sectoprat | f9e5167d5adced0124cd4149ce339ee0ee2036dfb3bd89484c9feffbf7884650

Analysis

max time kernel
103s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20250905-en
resource tags

arch:x64arch:x86image:win11-20250905-enlocale:en-usos:windows11-21h2-x64system
submitted
10/09/2025, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HomeMpeg.exe
Size 1.8MB
Sample250910-v1hdsshj3y
SHA256 f9e5167d5adced0124cd4149ce339ee0ee2036dfb3bd89484c9feffbf7884650
MD5 c73098893e41026d7d4d7f99f250f3b2
SHA1 92cabdc184a2ce41b97169d16fb66d9fc88f4cdd
SHA512 18449f9e4efd7294e298f175bc2093d04b3f3a4a0410eb4577f425ffad568d0b0cd3cbb636f7dbdfe278b119834033b3a072d4af6494f0efb18402f9c1116e59
SSDEEP 24576:EVDwFklDYgXbcuXUpuZ2jSr3n1SJyDZ17igqatiFj6wml7OdPm2x1YPW3ZC9udhH:EVfHBESr31S4DbgFfNY+3ZbFo1VStYAb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery sectoprat rat spyware stealer trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral3/memory/4080-86-0x0000000000400000-0x00000000004D8000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4596 created 3248	4596	Jewelry.pif	53

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4596	Jewelry.pif
4080	RegAsm.exe

Loads dropped DLL 1 IoCs

pid	Process
4960	HomeMpeg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3368	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PointedLebanon	HomeMpeg.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\VerdeSf	HomeMpeg.exe
File opened for modification	C:\Windows\FetishNightlife	HomeMpeg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HomeMpeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
4080	RegAsm.exe
4080	RegAsm.exe
3320	chrome.exe
3320	chrome.exe
4080	RegAsm.exe
4080	RegAsm.exe
4080	RegAsm.exe
4080	RegAsm.exe
4080	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	tasklist.exe
Token: SeDebugPrivilege	4080	RegAsm.exe
Token: SeDebugPrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif
3320	chrome.exe
3320	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4596	Jewelry.pif
4596	Jewelry.pif
4596	Jewelry.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 5016	4960	HomeMpeg.exe	78
PID 4960 wrote to memory of 5016	4960	HomeMpeg.exe	78
PID 4960 wrote to memory of 5016	4960	HomeMpeg.exe	78
PID 5016 wrote to memory of 3608	5016	cmd.exe	80
PID 5016 wrote to memory of 3608	5016	cmd.exe	80
PID 5016 wrote to memory of 3608	5016	cmd.exe	80
PID 3608 wrote to memory of 3368	3608	cmd.exe	81
PID 3608 wrote to memory of 3368	3608	cmd.exe	81
PID 3608 wrote to memory of 3368	3608	cmd.exe	81
PID 3608 wrote to memory of 3496	3608	cmd.exe	82
PID 3608 wrote to memory of 3496	3608	cmd.exe	82
PID 3608 wrote to memory of 3496	3608	cmd.exe	82
PID 3608 wrote to memory of 4012	3608	cmd.exe	84
PID 3608 wrote to memory of 4012	3608	cmd.exe	84
PID 3608 wrote to memory of 4012	3608	cmd.exe	84
PID 3608 wrote to memory of 4088	3608	cmd.exe	85
PID 3608 wrote to memory of 4088	3608	cmd.exe	85
PID 3608 wrote to memory of 4088	3608	cmd.exe	85
PID 3608 wrote to memory of 4596	3608	cmd.exe	86
PID 3608 wrote to memory of 4596	3608	cmd.exe	86
PID 4596 wrote to memory of 1696	4596	Jewelry.pif	87
PID 4596 wrote to memory of 1696	4596	Jewelry.pif	87
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89
PID 4596 wrote to memory of 4080	4596	Jewelry.pif	89

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3248
- C:\Users\Admin\AppData\Local\Temp\HomeMpeg.exe
  "C:\Users\Admin\AppData\Local\Temp\HomeMpeg.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c cmd < Hash.vsdx
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set EkrtC=AutoIt3.exe & Set JJqGP=.a3x & Set yLtJUvAdCvOAAjznvefYusmLipWkDiNvlowteB=300
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y Atmosphere.vsdx *.*
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "border" Accessed
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\471680\Jewelry.pif
        
