Analysis
- max time kernel
150s - max time network
184s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/01/2026, 02:53
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260130-en
windows11-21h2-x64
28 signatures
150 seconds
General
- Target file.exe
- Size 5.9MB
- Sample260130-ddkrzaew4e
- SHA256 4d95e661c6160b85f4320c21d44da333b97ba485f2969015c93cba9e81cdfc82
- MD5 4af5af6fed218c5cc4e2c8ddbdd4432e
- SHA1 dcf896658bea041c32dcac68c11095f2f44f051a
- SHA512 5bdf6c157505a67035e853279f054ef28664e4647108df7902d93d79810570796d3ed1e8c38a39415da5d3ae0f0e81fa887e3c545cf722401c8113fa031f45ff
- SSDEEP 98304:db5bc59tLCXk3M+goM5BU5bIvCbdCA3aWqsf99O+RB7FW6pzQdbl3Z+lqLxjX:dNwLCOKo5QY9q3+Rf9Gdb0qLxj
- TLSH T1FC563343B7C74476E8BD7E32C838C020CC2569782BE6B42B3DF9D69D46326D95972392
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\WriterManager
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b475-37.dat family_hijackloader - HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Hijackloader family
- Executes dropped EXE 2 IoCs
pid Process 2084 file.tmp 1344 NavGrid.exe - Loads dropped DLL 3 IoCs
pid Process 1344 NavGrid.exe 1552 VectorShar.exe 3876 Crisp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1552 set thread context of 2104 1552 VectorShar.exe 85 PID 1344 set thread context of 3876 1344 NavGrid.exe 90 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ps.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt VectorShar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt VectorShar.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt VectorShar.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\readme.txt VectorShar.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt VectorShar.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt VectorShar.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt VectorShar.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt VectorShar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt VectorShar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt VectorShar.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt VectorShar.exe File opened for modification C:\Program Files\Java\jre-1.8\README.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt VectorShar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt VectorShar.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt VectorShar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt VectorShar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt VectorShar.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt VectorShar.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe File created C:\Windows\Tasks\coreapi_lts.job Crisp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VectorShar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crisp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NavGrid.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2656 chrome.exe 1880 chrome.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/1064-0-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral2/memory/1064-43-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral2/memory/1064-139-0x0000000000400000-0x0000000000428000-memory.dmp innosetup - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1552 VectorShar.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1344 NavGrid.exe 1344 NavGrid.exe 1344 NavGrid.exe 1344 NavGrid.