4868f8d1f7e4fc70ff26d128d997cc628ab045b1
SHA512 394d780e84c1fd1ce2ab685bb6be28a289cb2974c9dfbbcbb6f98b8832fe81d624102363f8f5806d4b17342734570d0385e38ad77983cf0961d1b593275beccc
SSDEEP 1536:J/29GTnb+aTOpA0KOWZ59Dqd2LoanG5Yh+f863I5DypFOlJL4x7KBgtIZnsjAZNF:JKenii0yD1LoanUveooL4x7KBgtEnsja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scott

Path C:\Users\Admin\AppData\Local\Temp\Scott
Size 113KB
SHA256 ff6212d7ccc5d9d48762d8edb28b1a45a0c7e1d660c7958d8ce70e12f6398b9c
MD5 e1a8f8a0f670f1ea341232e078b35f66
SHA1 4e6799bdfb02daef8cad21e9a106da40906ecddf
SHA512 94b161bc016bd19d4d9e65c2819f37df41a53e7e3dcbc3b3fc4c761170ff71255c9601f1cdb04ae54bf3732341ac1651af51a94264975e8723eb96773679d17f
SSDEEP 1536:46j6rs84dvTcAXjKd1bS1wwQOchO+534IY1GsTrkerRIb+cgbrnoZwB:B6uId1bvhOYSQurhrRIb+c2oZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shared.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Shared.vsdx
Size 292KB
SHA256 bc6383b2458856bda10e489ccf4aff40b42684dcf1bb895e528113a41a645e66
MD5 358ebfeecdcbd3316aef52f32fbbc0ae
SHA1 57140f13563c329c11a1e0362ba26726e36523ba
SHA512 c53d709119e4e6e5e2ef6db7e89f2503e117b86451cf19f8e33d4fbe589441a99195b9fdcc214c819d30388e07667df69c005add33b3504f79375b894dfb6f82
SSDEEP 6144:bUed1qysCQGJBQKVejuSYATGOI7ilEXhPxPvB1dtUGTjIjHk103LVAT4KFi:4CqysCQGJBulT27WExVZ1gGQjE1+Bi4T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tube.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Tube.vsdx
Size 188KB
SHA256 9a0a0bcaabd8af4c46dced80ad3523358298b07b9d6fa0e1590f39b4d68097c9
MD5 616c5606664a88df3d47cdc4a67a0cc2
SHA1 71bd90287592d092e0780c9d10974490832a88d6
SHA512 e0d4b616bc3699ac7f7fec0ade2ed8455b780924a57586c67b475f6988e95ab9f914c708078ff1c6f139a59b27eaf46847e1e7402e995d354b961640df2cf8cd
SSDEEP 3072:uTqeqCBMOaL7Q5DVRl3eXhrNZ8JExoN7cfnYZDeAuJCPiJG4F3Rx5Id9Z5Zj/eCw:uWGaL74RNeXhrNZ8JE6N7inYUdYQRkd2
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Crashpad\settings.dat
Size 40B
SHA256 e4fb9830c0045059b7bee146da1eabf01160d074dee08ccbf61e902eb59afbda
MD5 3a19e9ae8416ea6553b7c44d0cc2292a
SHA1 aac4911990e93e8dd81dbbdde64715d38bac8d4d
SHA512 530b657af7e800a650f4582e3ff0394ebff79ab1c233e108403216857b41ae5df0d6ca6759547705ce7d6624f73cb8ea2cc3fd71672c66032b9ad108528d2032
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5e47aea4c3e889f9a9ce7e739def061d3f3ef5d639159dfb190c54393902d908
MD5 647fedd833663045e4b07c8e035bb83f
SHA1 c948231c40ad047250421288ae9c3a7915442374
SHA512 2564fc8a18ee33492260b7ec2a7a9a3fb593cad362938a803a973a9d0bcf60be35213c401a80f16a09000f4fbb3717ab023cc29d374a49fe2259c6baa5edc7ca
SSDEEP 6:/FoEXESM2McfkNwQGkmq4rKUFsktRypk/eDyypJE69+0Ey:d7XO2McMNwQzmq4rlRypHyypJbAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5fe9b6255b726acc6c47fc81ecaca931167fe9eccab69d163d8e9603908f602a
MD5 22e1579cb6159231d4328561dd10d541
SHA1 341be697103ed3b22dc9927244b77b931dfcddb8