        Jewelry.pif f
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\471680\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\471680\RegAsm.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4080
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i"
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa0c21dcf8,0x7ffa0c21dd04,0x7ffa0c21dd10
        8⤵
        
        PID:3692
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1912,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
        8⤵
        
        PID:4024
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --field-trial-handle=1980,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
        8⤵
        
        PID:8
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --field-trial-handle=2128,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:13
        8⤵
        
        PID:2892
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2772,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
        8⤵
        
        PID:2012
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2820,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
        8⤵
        
        PID:2124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3116,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
        8⤵
        
        PID:1500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3132,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:9
        8⤵
        
        PID:2576
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3152,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
        8⤵
        
        PID:1852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3212,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:9
        8⤵
        
        PID:4560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3984,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
        8⤵
        
        PID:228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i" --field-trial-handle=188,i,13558132440741313818,10283795780607796063,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        8⤵
        
        PID:3908
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\NanoInnovate Labs\NanoCraft.lnk" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCraft.url" & exit
  2⤵
  - Drops startup file
  PID:1696

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 106KB
SHA256 4189c16dec305866abe8e79e051b1a512a9d9c81d1c7cceece3624fa90fd7b5b
MD5 d7fd00ed8065971408438fc473a4379f
SHA1 6473af8b76facc6cd08fe2a24a323fa8424f69e6
SHA512 887507c4578665e808bd40c908a096d2ecf32052d8a3d4a86046e04d69e50950555d14d3ea76c2bee551e8a779009f347c738f4a139be17607b3cae32fd2e16d
SSDEEP 3072:UrPZaDbgxLzICJoIYkJENyhaMifVu803GB0RFXWnexq:+PqbUICJovkJENybqz03GB0RFXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 5cf66558bde053af5dabe1528ae0b848152df4b2006fb4aa08fcef73a9d1ff9d
MD5 1167873243aa6fbb967208328f73a497
SHA1 de8e2de9285727aa69ded4cf6532557037e1eef6
SHA512 ebabb20b86ca6abedd689f471ce057c11de36c67a73be824e532f8684595c8c6a7580dc089d53e1abb0f496f14dabc8c11d7e33206bb0e4c2c939a0e72aa0956
SSDEEP 96:NqGNkCyUf5IED5ih/cIVURLl8Rotop5b1PhsDABcPjLvptc7rw+oIzy8Ze4mJ/nd:kGNbyIUWiRUy5J6kmc72oy88/nc1K
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Crashpad\settings.dat
Size 40B
SHA256 7de00dba99934460d7172f1e3b520033ed211e289f5c3f84514f0de850c8477e
MD5 fd4c39672311012f737262a2933942d5
SHA1 a80f10b0001d078398c207ca033390fa6b541ae7
SHA512 6f7a1f55afb59d0566bc2e3dbbcaefd45966db8beee2a50aae82122bbcea6ecbee5aa3362dd959a2409026ec29494fec9b6badc88fd755c12e9a62105381e5ed
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f85e81369c66b2c8cb059f4e2d19268fd2e388bc2c2d64d66c745f8c1bf964b6
MD5 c904d38a5fc82fa33812b035316f1a77
SHA1 128f0268d836a7419bdf9936dfa3ddf665c52e65
SHA512 4621501be56b29ff986e537f892dab9ec7ce92bd50e54103a838bbc9a416d4f6cc1004c977d78de7fd0d928243de17c3ffe5849382ed673864cdfc707097900f
SSDEEP 6:/FoEXEBWNjJfkNPwipFwXG3sNPms7t2oO7TtCPExOd4zK:d7X7JJMNPwKFTeP1J2F5qEK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 66274bda3ff91c689e6b2d0a40d92d70a994c3f544896dfc6ba42a4743518d97
MD5 84ee9be8e9e6d2b0498d133eb3a8c72e
SHA1 2915790ca1b4b88f6172bd116562a42010dcc923
SHA512 e6ec3c310df2053c49d0ab309057a6a4bf7cd5aaa60a4e27a237d9684715564eef52b8012f0ede661518f19ae752d73f1ffe40ebbe259408b953c2a83b0d98d1
SSDEEP 48:oSvYFtWJwMCXgOvMiXWd5RGxoyCqS8aBCyGUafzW0Yw4:oSAZ/g0DWtPDqSCyLaa0YL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 47ea375c02bb15532d7cd57dfa1651d90b1da6166ec2845f34fcb11def18e1cf
MD5 272f34798628d17d037f59d74b2b83b9
SHA1 51fb95fd460f07b65109d40dc0d1253032f0956e
SHA512 3531135a05fc7aa832692a9379b86c1927447bd5dd69ee97119347094f1ee7529f59a3948db2fdc8bdc6d05870fa776cf5dc9dd7464e7618447b96469f4202ec
SSDEEP 48:NSvPBgZ82Qrp3FsrR0cNcC1NCdH4emXZY:Iy82QR2RXuQ0dH4eU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0a6f00f64ae67cf8657a25b8efc555a08f21f2ed3cd3b8a57466aa58c54e2aec
MD5 cb8dd2e90800a9b8cef465670907f4d4
SHA1 931361879d1a7a693bb70e8335a9d5631d346dc6
SHA512 974e5f1dca309ee22a87cb601407029727fd1d92fa95bd9886daafee07f8a28563a4e51ea0649e5594fef86996fbee72fc35f3b762100dda04fdfae1f09a8b54
SSDEEP 768:/fDPLSgcRUv+1h4WUfDPLSgcRUv+Ih43UfDPLSgcRUv+Eh4f64Rj64064Yk4:GQ5e646l6A
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 9fc0372907ef859950a55807303dcdcd915aa14babd808ebf6b3dbc9c7e32813
MD5 7b39e244a7a7faed8f198d5b17a3348d
SHA1 c74a2083577d20ef674e4178b86e204c75fc4b5b
SHA512 6d0303b4dc4ae8a5cca714bc202ecd02af1cf66ab72a329ddcae6f305be2a895cb99861cd11d0559325054b1ac76768efd03899d7cf6367547bc0d80d66c3f17
SSDEEP 768:wLB8cMxUV7EYWH+/zc4z9Vio3a9iriaCi2H5odAnDFOEi+:wHztWqzjz9sIjrJMjFLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 569194375d5d79d291195610ec5719bb42a1cb42f58873ee4b62d9beaae54832
MD5 713908d970d7a738f4831a564abd6397
SHA1 4b6cfdca613d695218d481d4ba7f591f759e4507
SHA512 4e7476a3731a6551983b6aa32fe72d58d97d6825f6fbfffc8ca846abbaf610250d857766e8703dfeeadf8f9b2db3f846076045a2db3ccf435723cb444dfe0619
SSDEEP 1536:C+DwDqrDkQ4IU08bp8OBuwWQIYaDnCCdYXGLr/Mqu14UFsvXR5xRn8i:HwagtIj08MY1jXr/ZWzsZvRnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 420ca2eaa32a22f339066e6879d75a60848f8833bb4f10c3ad10a2da78adf04f
MD5 32305e20df23cddaa5ae886b97ba6170
SHA1 461d0572662dea04eada8017b97e2bdeb023b475
SHA512 9763137e96925327189a4cc2fa234fb89342b0f34339ca2bec5baf95b810c6b2b4ce40905224ecd7759cae0fe5c2dcbbc876a509e86a8cd67a6d49d772d73123
SSDEEP 768:vta8A+3yJu2PsUex0BUePLOKRf0peBavs6h88SQxkGxkqDPQIFCvUUPAAnqW1:vE3+CJZURx0BrPcs6m8jDxkqzQIxUPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Cache\Cache_Data\index
Size 256KB
SHA256 117a46f35f3e0a9e0b2f07e00d11a2b8b5b25c45ea5adeb127662e6182a48ff6
MD5 6e63500212001a07a002ed43f3eb8066
SHA1 97bdc75a770587471c8831a8e2432d165215ead0
SHA512 85b6976153882230b54a6f3635211580f4bb9d312560d06ad546e9ba8a21e546b970827791b16d598237141df3a45f6c40e284b0b7a1f53026bfea38955891f8
SSDEEP 3:LsLllNlNllklkXljNnllSllx/911t/N/wlDlNlXlmNtlME/:LsRt3lPRnufFfNcE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 3c94440c181a078ca80de43f8627b59a4fd77165213c799244020e04d5ff5811
MD5 efb8bd02a5d762685237de3a33dcc8d0
SHA1 e177299ad2162704b7b368fd55f8780d1ec67a6a
SHA512 6edda98d77be078a9ffe78bdc7e46b872b1decbfbbc19ebd32d7e761449f7b7d121638bc11fbc39c152210e8fab09f4ad1f29a91e1c51f9f3f5e99a5ef88e0d2
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 e91ed7617028b1fab6829882e475830a11f9b7962ffd576eb95a09957b267366
MD5 20b111e502e9b11c7c50989759eead63
SHA1 4cda6055061dc29d3369e2f57987a070c634c105
SHA512 9d177b7606cd6b2d1d4b8056eb4dabf5508d7bc2aeff33e221db297692874d07bf8ebb435db38eed1e4426b368f3d55a0270f9883e180d41f11836cacd9377a5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 bcd3c70eda7ef100ceffe4f42fb86dc414eeb8b4adcec6841c8d84a932ae8e2d
MD5 3d00f58d38753d2e94e1f6f8f86e3c16
SHA1 aad21b270aae9b173ddcd8c4a9f5c7e9b4ad1897
SHA512 a74aa20fcb5421769f36de1d431fc8706c781448f5c863b1d978310a1684ebdac6275eb593b4d19e51998a5ebf2644e701d36d82e16b4b0947389ba082549dad
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\DawnGraphiteCache\index
Size 256KB
SHA256 4d4612d8e06c827ea4a0d8232b6f2a4b177edb1f74b3e8a5b0146ca230049bfd
MD5 7a529f7373443183a62d5569a11a53e0
SHA1 23c6760b2144084034b8ef9178c9f94d8626daf4
SHA512 e4e2675d220ae8e250e5db3c4bbf807623541cf9c9b4e323b72a8e14e02512c8970131cab2a663058e9a630b2aee702fc10000668a83744056a60d67830caf7f
SSDEEP 3:LstlNllklkXlEN/t:LsX3lPEN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\DawnWebGPUCache\index
Size 256KB
SHA256 991f764dcf023c458338e994221fc25f221ed6551576447123c3a2f9bbe29ef8
MD5 e52083c993c5c9c9d9de9f373c862566
SHA1 e7a9206ed1915ee2230285827981a3e2d2d4af5d
SHA512 50647b2555649090bb278b980110f18bea609cd7423e5c709b409afc066d76425cca6581a339c80bd5315c908fcc155778021a20e88ed68695040c8d5cc684eb
SSDEEP 3:LstlNllklkXlmHllt:LsX3lP2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2ohqxmwj.q4i\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jewelry.pif

Path C:\Users\Admin\AppData\Local\Temp\471680\Jewelry.pif
Size 1.1MB
SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
MD5 7ac9278876c83c9b597fae68acb6fbf9
SHA1 18150c9b96bffd20c8203ff98a4fc153929bc2c9
SHA512 ddcedf90c53c148d85e36e039fc25712e242e9256ea8791d6cc15bb862b6b85a19a5583b5554f1afda9406affc4e953c4f8a2ddad6fe4d959a9fd5395dc870ee
SSDEEP 24576:r2XJHqX/Rr2YU9EPqYlsgSsJbD1tiP4+kUrp5B:yZql2nuxlRV1t1YrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\471680\RegAsm.exe
Size 63KB
SHA256 1136010a4706295f80343fe364d90d5789288dead5ab0ed0e0981d29ad669bbc
MD5 15d0f3abfb5a3e38e83ea61a082ef934
SHA1 9ff4a64e44efdcd088dfe489466ed612fff1ef55
SHA512 b33aa91069382a2f57275fbae3cd94bf477c13ab263ee07a94422da9bc3d43513df4016449d103953d87ca672ba9e5f83d854d17e9228e865f5c1753466eea5b
SSDEEP 768:D8XcJiMjm2ieHFYPyCsSuJbn8dBhF+iSMH6Iq8ASYDKcagxW6l:PYMaNyFYPYSAb8dBndH+lDKcaL6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\471680\f
Size 1.2MB
SHA256 6082a2b5abd480fe40eb11add3cb54cc389d028ab78d4069254cbcab7ebf27dd
MD5 a6aa955784b84cabb3501bb375f08eb4
SHA1 47c849a6ca2738e4e91ba3fa32f5da4512793512
SHA512 b8103d561bc590869f48cec2bfede548ec4c7316f7be90f5f5b272e1434628f9e83098bdb88be0a8578f63e3939533f3c711af93f2dac81ad1db1892648685e4
SSDEEP 24576:C9umhBXCY701LvSt6sY6e16bcfXTuZ2jkr8MFSHy8Z1gHg2RCylCiDY6GaJ:ASI0KtnveAGMEkr82SS8bQl7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accessed

Path C:\Users\Admin\AppData\Local\Temp\Accessed
Size 405B
SHA256 0db925cd11829e5e4bee8628ee119f962036fb58b3437957221a8e5fc64e3cec
MD5 a40e3d5d13a7c5f1bf018f4ef4f5b34a
SHA1 5b036c1522d16bc9e858377518a261d79e76fb0a
SHA512 510199b0cb412bcc8d7317bd9a3111407c1c7b30b571883761d9307f8835ecb7a187cd5f52fa9ef1da28f0f414d44de88674016e167119cc692abccbd73a09d2
MD5 SHA1 SHA512

Submit Download

Atmosphere.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Atmosphere.vsdx
Size 533KB
SHA256 819e36604e5550bb0fc7025667f1f9fd1e18e87862627f18b7f23b401a310b0f
MD5 3648ef7a2eb809ddf1ce3916af06a132
SHA1 af4df2f760c0cddd1c758c76408f3c28c84f9970
SHA512 61dbb7fe33f76b7ab14a0fc7e7462bc78b5b5ed4c3d0d293a9591ce0150bbbc3daf2e6e558704f657627c3209c8b704094800991c31c7e6b35e2f30e60ff065d
SSDEEP 12288:xWIVexiUan3uSowHllPEyrHcoZjs0yviL:xpVuiUaeiln20bL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Calgary

Path C:\Users\Admin\AppData\Local\Temp\Calgary
Size 131KB
SHA256 c472d46e978b0722ae864f7a66a8bfa1ecaeddb53af2bddc293a714c2037cc23
MD5 8a6fbe74115b2930511841451e9f00fe
SHA1 984528e8ecb52fcce7a5fb54cb2a9f69b619e6da
SHA512 8599019dbf7ac1e1022255d587067464bf88824ad2bb85a28ed51bd3410ec46256811c74080429bca35593f0606f94f0857f253c65e36f3d407f8fce90e5e802
SSDEEP 3072:N36sVtT6H04k5h6m/Fy0UhMsqu5OonZkFNrsjeiw:t6snrZ/FfUhMsqu53mFxsjeiw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Centers

Path C:\Users\Admin\AppData\Local\Temp\Centers
Size 127KB
SHA256 f0e3125db75399342a83e76b91103451a67c2c6fabe6f1103a7470c0daf6d919
MD5 e8376f02fcf285ff6d267f8eeea31705
SHA1 6b52639c4ec373d444c5874cad48814c7ed880cb
SHA512 e1a3e516f95bae3e4bd6ccc791b47e43a8789fe7dcdf43b4ab9a4e960a42df174d25b3eb23b80092be5ed73d98f853a99eb47d107ac3dabe0b9df75bc47b1806
SSDEEP 1536:R1iNBTCUXIH42r7snyuXG5egqzIU15AG73prFCtNwFqGqUqHHM/cZ+nVzM:7iBZ4trwnNX51zt2wQGq/hoVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Eh
Size 110KB
SHA256 3ee22a06321c6369a2b502c67646eacb58bec2306189c7c53edcb48468c91aae
MD5 22f7b01c610232458f9e36c8963f1065
SHA1 bddd5b57a2603455a2901bcb3ec4805d38a49768
SHA512 14ec31a4ce009e46399cf9acf6c1d376152cb9812f6051dd927db9c08dd31a7e7d0f04d3c9f764ce31455ccc48afbeee62157beb0d675694d80a8d4b86e630c4
SSDEEP 3072:ZRMsKz50/0DIPEXbeTjDiNyWEfGxciSvbDb4w8:ZRS505EXoiNy8xciSzn4w8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emily.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Emily.vsdx
Size 219KB
SHA256 ca8d6afb89daae43de486a9eadceb89213da61659c144833778d7135d42b80ec
MD5 cfab8e128a6b57a37ac057aaf87ec04a
SHA1 78ce87cc9a6897514c14ddc24ead60d0ba5038c1
SHA512 60309732736e4871ee0686254315e0510d02f6c5c7353dee43239ab3ab5bc444a2d811fb56418c30d619b3834624c991818432b98c6698b89c93c3e5b77ba1f7
SSDEEP 6144:S+bRWJj7vdGIHT7GfZVQjB0pCGzQMVKQr8qZui8p:S+bcfXTuZ2jI+ir8gui8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Exception

Path C:\Users\Admin\AppData\Local\Temp\Exception
Size 56KB
SHA256 2620694dd68ce37e0f3635be022b34dc0b1b2eb24db5b3c30520787283d1ee4c
MD5 2443cd8773b0718847895f4c5130d7d9
SHA1 cde911724c458139ed42ca418471412e740a6427
SHA512 405e6ddca2de93c5ef363b94ac82487068dd14ede3832bf0eb693ecba30b3d7ff76aacef2ace45cd0268e180911c0302be7bd11b3d4b4cd78316bdf27415b36f
SSDEEP 384:yXoSpu88888888888888888888888888888zv888888NfU84444QnooooooooooL:yx/Sm1fI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Footwear

Path C:\Users\Admin\AppData\Local\Temp\Footwear
Size 145KB
SHA256 6d25c1b0db2b0dfb7e100cffb41feb59221a02c7137bb6093848f423bc41a180
MD5 d23e431aa6859f9a6191b32d4d6bddfd
SHA1 856b08c060b13611a24e33b94c7a74fedf8e6b8b
SHA512 a91bfdd4e25a0f41ef3324b44a13b291ee1f950c604c90ec1944036cb134f8c9d1e836d3a8c83abe7f5f1a2402ff28457aadf209e897d1ab2bac0d8545bfcfa9
SSDEEP 3072:lzxsPR1yciPWprowM3Qm23DjOH4IoVcfIHaAtri:xiPDviPWprowbzxIoyIHddi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hash.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Hash.vsdx
Size 28KB
SHA256 6eb4ed45d1cd7c0747e7bec09425c347b9deb0f831ffa62a69d084ac4da58697
MD5 120d5103199290a8b075f86f6fa423a6
SHA1 1747a46f63359184128a6fa929a2997951586b60
SHA512 997a2ff8ecb878e799b249607d365958c06ea27317288bdee6110637dad72d7333e94dcb26dee12d91f4e894a253432e93ed370177dc93eaf763f5581eae52ff
SSDEEP 768:qaXNmMhd6ytl8rKTxmQgEJTqlVjUxj3Nx87uu:z9VAsTQQg9wxj3NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Highland

Path C:\Users\Admin\AppData\Local\Temp\Highland
Size 73KB
SHA256 d8bebe65ed8106cd2c18dcbd120c6ce0ca0e3f0ba3e43fb3adaa9785cc2cc8e2
MD5 a32fe555134dc9187a13a17f00d3e276
SHA1 d11fa6b6a0b2784fcefdaf92aa6f9a38261a9dc2
SHA512 5058b46183240e0cb929e6c40e91128cddce3626db104288b9a543cabb860abe9c817d5f5446a203aaec8a0e56f8e9f91ccd92571f2231dfd306cef1e637179e
SSDEEP 768:i3T3Xr63EYr8qcDP8WBosd0bHazf0Tye4Ur2+9Bkk2TalOSVWV9+k:inr63EYrDWyu0uZo2+9B4u0SQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Latter.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Latter.vsdx
Size 167KB
SHA256 862dcf739fd5453a5584d021b73faff607037054308a7f4e37b956626e2a5242
MD5 0c5ee23ef98345d3c81bcae1d9b20faf
SHA1 1454b241e0062666110897790979cf3841676520
SHA512 2afe303c6640318e096f2c3deab07f2ca62ff615f31f2dd8c09fdab0e04caa17f3e52dd80d89c8f20f9b4bd9d03122f87b7daac34b55da3c8792df4279dc4fab
SSDEEP 3072:1e2Iw2nRS0VNGUzcqlN37sxiNeZU36JTdI64457yHHEPnRbSN:1e2Iwog0VkUwqlNLsxiN76tdlf57yHkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Licence.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Licence.vsdx
Size 287KB
SHA256 81a327e5a80f4ca2170b95f18a14b7e0e95e754785f64a39f977f9985582fbc6
MD5 8851737f0cc04239cda93ae36872993c
SHA1 5b39e98235adc90ac552a4408712137a5e86493c
SHA512 f56e7d79eab1018fb8c7033228309474e5af632d98586174d6025d38959ce85b8aff72858a3fba46ee8d7e80d8c1663ec9525ed7392dc5e05c5a0a138a861f7f
SSDEEP 6144:Cr3RKdHGhrF0St9yF9ayk8slhNg/MLh3JnvnwZk1u17xn4gNNhGThO8:CrBumhr1U0F8YL15vnwZ117NHjhwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Meant

Path C:\Users\Admin\AppData\Local\Temp\Meant
Size 114KB
SHA256 a27aba7030721814e2d3d8fa08fac3b0788a04173148cfd6d564e1b1cceeabc0
MD5 7d4c057994d5fea4333035d73f75412b
SHA1 034a633617f2607f9c0138e5245eb442e54abcc2
SHA512 7a9996b7fd6978794352ea7e495d4e6b9e27a3cb6b03f6d53c6aa81f4194033e7c2aa4659482c6cd2e737f0ac0ca63ca1e57a4de89321b8f48378c7472d45a4b
SSDEEP 1536:lvMp6EDRYJ7kIz8DkgIhPkN9KnmT1cg3ZDctGbKBXkWj4upDK9q4Dw3c61RG31M:6lsgIhs3kmTmwZDgGbDHVAc6jG31M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Montreal

Path C:\Users\Admin\AppData\Local\Temp\Montreal
Size 125KB
SHA256 941f5dd83c1aa71ff2540086c19504c79d7681c9211278de32645e8a3f31940e
MD5 7ef8a6d3bf8d0b6e959b13f0291fba46
SHA1 70cc95b80f79e12a6fff7b20aeaf90ed924ea87b
SHA512 43fe406603cde6a1da37b91f5eba9863135dcc69fc006a82aba9a3c1cbceac3ff6a52c8857396df4caac983f18634ac3b7c54e08ffddf29b6086d4ba159029be
SSDEEP 3072:OgNkSXF/U8QCgh+qLzxc9TvNU7DYrVUhijUvlg5:HkSXFsczqkC7aVUaUvi5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Outer.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Outer.vsdx
Size 75KB
SHA256 6758c76bf8373c23e9525014b74ff699daa4f77ad8d434a950f6df7de279f5e5
MD5 6dc0ffc6e1825003e90eb6d77fe43c05
SHA1 3b4616ece5386e49ac7c2342a935d5f6bc216a26
SHA512 c6fd6b13e19adc2a470a40b8fa6ffc6a30f06a95b76f0872a6838c9b8748ff28612936513e8b4ed5860b71d5f1bfe6fbfb31fec6eefe0f83b21d7c4cc79c61fd
SSDEEP 1536:biB5ezAz8XBEqiNcBQE2kY+D+mVoiiuhg99Luan8uga:biBVz8Ni9E7VUuU38Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reading

Path C:\Users\Admin\AppData\Local\Temp\Reading
Size 87KB
SHA256 f75beff8826deaae9f963d79ca669d8a91a794e7e6dd5693d80d6cd9d78436a2
MD5 eb90a67256866f9cf94351131101c24a
SHA1 4868f8d1f7e4fc70ff26d128d997cc628ab045b1
SHA512 394d780e84c1fd1ce2ab685bb6be28a289cb2974c9dfbbcbb6f98b8832fe81d624102363f8f5806d4b17342734570d0385e38ad77983cf0961d1b593275beccc
SSDEEP 1536:J/29GTnb+aTOpA0KOWZ59Dqd2LoanG5Yh+f863I5DypFOlJL4x7KBgtIZnsjAZNF:JKenii0yD1LoanUveooL4x7KBgtEnsja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scott

Path C:\Users\Admin\AppData\Local\Temp\Scott
Size 113KB
SHA256 ff6212d7ccc5d9d48762d8edb28b1a45a0c7e1d660c7958d8ce70e12f6398b9c
MD5 e1a8f8a0f670f1ea341232e078b35f66
SHA1 4e6799bdfb02daef8cad21e9a106da40906ecddf
SHA512 94b161bc016bd19d4d9e65c2819f37df41a53e7e3dcbc3b3fc4c761170ff71255c9601f1cdb04ae54bf3732341ac1651af51a94264975e8723eb96773679d17f
SSDEEP 1536:46j6rs84dvTcAXjKd1bS1wwQOchO+534IY1GsTrkerRIb+cgbrnoZwB:B6uId1bvhOYSQurhrRIb+c2oZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shared.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Shared.vsdx
Size 292KB
SHA256 bc6383b2458856bda10e489ccf4aff40b42684dcf1bb895e528113a41a645e66
MD5 358ebfeecdcbd3316aef52f32fbbc0ae
SHA1 57140f13563c329c11a1e0362ba26726e36523ba
SHA512 c53d709119e4e6e5e2ef6db7e89f2503e117b86451cf19f8e33d4fbe589441a99195b9fdcc214c819d30388e07667df69c005add33b3504f79375b894dfb6f82
SSDEEP 6144:bUed1qysCQGJBQKVejuSYATGOI7ilEXhPxPvB1dtUGTjIjHk103LVAT4KFi:4CqysCQGJBulT27WExVZ1gGQjE1+Bi4T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tube.vsdx

Path C:\Users\Admin\AppData\Local\Temp\Tube.vsdx
Size 188KB
SHA256 9a0a0bcaabd8af4c46dced80ad3523358298b07b9d6fa0e1590f39b4d68097c9
MD5 616c5606664a88df3d47cdc4a67a0cc2
SHA1 71bd90287592d092e0780c9d10974490832a88d6
SHA512 e0d4b616bc3699ac7f7fec0ade2ed8455b780924a57586c67b475f6988e95ab9f914c708078ff1c6f139a59b27eaf46847e1e7402e995d354b961640df2cf8cd
SSDEEP 3072:uTqeqCBMOaL7Q5DVRl3eXhrNZ8JExoN7cfnYZDeAuJCPiJG4F3Rx5Id9Z5Zj/eCw:uWGaL74RNeXhrNZ8JE6N7inYUdYQRkd2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn9935.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1ED1.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1ED1.tmp
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3320-150-0x0000023B14430000-0x0000023B14454000-memory.dmp

Download

memory/4080-86-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4080-91-0x00000231C1360000-0x00000231C13D6000-memory.dmp

Download

memory/4080-92-0x00000231C13E0000-0x00000231C1430000-memory.dmp

Download

memory/4080-89-0x00000231C1530000-0x00000231C16F2000-memory.dmp

Download

memory/4080-93-0x00000231C1C30000-0x00000231C2158000-memory.dmp

Download

memory/4080-94-0x00000231A89C0000-0x00000231A89DE000-memory.dmp

Download

memory/4080-90-0x00000231A8960000-0x00000231A896A000-memory.dmp

Download

memory/4080-288-0x00000231C1A50000-0x00000231C1A62000-memory.dmp

Download

memory/4080-289-0x00000231C1AE0000-0x00000231C1B1C000-memory.dmp

Download

memory/4080-95-0x00000231C1200000-0x00000231C1224000-memory.dmp

Download