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 2104 chrome.exe 2104 chrome.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 1552 VectorShar.exe 3876 Crisp.exe 3876 Crisp.exe 2104 chrome.exe 2104 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1552 VectorShar.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1344 NavGrid.exe 1552 VectorShar.exe 1344 NavGrid.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1552 VectorShar.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeDebugPrivilege 1552 VectorShar.exe Token: SeDebugPrivilege 1552 VectorShar.exe Token: SeDebugPrivilege 1552 VectorShar.exe Token: SeDebugPrivilege 1552 VectorShar.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe Token: SeCreatePagefilePrivilege 2104 chrome.exe Token: SeShutdownPrivilege 2104 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe 2104 chrome.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2084 1064 file.exe 80 PID 2084 wrote to memory of 1344 2084 file.tmp 81 PID 1344 wrote to memory of 1552 1344 NavGrid.exe 82 PID 1344 wrote to memory of 1552 1344 NavGrid.exe 82 PID 1344 wrote to memory of 1552 1344 NavGrid.exe 82 PID 2104 wrote to memory of 2260 2104 chrome.exe 86 PID 2104 wrote to memory of 1752 2104 chrome.exe 87 PID 2104 wrote to memory of 1752 2104 chrome.exe 87 PID 2104 wrote to memory of 2656 2104 chrome.exe 88 PID 1344 wrote to memory of 3876 1344 NavGrid.exe 90 PID 2104 wrote to memory of 4800 2104 chrome.exe 91 PID 2104 wrote to memory of 4800 2104 chrome.exe 91 PID 2104 wrote to memory of 2212 2104 chrome.exe 92 PID 2104 wrote to memory of 2212 2104 chrome.exe 92 PID 2104 wrote to memory of 1644 2104 chrome.exe 93 PID 2104 wrote to memory of 1644 2104 chrome.exe 93 PID 2104 wrote to memory of 3016 2104 chrome.exe 94 PID 2104 wrote to memory of 3016 2104 chrome.exe 94 PID 2104 wrote to memory of 4360 2104 chrome.exe 95 PID 2104 wrote to memory of 4360 2104 chrome.exe 95 PID 2104 wrote to memory of 1436 2104 chrome.exe 96 PID 1344 wrote to memory of 3876 1344 NavGrid.exe 90 PID 2104 wrote to memory of 1840 2104 chrome.exe 100 PID 2104 wrote to memory of 4568 2104 chrome.exe 101 PID 2104 wrote to memory of 652 2104 chrome.exe 102 PID 2104 wrote to memory of 1880 2104 chrome.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\is-PH73C.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-PH73C.tmp\file.tmp" /SL5="$50264,5829781,121344,C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\is-A1HR8.tmp\NavGrid.exe"C:\Users\Admin\AppData\Local\Temp\is-A1HR8.tmp\NavGrid.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\ProgramData\VectorShar.exeC:\ProgramData\VectorShar.exe4⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Users\Admin\AppData\Roaming\WriterManager\Crisp.exeC:\Users\Admin\AppData\Roaming\WriterManager\Crisp.exe4⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵PID:664
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84a58c728,0x7ff84a58c734,0x7ff84a58c7402⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,8370906477901338389,9501864129290559606,262144 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,1596576750922238326,13045251735647284680,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2240 /prefetch:112⤵
- System Time Discovery
PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,14215147697362519583,619952461760946028,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2508 /prefetch:132⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,4547085629423634255,12497364992928997897,2097152 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,5056142326614119405,4746129830161955647,2097152 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,1524341133647341511,17240553416687008909,2097152 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4372 /prefetch:92⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,9914984602722576002,4218697245832280755,2097152 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,17340389219027080300,1875555038868500528,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5376 /prefetch:142⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,15922480970544885491,3430517861281352253,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5728 /prefetch:142⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,3022027562774254494,9737563218977708278,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5684 /prefetch:142⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,7841041351425520493,11268404301060102744,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5776 /prefetch:142⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,16056082470541246632,9185144443712061103,524288 --field-trial-handle=1948,i,9022346735774781100,11499932145008506741,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:112⤵
- System Time Discovery
PID:1880
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4440
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4124
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\VectorShar.exe
- Size 1.7MB
- SHA256 1dade02f4d36d483a918a455fad19dcf2f6ba993ad33bf8cac75184d5713ceda
- MD5 f791b56733b56b97132351f7deda4297
- SHA1 5528a47c2214a827e0f68ee564b789759eba81a1
- SHA512 fffc7b5cfb863c425403f8d2711bc27f4fce31d274837464b9b7a3047df25e2daaf453359b6efd118614faa926fdddd4800d5c932ff61d7c443f3ca4a5119cc8
- SSDEEP 24576:yL3450FtfMqXPGezr5n0cnrYKMHnM+s/qzUBUO2FdAEY7VN+:CZtUqfHB0cn8hBsuUBdUAC
- TLSH T186854D01A642D23AF9F315F7CAFE966D9638A660171950C393C81C7E9F21AF27D3124B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 fb43f0ec8f04e0a8c359a92e05463c556d90e2c5d04fee503e276ff33e8b34fe
- MD5 d4085e74dffd001bbc5b7e6944c80a43
- SHA1 788a4666cac0db7b9db6e5c68d66c91b31564d79
- SHA512 8531428956fc51efe89eafc53e6821ccab9337cf6219042b705ad52ff94090757330d953ef465091a88a0452d2393dd6e036277f90622ca3e570f8e85845492f
- TLSH T113E0E5AAD821A83709F90B19501087C5E700035B6640859B373C820D4FF1A6B46A582C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
- Size 44KB
- SHA256 866083c7d69a3ea03ed5596e3469db62f6b5a7e4119b2efaf999a7a9e28c821d
- MD5 648f5a4a092dcec2c6bd68eeda884ec2
- SHA1 6b4773ca8999d2e185e644f87df8b3f52f5c9256
- SHA512 85064b0ea7d487301c78d005b631b214742fb3fd5d8ab549ad0302b3903a774a8d13bd9f6db3094f58d9497ed22a054a3564cd3f46cb39de7f8a03886010ac25
- SSDEEP 6:/FMe2FIrJorokoroFwjqi+0AHuuNEX/RE22ZmkllRV0OKa3/lOKllpllmtsOLqyt:dMXOrJ8VRu/5EB/RmOJdOKllgky
- TLSH T16113866E6A4C2F4BC6CD40BD203B7BB183F5D8459EDD85974071B43AF483B09354EA44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
- Size 264KB
- SHA256 294f6bdfbcb1b3abbd72edf5387de746cad5a0b4506d4cab333d9d55809dd6a4
- MD5 468c9c933fb09e87feaeece746fa5b68