SHA512 c80475899c70ea43f54c4382a1166f7ba1e9f71eb31c326535b5f2e2d3379f5333e20eb06ab958b8f64b50134b32fe2b5f2d16aebdb4c5cdd26ea5384ca31eb1
SSDEEP 48:I4gYygtcJwMCXgO8YMiXWd5RGxoyCqS8aBCy35afzW0Yw4:Igt/g+DWtPDqSCypaa0YL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 47ea375c02bb15532d7cd57dfa1651d90b1da6166ec2845f34fcb11def18e1cf
MD5 272f34798628d17d037f59d74b2b83b9
SHA1 51fb95fd460f07b65109d40dc0d1253032f0956e
SHA512 3531135a05fc7aa832692a9379b86c1927447bd5dd69ee97119347094f1ee7529f59a3948db2fdc8bdc6d05870fa776cf5dc9dd7464e7618447b96469f4202ec
SSDEEP 48:NSvPBgZ82Qrp3FsrR0cNcC1NCdH4emXZY:Iy82QR2RXuQ0dH4eU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e444e6a4f7f074b9d490a411a8343eac37d90abb60cc335f43aabb0e05135c06
MD5 ade14034aeb81814330a4d8b89826e04
SHA1 8cdb7b97343366352977201db7162d224c96ad39
SHA512 04e77450f3d5e4772502369abc3535b06ef5c194edeac031c0f6162c327c0c66e6a63bf17524f3e1c49c5f8b7c6c3feaa18f8b4d209783f298bac71795b2d17c
SSDEEP 768:sfDPLSgcRUv+hh4FUfDPLSgcRUv+Eh4wUfDPLSgcRUv+Th4wF64464464Bk4:tn1h6d6t6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 7155c0c7ac5719489c60207678c68b46688351534389f8998e39c19ea33cfc67
MD5 f7999b0fd92d8bccc76adf3ce02d33a4
SHA1 7a058492bc92f06928add3b7e5eb6b5e3e1e3eec
SHA512 c1840305cc462a927ce8e6ad46cc1ae07456d6548debb627151709e6d7758b2b7eca17f514c3fa479be841bc1fff0b6604c8424e94af47c7e37539bcf010aec6
SSDEEP 768:2MRb83r+8qCH3Do4S2NvKOBUOWoLCKAlegcNvgkssOzfwuLQaY9c:2M1MH3Mb2Nyr6ptvBsHtQaYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 569194375d5d79d291195610ec5719bb42a1cb42f58873ee4b62d9beaae54832
MD5 713908d970d7a738f4831a564abd6397
SHA1 4b6cfdca613d695218d481d4ba7f591f759e4507
SHA512 4e7476a3731a6551983b6aa32fe72d58d97d6825f6fbfffc8ca846abbaf610250d857766e8703dfeeadf8f9b2db3f846076045a2db3ccf435723cb444dfe0619
SSDEEP 1536:C+DwDqrDkQ4IU08bp8OBuwWQIYaDnCCdYXGLr/Mqu14UFsvXR5xRn8i:HwagtIj08MY1jXr/ZWzsZvRnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 420ca2eaa32a22f339066e6879d75a60848f8833bb4f10c3ad10a2da78adf04f
MD5 32305e20df23cddaa5ae886b97ba6170
SHA1 461d0572662dea04eada8017b97e2bdeb023b475
SHA512 9763137e96925327189a4cc2fa234fb89342b0f34339ca2bec5baf95b810c6b2b4ce40905224ecd7759cae0fe5c2dcbbc876a509e86a8cd67a6d49d772d73123
SSDEEP 768:vta8A+3yJu2PsUex0BUePLOKRf0peBavs6h88SQxkGxkqDPQIFCvUUPAAnqW1:vE3+CJZURx0BrPcs6m8jDxkqzQIxUPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Cache\Cache_Data\index
Size 256KB
SHA256 256f1bf7ecf1f73767760616d0a66e42a457066dae35e9054ec59789d06d2f08
MD5 48d3aecd60c141ddb1c9df0b02b0c9da
SHA1 207d7a4c24934f42a1a8d859d62da1d71107cd7b
SHA512 9e51c467f6ec0cf5ef0e42f9fa86e6bbb62e13671db08e4e82ef38f42b826861a39a7de9900dfdcb2a16e43db66be7e6342ce74906e1dc46e864c5e1ca8712fe
SSDEEP 3:LsLllNlNllklkXl2n1Sllx/911t/N/wlDlNlXlmNtlME/:LsRt3lP2nIfFfNcE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 309784524a15b187ed8311ae0fcea24642c920965e0d0211024060c93157d388