- SHA1 bd04eabc7f8d8ca74e8fac481e0cd3f9b4c52c21
- SHA512 8ddee5f938456c6a71dcf1bde8989b3c0520d77e90371c834a5cc32817041f56fcb1fbf0d111a9a0b251663d036b56b6322520fcdc0967f899dd54669b0114b1
- SSDEEP 96:Ubyspm/gloWDWMaBF0sPDqSCyO3jWWiVOLHKWol:UbyNCFsN343fiScl
- TLSH T18144B6F71915EDC7FA28CFB11C505238CD325A262D95FD77F27844A2424A6F33228BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
- Size 4.0MB
- SHA256 c89f4332ba99df00c9063c9c895339526fee5d9a5a4f7b17b3b80976a97eab02
- MD5 9637a3cabd3a2d448e8980b91d404c51
- SHA1 aa0351c0a9249684113aa5cf34ff3535cd242c77
- SHA512 566e4230656b9cf8cdf0be33ad77ccd4beb003d36d94a8b7f692234b285f3dda56819aa41697445a4f0b5be36cea4a7699dfc68c3af96b8fe1b96a168294b207
- SSDEEP 768:j4SUfDPLSgcRUv+TZ4EUfDPLSgcRUv+qZ45U47A43F4iL04vfDPLSgcRUv+iZ4Xk:jpZOZrxYk2ZRqZ
- TLSH T12C163BE70F64B543EA85EBB0BBCDEC187C702296EC979882E122927D45F1FC41B4519D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
- Size 36KB
- SHA256 479b90628eb340b6e024d76ee2a02fe820028bf5664425e079b37137f526ee33
- MD5 fe1bc7c7d542165dd4eed3d8e79841f0
- SHA1 78a44c91aa824aab19d00b114bbcedfebd00952c
- SHA512 61ff4e6c844b9b03bc3d0c8105699d5947c2a1ecfaa64ed526a17b90da3e52368282dc8fcb920885822de659306ed1df58bdfa7edea2a19a60e777c6b90747f7
- SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBLRH:OIEumQv8m1ccnvS6jRD
- TLSH T12FF20FFF1B05B601C0E491B4E5810ECFFD6D112D4B9ABED0AA9809F357C66F39538259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b99f4f43ef2ae91ba8cf82a549e87633db34aa946614b1efa265296539e5863d
- MD5 4322e57a52f30c6711a7e03b391ccb38
- SHA1 b32e5921a4b9d060eda434d7e1ff018941a79a1f
- SHA512 912331b5934e7ddd00633e7e1e662c7d4a2401ee0dd8dd9595591805672b7e16155cdbd5789ec1b93cad66cca851ad4b4236116312375585aab703d6d7126723
- SSDEEP 192:gRpNJuB+gbhrv7dpAPRp2d9ZHsb+WNnfkW5dCR+VyIsnAUgtaJ:gRjJuBbTpUXGHw8WmR28
- TLSH T1E232822EA928753B4CCBD21AF925B757E7F1102161942E88D7F8CA2C04E7DCD721742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
- MD5 6c2a084e9725415d6e6f241570b51988
- SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
- SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
- SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
- TLSH T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 f1ff8f246b3babff6862c508164690e90eaf53ea303c38e0a18bae399cb4a676
- MD5 71122c8df68966c6791e6f117704a9d5
- SHA1 95c391c8a6be0b98e61962342bbc21ebc215fa43
- SHA512 1852f6e2c406a06b3ef77280999f395195b2ef0d94127a864b914a3287c3a3a73213b6e2e0cfd63b6121f5d556e6347ed786fcd8f96843eee34e6d8326939e84
- TLSH T1D9B012A1C4017D12C00303F4119A54A83124AF10AB09170957F06DB1D83A1D14024151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5917d4.TMP
- Size 96B
- SHA256 8999dd7f80b45eacfb65d75892b2eec0fc07b41fd4af9962f42619acc12f0793
- MD5 7912c17d1bae2f36a547d1f9814f77c3
- SHA1 438badcd5b21fc6fa4b9ff2f09696d5e3b163151
- SHA512 47e6f78569abde7e3423cfa1f9311a1d9555ba98511d322d660a71c8a918a92bdcc334263695bad7cf5a97297498dec0ee26b279e65db1e2a23afba3a3d52531
- TLSH T15EB02208C0022222E00203F038A8A0CC30A0EF20C383020282E00AE3CC222A00038A20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 5be2569498a1a19e311cda724c3a79d610bceb80783d23edec36aab74b3b1b40
- MD5 32a25230b2e3ddc2cd88a966d3bb6bc0
- SHA1 61bc9ab851f19692967ef4bbcfa70de7b3a08b93
- SHA512 3e7af25c438709fdd5473bec0636c75b7ce991beb7b535df448bd82aadb2cc894cf8fa5dc6f23cf2c965ce515db8461e8f4b95239240619a9812000356359095
- SSDEEP 1536:aExmPP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNU:pC++J3qUQm08KMWF0bFTcVHr6zp
- TLSH T1439301B99D1E7C79236BD29690079CAD8CE3DCCE1114157C31C3AF0E04EA393A31B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 92KB
- SHA256 c949d578df9a231afca386eedea7f37879b66b1f73d52689f17c4b2d9bee3c85
- MD5 470025043c89a153e613b06627dadf83
- SHA1 8b8ec4bab308e0842b55a353d688e06e99a0d039
- SHA512 f0fe7bee9d343d401a47856f521079fbae0e67ed922c42357225b8658718ead23a6aa92689646c4e3922ac85d4da8b434ae5e6e7020dfddbb24707b957a64fd2
- SSDEEP 1536:ai4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNU:re++J3qUQm08KMWF0bFTcVHr6zp
- TLSH T11A9302BD9C1A3C7553AB859A9007AC6D4CE3DDCF5518447C308A7F0E14AE3A2AB0B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 499bd995ede4b4babd5a1354f630410db40710c731f6617d9f2b623de92a7579
- MD5 037daa504e9babbd3ee7d8eb1eccb33d
- SHA1 f1637db2964fed81d1a0d9bc49cbf105eaa0ed94
- SHA512 c16f458e8ea3c09efc2afb20e96262ac728e16ce143b03481ee7715d95308b993f4092ec1980b40152bcd0655e6a41ae4640613bac87db619312baa1eb1d5e80
- SSDEEP 1536:lhP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:7++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1189302BD991E7C79536BC696A0079DAC8CD3DCCD111851BC31C76F0E14BA3A3A31B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 b858728fd734d322475dcb5102a9b24143c348f4d500ad413b6e98a822702d7e
- MD5 dd8d7d6089e4c47ddabe3389c36a388f
- SHA1 5b4c389a3249bb848fadafe34b935b4df3e212db
- SHA512 09fc4ad853676c1d9012efdd7d3278ff4af3a9977407570b7f2c8f0883cca3bd705d2ae418c8383f977e250efcefd201007aa47e6f12f736614fa68c2fd11876
- SSDEEP 1536:NExmPP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNU:wC++J3qUQm08KMWF0bFTcVHr6zp
- TLSH T15A9301B99D1E7C79236BC29690079DAD8CE3DCCE1514157C31C7AF0E04EA393A31B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\D0E3553.tmp
- Size 6.2MB
- SHA256 636420c0b8b57b933d3dbae347eb6dc83ec74ff5b56d27b5df59c6cf9232981a
- MD5 5efc36e72b6ba0c933329ceb96695605
- SHA1 f3d1bb5d5f9cdb69eccb377e4696bcaff77f30cb
- SHA512 f66b50534d1d8934b2588dc92b3d05ea3a8bbe1af3bb39d920e4a136c29580336c8e9be88765668dee0f5f4f74053c48dbf51dda5676b8bf59e1523fd3350b2d
- SSDEEP 98304:D/QG2hk05iH/EO1KPy782LVF74Zi0udZkS3hx2wP69U27UMk5B/m5ZQ:D/QPNPygI4o0gW8hx2NAMkf/IW
- TLSH T179563322B2425F5A665FCBFA777083A6CB502370E502D26EC19949CB861D0FAF5309F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\D0E3553.tmp
- Size 6.2MB
- SHA256 56b99bf55f85edb3e5c6fe1f245c27fa648c5788b22292312fbe06cca21eab40
- MD5 df725c2c4cb15af3ecef643563b4b971
- SHA1 f1cb5daae3370bd85c89c715b2a48d0bddc11d56
- SHA512 f63fb76e0167e2b4c4b1ee88a31f586d65b02eb025c7ee522bf5c0adb02b20369a4c3cd817c65029e6e42409429b5d538ccd38c594e35a5e819b74d763610daa
- SSDEEP 98304:X/QX2hk05iH/EO1KPy782LVF74Zi0udZkS3hx2wP69U27UMk5B/m5ZQ:X/QyNPygI4o0gW8hx2NAMkf/IW
- TLSH T1C2563322B2425F5A665FCBFA777083A6CB502370E502D26EC19949CB861D0FAF5309F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\G8ZcO.7z
- Size 6KB
- SHA256 09c6f1784fc8cd03b85061d89c9462c4b08ca2b8bc945b5ee935216868dfc27c
- MD5 d437e9838b2d32d26943ad6c48cec88e
- SHA1 015b0ecea37b1130db05bc52f92fe15bdb5c6484
- SHA512 598e778a98427529b3678ae3f1cb2af5d69838f6aff099b97b19a098b16d006491e37ef872429a947ffbbd3af5b12c619d0d80efe6e53b65f9fa854061587b85
- SSDEEP 96:Wgo0CHKiM9w4WALo3hL/0amlCNiHT21fRRC0kIdD4uwCHqIae+5KwC0kxCrL:hCHKi1K6hL/0auHT2dLCE94eaZ5Kiv