MD5 71e9a0eaa15cbd540a692a03840b7648
SHA1 12de79468b280a869dc658e431dbf15d3673184b
SHA512 22518e2fddaf4e206da39915d07a70ed1e376bd64a5023ffbab4f346012aaf01348f25fd00217a2204760e3bba964557afacef05e09368840b301233ae7d12b6
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 a63e688f101f4358a83f5af1884e35b1453fa8595df3693ee7f3d2415c4b0941
MD5 0cf0d39b22f84a74d1a61ae5a81ea974
SHA1 f8b8ae27a5c66baebd8e3c68355e829c522c359e
SHA512 5b77afd669bb3bbe964a622cf91c505a53aa42d6ad9c0d4753331237cb23934807229ddc9028d45e4e32e83cf18be7bf9f1a4f80db63aab7121c732b0ab9761e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2d9dba3776146aaa5ccc32ace34ccfac64137b55bc7f4ce8641b2709d60032b4
MD5 3bebad46523b37317a14d88b2f6a4c67
SHA1 954e7706679cc267a1f27622fe114479ce15a04a
SHA512 509da0b4f982d77afdd546b84cab133c346ee0e2db78eb12627c0888709453281909927962cdcde495436051fe4673cd06868f45e3efa1aaf4e13e53488d57a6
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\DawnWebGPUCache\index
Size 256KB
SHA256 171066cbc25c015aa5acee4d1274066bd0186f9de830a01fb6f198d0eec88d81
MD5 088d3b2a87e10feafd533421d3e9e93e
SHA1 9fa7af1e9e48cc37c28b0f3b2debe2ac6bf4d5c9
SHA512 e5dd3f722f35798d0dbfe22fce0d301546545673138480273f28fba50dbe99a5208a1f2c48915cc148beb9ce6e33b4852fbf3a5941acf6db99df3c94894ef2cc
SSDEEP 3:LstlNllklkXle3lt:LsX3lPe3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Extension Rules\LOG
Size 267B
SHA256 a3b97910963efb0e22c67a9a535c3acf1dded014ae6182cbe71c7107facaae2d
MD5 bf72d3cf45a0f56770ba41dc0927c960
SHA1 6b367a849799c6671413d7bb741f91bb1dec6a89
SHA512 c8480ebae6ef65324dbc0f7df1a6939ff80bbf0bafcf2b7b524d01f38565f1a75c957ee190129b666f47e01db9d29887e55fa32e483c8483da78c235af178cda
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Extension Scripts\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dntyg221.uuw\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7273.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1948-89-0x00000297B96F0000-0x00000297B9C18000-memory.dmp

Download

memory/1948-88-0x00000297B8BD0000-0x00000297B8C20000-memory.dmp

Download

memory/1948-87-0x00000297B8E20000-0x00000297B8E96000-memory.dmp

Download

memory/1948-86-0x000002979EB90000-0x000002979EB9A000-memory.dmp

Download

memory/1948-90-0x000002979EC20000-0x000002979EC3E000-memory.dmp

Download

memory/1948-91-0x00000297B8D50000-0x00000297B8D74000-memory.dmp

Download

memory/1948-273-0x00000297B95C0000-0x00000297B95D2000-memory.dmp

Download

memory/1948-274-0x00000297B9620000-0x00000297B965C000-memory.dmp

Download

memory/1948-85-0x00000297B8FF0000-0x00000297B91B2000-memory.dmp

Download

memory/1948-83-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2672-140-0x000001C379500000-0x000001C379524000-memory.dmp

Download