- TLSH T147E18D1581C26ED78E8B939F76653412222BB21E88C03FAC5954F46E899BC3F9C3D45A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-A1HR8.tmp\ExceptionHandler.dll
- Size 128KB
- SHA256 3b0f1581ea7f69d17460e3e698ba05876617437352dc8fdc8d633c42892c1553
- MD5 05ea79d834f6f0924ae573a1276f0e86
- SHA1 78c8b8066124ede98b61e5d3fc78e472ade7bb2d
- SHA512 c7c0f300b0975eefacaba08a4e9f8f6c85c595993e6540e9a7243b2300a1a65e53e89bc2a761c4ecc680f5df64c1702437b5785fa67c5c08a2792f849f452e4e
- SSDEEP 1536:xeLbWzby5i5ZqygSH9JFXHSFUNNRcZZh6mCcTSkb0EYsKK93BFZ2nQ+5e+b7:cv+iNRSH9JFCsInjWK9RFZB+5e+b7
- TLSH T1D7D38D21B250C0B2C4CF663D4466C7655B7FB5358B658ACBB7580B7ABE203D09B3A347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-A1HR8.tmp\NavGrid.exe
- Size 119KB
- SHA256 daef1f11e3ef895923191a21bb1d9e4652a0568aa2651c97033ab9d3be9ddb10
- MD5 bca13825411049cf5b942ba2decb9192
- SHA1 ddd26f1754ae44b8f194ecf963abf8e5436d83f3
- SHA512 c00dc2a4b242912da40a052e7ee0b45bfc5fdb62d712201a39dfc623b187f4c5a93cfde21ee7b85a54c5bdb56fc0021ef3110197ad1ba193e5ded1533876ea87
- SSDEEP 1536:IBnZOvLKSCNIoaT4AhbcfkdOpLbdTqBiLDnlxZksXoEU8+scVvoa76Kw87ZsP:EOvLU63RSLbRjlgEU8+sqvoaR9y
- TLSH T1AEC39D11B890C873C417593558A4E7A69E3DF6224BB089C7F35C4B7E9F203C19B7A2DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-A1HR8.tmp\Thongshootplieg.zh
- Size 9KB
- SHA256 c9e70912a5b73ea44b13a3b00ac81696bf4f0398ecca0fbf27ed9b12626302cd
- MD5 9d26d235264bb21f84c15e71a1097f06
- SHA1 0a7fda9909ba806e9ac61a6d308ba69fa1cd2023
- SHA512 55fc0ce4415b346f9fe0559987fdd8ccb32ee5062a0c245433b6b482fa7722fe93e86056e151d999b5f81b347e8b061b29c4ed4c861663eb1ce0a1be7964858b
- SSDEEP 192:52IDgBc4JOxPMhVroMBb+PN5WdeKpvjH89OfKmpkF1SQZMg:kID2T/Vr95+PyewzTpQ1pMg
- TLSH T10512395D5DAE57182CCAA4FDB6F0DBAFA1F47A3E2B9410C115A964152973A0CC203C9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-A1HR8.tmp\Wailhaingshaeck.ia
- Size 5.2MB
- SHA256 fe094ebb875f1b2b180f2cde1b672b4f4467e6820ceffaee534c5352713faa83
- MD5 7c4589bd58ebaf6ea0c530dad9c9e89a
- SHA1 b6bf893cde087c4e1e33b0c84861d918239e54ff
- SHA512 da4d7bc71cd6233665cc4972f8ecee78860bce0299e7f89fca96501204723e9d6e5b0830028be720e4d1f82ce638c7073625d832c626e4a0080ee1e079484f58
- SSDEEP 98304:r/ipDv0OUm/xjXq/kiWPPVlbg8zLho0Og0En+HNUQIaWAXet4ccjNrbav:ruDvasxjXqBelkAhoYFsNUQ1E7kNvav
- TLSH T1954633A6E68EC433CB57DD7A5BBE25DD3A8C94C01BA300A032C5A1EEC8FE540555673B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-PH73C.tmp\file.tmp
- Size 1.1MB
- SHA256 821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
- MD5 90fc739c83cd19766acb562c66a7d0e2
- SHA1 451f385a53d5fed15e7649e7891e05f231ef549a
- SHA512 4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
- SSDEEP 24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
- TLSH T198453A22A3D24437D5732F759C6BC2946C367E202EA4E54A7EF99E0C0E39B41BD35392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jkizzLL1X
- Size 32B
- SHA256 56748a34b2abd7bfa911da43471f09cf968f26c7d13fd9beda76277ab96884c6
- MD5 f2f4f86859d8dd789b25d60a804cc7fa
- SHA1 412b4b35458ebb7a7ad8046319b77b8e1e6300b7
- SHA512 5fb16b84c5f0d5b371075d1811040d91f4e6d801cc4fb838e4fbba6c0a12e94908756ef325a54f408accfb1260360d75fb2cd8ce42dcf80ede0c0e216e6763b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\WriterManager\Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH