hijackloader | b39688635bb5b2a90bb9101b372080b61d6ba78f2cd78ee275a983a84e2a047d

Analysis

user interaction
yes
max time kernel
300s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy.exe
Size 4.2MB
Sample260528-2xvchsdz4m
SHA256 b39688635bb5b2a90bb9101b372080b61d6ba78f2cd78ee275a983a84e2a047d
MD5 b601ca8a198c8971c069052d588aac4f
SHA1 4c58327fb51bf9afc6ea9e910e92b81fef86e40c
SHA512 714ebfc2fc23faa02e2dc353949d7eccef796aeea8955e166a1e98b0a0e0cf9cd7ec11bc783a03972d63d9942690139663d5aee3246fba44f65eb2c38ad2a174
SSDEEP 24576:lj4SUw4RXMmAezRybIYrrwoQKo4ajMxfO0CXak1fnBele5yK2tFmA2b:ljzUXRHAezkEDJMkVOXkAK
TLSH
T12F167C4A7CE149EAC0AA633288B722867B71BC550F3263D72E50B7783FB26E45D35744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NETBuffer_v1_0_rc
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244c7-49.dat	family_hijackloader
behavioral1/files/0x00070000000244db-94.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 1556 created 4012	1556	RippleTr.exe	120
PID 1556 created 4012	1556	RippleTr.exe	120
PID 1556 created 4012	1556	RippleTr.exe	120
PID 1556 created 5832	1556	RippleTr.exe	135
PID 1556 created 5832	1556	RippleTr.exe	135
PID 1556 created 5832	1556	RippleTr.exe	135

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	2620	kythy.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	kythy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	JiFtyMe0Te0AD4LWgIsMsPqr.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GUIGuard_net8.lnk	ZTracker32.exe

Executes dropped EXE 5 IoCs

pid	Process
3500	JiFtyMe0Te0AD4LWgIsMsPqr.exe
2800	uctmlruhl7snn7DbuNudJD71.exe
872	Vect_P16.exe
3152	Vect_P16.exe
1124	Vect_P16.exe

Loads dropped DLL 10 IoCs

pid	Process
872	Vect_P16.exe
872	Vect_P16.exe
3152	Vect_P16.exe
3152	Vect_P16.exe
1124	Vect_P16.exe
1124	Vect_P16.exe
3952	ZTracker32.exe
1556	RippleTr.exe
3796	Crisp.exe
3048	Crisp.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\desktop.ini	ZTracker32.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ZTracker32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ZTracker32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	ZTracker32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	ZTracker32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	ZTracker32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	ZTracker32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	ZTracker32.exe
File opened for modification	C:\Program Files\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	ZTracker32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	ZTracker32.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.myip.com
40	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2800	uctmlruhl7snn7DbuNudJD71.exe
1556	RippleTr.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 3952	1124	Vect_P16.exe	108
PID 3152 set thread context of 1556	3152	Vect_P16.exe	112
PID 1124 set thread context of 3796	1124	Vect_P16.exe	113
PID 3152 set thread context of 3048	3152	Vect_P16.exe	114
PID 3952 set thread context of 4012	3952	ZTracker32.exe	120
PID 3952 set thread context of 5520	3952	ZTracker32.exe	160
PID 3952 set thread context of 4012	3952	ZTracker32.exe	120
PID 3952 set thread context of 5732	3952	ZTracker32.exe	166

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-64.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailBadge.scale-400.png	ZTracker32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_32x32x32.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-250.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-200.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\platform_format.lua	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-150.png	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png	ZTracker32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\187.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-60.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\Describe.snippets.ps1xml	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\View3d\3DViewerProductDescription-universal.xml	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-100.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png	ZTracker32.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-125.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-200_contrast-white.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-150.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-150.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-100.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-125.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-black.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-32.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-200.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	ZTracker32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-96_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\MediaInkToolbar.xbf	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	ZTracker32.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll	ZTracker32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Square71x71Logo.scale-100.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-24.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\startup.js	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-200_contrast-white.png	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-environment-l1-1-0.dll	ZTracker32.exe
File opened for modification	C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Zview.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-200_contrast-black.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png	ZTracker32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll	ZTracker32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms	ZTracker32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-48_altform-unplated.png	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\CircularProgressBar.xbf	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.PhoneNumber.ot	ZTracker32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-unplated_contrast-black.png	ZTracker32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\UKV.job	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JiFtyMe0Te0AD4LWgIsMsPqr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uctmlruhl7snn7DbuNudJD71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZTracker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	chrome.exe
6132	msedge.exe
6740	chrome.exe
6152	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RippleTr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RippleTr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244828867433611"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3952	ZTracker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	uctmlruhl7snn7DbuNudJD71.exe
2800	uctmlruhl7snn7DbuNudJD71.exe
872	Vect_P16.exe
3152	Vect_P16.exe
3152	Vect_P16.exe
3152	Vect_P16.exe
1124	Vect_P16.exe
1124	Vect_P16.exe
1124	Vect_P16.exe
1124	Vect_P16.exe
1124	Vect_P16.exe
1124	Vect_P16.exe
3152	Vect_P16.exe
3152	Vect_P16.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3796	Crisp.exe
3796	Crisp.exe
3796	Crisp.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3048	Crisp.exe
3048	Crisp.exe
3048	Crisp.exe
4012	chrome.exe
4012	chrome.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
3952	ZTracker32.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe
1556	RippleTr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3952	ZTracker32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1124	Vect_P16.exe
3152	Vect_P16.exe
1124	Vect_P16.exe
3152	Vect_P16.exe
2800	uctmlruhl7snn7DbuNudJD71.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
5832	msedge.exe
5832	msedge.exe
5832	msedge.exe
5832	msedge.exe
6428	chrome.exe
6428	chrome.exe
6428	chrome.exe
6428	chrome.exe
6428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	ZTracker32.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeDebugPrivilege	1556	RippleTr.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	6428	chrome.exe
Token: SeCreatePagefilePrivilege	6428	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeDebugPrivilege	3952	ZTracker32.exe
Token: SeDebugPrivilege	3952	ZTracker32.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe
Token: SeShutdownPrivilege	4012	chrome.exe
Token: SeCreatePagefilePrivilege	4012	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
5832	msedge.exe
5832	msedge.exe
6428	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe
4012	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3500	2620	kythy.exe	99
PID 2620 wrote to memory of 2800	2620	kythy.exe	100
PID 3500 wrote to memory of 872	3500	JiFtyMe0Te0AD4LWgIsMsPqr.exe	101
PID 872 wrote to memory of 3152	872	Vect_P16.exe	102
PID 3152 wrote to memory of 1124	3152	Vect_P16.exe	103
PID 1124 wrote to memory of 3952	1124	Vect_P16.exe	108
PID 3152 wrote to memory of 1556	3152	Vect_P16.exe	112
PID 1124 wrote to memory of 3952	1124	Vect_P16.exe	108
PID 3152 wrote to memory of 1556	3152	Vect_P16.exe	112
PID 1124 wrote to memory of 3796	1124	Vect_P16.exe	113
PID 3152 wrote to memory of 3048	3152	Vect_P16.exe	114
PID 1124 wrote to memory of 3796	1124	Vect_P16.exe	113
PID 3152 wrote to memory of 3048	3152	Vect_P16.exe	114
PID 4012 wrote to memory of 3380	4012	chrome.exe	122
PID 4012 wrote to memory of 5076	4012	chrome.exe	123
PID 4012 wrote to memory of 1380	4012	chrome.exe	124
PID 4012 wrote to memory of 1380	4012	chrome.exe	124
PID 4012 wrote to memory of 4656	4012	chrome.exe	125
PID 4012 wrote to memory of 4656	4012	chrome.exe	125
PID 4012 wrote to memory of 3936	4012	chrome.exe	126
PID 4012 wrote to memory of 3936	4012	chrome.exe	126
PID 4012 wrote to memory of 368	4012	chrome.exe	127
PID 4012 wrote to memory of 368	4012	chrome.exe	127
PID 4012 wrote to memory of 5024	4012	chrome.exe	129
PID 4012 wrote to memory of 5024	4012	chrome.exe	129
PID 4012 wrote to memory of 2188	4012	chrome.exe	130
PID 4012 wrote to memory of 2188	4012	chrome.exe	130
PID 4012 wrote to memory of 5152	4012	chrome.exe	132
PID 3952 wrote to memory of 4012	3952	ZTracker32.exe	120
PID 3952 wrote to memory of 4012	3952	ZTracker32.exe	120
PID 3952 wrote to memory of 4012	3952	ZTracker32.exe	120
PID 3952 wrote to memory of 4012	3952	ZTracker32.exe	120
PID 3952 wrote to memory of 4012	3952	ZTracker32.exe	120
PID 1556 wrote to memory of 5832	1556	RippleTr.exe	135
PID 5832 wrote to memory of 5856	5832	msedge.exe	136
PID 5832 wrote to memory of 6132	5832	msedge.exe	138
PID 5832 wrote to memory of 6140	5832	msedge.exe	139
PID 5832 wrote to memory of 6140	5832	msedge.exe	139
PID 5832 wrote to memory of 6140	5832	msedge.exe	139
PID 5832 wrote to memory of 4864	5832	msedge.exe	140
PID 5832 wrote to memory of 4864	5832	msedge.exe	140
PID 5832 wrote to memory of 5392	5832	msedge.exe	141
PID 5832 wrote to memory of 5384	5832	msedge.exe	142
PID 5832 wrote to memory of 5392	5832	msedge.exe	141
PID 5832 wrote to memory of 5392	5832	msedge.exe	141
PID 5832 wrote to memory of 5384	5832	msedge.exe	142
PID 5832 wrote to memory of 5384	5832	msedge.exe	142
PID 5832 wrote to memory of 5536	5832	msedge.exe	143
PID 5832 wrote to memory of 5536	5832	msedge.exe	143
PID 5832 wrote to memory of 5536	5832	msedge.exe	143
PID 5832 wrote to memory of 5544	5832	msedge.exe	144
PID 5832 wrote to memory of 5544	5832	msedge.exe	144
PID 5832 wrote to memory of 5544	5832	msedge.exe	144
PID 5832 wrote to memory of 5904	5832	msedge.exe	147
PID 5832 wrote to memory of 5904	5832	msedge.exe	147
PID 5832 wrote to memory of 6112	5832	msedge.exe	149
PID 5832 wrote to memory of 6112	5832	msedge.exe	149
PID 1556 wrote to memory of 6428	1556	RippleTr.exe	150
PID 6428 wrote to memory of 6508	6428	chrome.exe	151
PID 6428 wrote to memory of 6692	6428	chrome.exe	152
PID 6428 wrote to memory of 6692	6428	chrome.exe	152
PID 6428 wrote to memory of 6740	6428	chrome.exe	153
PID 6428 wrote to memory of 6792	6428	chrome.exe	154
PID 6428 wrote to memory of 6792	6428	chrome.exe	154

C:\Users\Admin\AppData\Local\Temp\kythy.exe
"C:\Users\Admin\AppData\Local\Temp\kythy.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\Documents\Screenshot album\JiFtyMe0Te0AD4LWgIsMsPqr.exe
  "C:\Users\Admin\Documents\Screenshot album\JiFtyMe0Te0AD4LWgIsMsPqr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Users\Admin\AppData\Local\Temp\Vect_P16.exe
    "C:\Users\Admin\AppData\Local\Temp\Vect_P16.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\ProgramData\NETBuffer_v1_0_rc\Vect_P16.exe
      C:\ProgramData\NETBuffer_v1_0_rc\Vect_P16.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Users\Admin\AppData\Roaming\NETBuffer_v1_0_rc\NDZXZXMEEXNXNNIYST\Vect_P16.exe
        
        C:\Users\Admin\AppData\Roaming\NETBuffer_v1_0_rc\NDZXZXMEEXNXNNIYST\Vect_P16.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1124
      - C:\ProgramData\ZTracker32.exe
        
        C:\ProgramData\ZTracker32.exe
        6⤵
        Drops startup file
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        
        PID:5520
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Roaming\srv_router_starter\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\srv_router_starter\Crisp.exe
        6⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3796
    - - C:\Users\Admin\RippleTr.exe
        
        C:\Users\Admin\RippleTr.exe
        5⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        6⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ff80a61c188,0x7ff80a61c194,0x7ff80a61c1a0
        7⤵
        
        PID:5856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,14769859703133399141,15873147401613129634,524288 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:6132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,15187422851383800746,9921801192909324927,262144 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
        7⤵
        
        PID:6140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,5605522556883092345,17088321133483933829,524288 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
        7⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3364,i,18308200607766310784,10962082892683791107,2097152 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
        7⤵
        
        PID:5392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,17061580859470613964,127600310955025425,2097152 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
        7⤵
        
        PID:5384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4028,i,7066526679589442150,7692707075400556562,2097152 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
        7⤵
        
        PID:5536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4040,i,17194148900568698468,2725158594867177944,2097152 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:2
        7⤵
        
        PID:5544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,80395557668394789,1011913062887383016,524288 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
        7⤵
        
        PID:5904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,2533983371583382021,11754552399331752559,524288 --field-trial-handle=2288,i,16942736014519235561,11594855571711111807,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
        7⤵
        
        PID:6112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" about:blank
        6⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\conigWorkr\c4369405 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\conigWorkr\c4369405\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\conigWorkr\c4369405 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80e43c728,0x7ff80e43c734,0x7ff80e43c740
        7⤵
        
        PID:6508
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1908 /prefetch:2
        7⤵
        
        PID:6692
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2156 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:6740
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2220 /prefetch:8
        7⤵
        
        PID:6792
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3136 /prefetch:1
        7⤵
        
        PID:7052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3248 /prefetch:1
        7⤵
        
        PID:7060
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3780 /prefetch:1
        7⤵
        
        PID:6028
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3896 /prefetch:2
        7⤵
        
        PID:5920
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\conigWorkr\c4369405" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1912,i,12505031608171870081,81351873165968858,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4572 /prefetch:2
        7⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Roaming\NETBuffer_v1_0_rc\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\NETBuffer_v1_0_rc\Crisp.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3048
- C:\Users\Admin\Documents\Screenshot album\uctmlruhl7snn7DbuNudJD71.exe
  "C:\Users\Admin\Documents\Screenshot album\uctmlruhl7snn7DbuNudJD71.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff80e43c728,0x7ff80e43c734,0x7ff80e43c740
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,15344791097538568585,829552088512388880,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,15010331672365419208,2646633309808824974,262144 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,16418955291849087050,5447846142469153042,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,6363192037848486027,17686188316561632264,2097152 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,2863661145064978401,14933396442888581117,2097152 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,15394390917154028774,10073994415709598697,2097152 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,553271509567354684,17809825440156808064,2097152 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,3008138013161753503,10349751193511870550,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,915263308586209566,11297138478082326013,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:6808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,9593534741102349521,6128194383963982362,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:6816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,9013844565650243376,16557669234290456427,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:6824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,16437285993528138947,11454002486926631456,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4056,i,13685442758415957968,16333603966217837329,262144 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3144,i,7805386212015858808,8993860387826023807,524288 --field-trial-handle=2060,i,11699471355459912185,15338907979190397585,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jifexabo

Path C:\ProgramData\Mayanex\Jifexabo
Size 2KB
SHA256 1b019c082111d7c245cd86bd28c795a8060ed39240d9b117f996f865faa7539d
MD5 881786b9c21747c2a27d337e1c823366
SHA1 7efae6f01ffd87bde87c67198650d91d3d1beee1
SHA512 fb6524d127d7d52e8371a57b79a2b1bc7a038ac919a0917b1a26b38731db7dfd87a205268c86605454c01cc86f7df771be09790533184971c3d1606236799852
TLSH
T175413B8220C5E8E370A17B96887DAD84DF80C66067B04D1D0F2C6F2DC53FB32A5C12A6
MD5 SHA1 SHA512 TLSH

Submit Download

Mitonico

Path C:\ProgramData\Mayanex\Mitonico
Size 6KB
SHA256 1385eb67a1cb7cf1dddc56d1867087331edce1f91ffb80fe1edf5a142bf46561
MD5 80529666060ead4aecd9e277ce9ee231
SHA1 8fdf1303e28a4f8459ca04d10295831905a757ab
SHA512 202a61053634103e5f09a9e5a9622a273d30b74a223a3b7d3bf2070579a34c82b2c31fe0f271372edc0819812cdead4a94b6304a73f9f7d53b011ad2a3c8c0af
SSDEEP 192:caRTrebOctQECtGqleAqIH6qsOIuvQ/1O:caR2b7tQE4eAqu/sOIc
TLSH
T148D19E4B7716203D0228CF60758FD41C49F9D43A6B04DCA4B1DB8CDAC96E778FAE2028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5f9c7b375dea7ec386ea00705f6b0fd663ceff1

Path C:\ProgramData\Mayanex\Nata\c5f9c7b375dea7ec386ea00705f6b0fd663ceff1
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

ZTracker32.exe

Path C:\ProgramData\ZTracker32.exe
Size 998KB
SHA256 d9fa3fda6755eb535c4de9572a88deaf5ba2035507dd581ae1a29f888ff5bb0e
MD5 e49a77cf258b9aa20d4c499776935502
SHA1 0e05361c2daf783ffa92054272aa528c696b4db5
SHA512 971a2e78572a9aa0fa6f4cf33e8ac1a844891726da9345d6f0dc130caa42d3fab2229f32fdde8d0adfd3ccea80eee917053e69091a33affee45969860ddcd046
SSDEEP 24576:zP0dnoZJZWP48I+6bl7MVamLQFLw2nw+pJbU5e2yZm:7KQAPI+6bl7MVLQFLwepJbuLem
TLSH
T1D2258E7269019071E95205B95639DB35EDB8C03B8365D6D3B3F894A80B134E13B3FEAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d1f702ddb2a18b38e58372c723c9c82a5f8f6aa17bdaba5cdafed00fc1b68eaf
MD5 babefb49ceb3cb07efa7b9273ef8add4
SHA1 6897dd4fbba320ff8fe187134ec66ef2e07831fe
SHA512 0d3962b5503635fc7013ad8d5cdfba28bf6f796b873546ce936f8af3bbe11b4759da8f9a680444e101a0e289d3f4c1367dc0697b96ea03efea89173b26ad3419
TLSH
T1C5F0F9B9CD22AC3718FD171874A5470AE75123672740985F3B3D420C4FB463B494691C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c103315078a6d6fcaad31e522413f664ed56cedc1c72fb75a9f167dd712c292b
MD5 8011d3db5fe6c4035f246cbb5e89d9a6
SHA1 04afc88b2163beb91e03c9f15459eeb003f2def8
SHA512 81397854fd3a392d49276f6e60470166f54447759314b9283cf4216f3416aeab25acc37cc1e7729c4d8109f4dfec898331db6dc2118fe021a99a7d235c9b3e46
TLSH
T1BD6159F7C7D8867DC91196F4AB256E1FCD2A0A14532C3C56C8D4AF4B53E2872D25078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 949068bccd2b5f2788241e6bbf0747b60822344d80ce4f89ab2b65bf673e0ca4
MD5 bf9a3ad6a54044b682550d4dfa96af6e
SHA1 2b307cc292b51fa41461bba2cec08525cd2f2e32
SHA512 f7d98f56ccde2c11c8d5aa5166079c1a71723f6fceabab3828baca4ab7a83eaa20011e539624764ef95db8c96c5ffc3365828494c6111cffd317a51a0eb9262d
TLSH
T1695169F7D3D88A7DC91192F4AB256E1FCE2A0A14532C3C56C8D4AF4B53E2872D25038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5319f48f1e4e8a8b82f14aeac7602ef4b07238f938efd5671ddabc589776110d
MD5 d0857b0b21668563edaa4ef9b06800c1
SHA1 61800854d24150f91b6ed102239fba2ec8232588
SHA512 c44008c8a250a7d9aa1b88e95a18d2a4efea671f5e8ccb91779fa64d56c08da3f9690b78ee13232cb694928cc131d921185a82f6fb0bd4e6275de700cf96181d
SSDEEP 192:yRQBueBB+OVNv7MF+pAPRp2S9HHsb+WNnJu0UBckw2+VyIsnAUgtaJ:yRQBpDtgoUX91ww0/W28
TLSH
T10B42B62EFE15687B6CCAC229FD227B53D7F5203121942E54EAFC8A2C15E76CC621705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1784965aef1df75fe0052b343acd018e66dcd2f2a204d2bd5d47646dac34c79b
MD5 14f6804bf278de7dedc97acd0edce715
SHA1 4c13784a559ef037c6187280875695c205bcddf5
SHA512 d76007fa9e3c520bc01921bd3bba77d3b71a57d9adbfb6f161ed06058a0988934de745801c3ae73f348ccd5c91fba8e6711bc87620e46899f9b193be8ef7026a
SSDEEP 192:yRQBueBB+OVrv7MF+pAPRp2S9HHsb+WNnJu0IBckwN+VyIsnAUgraJ:yRQBpDTgoUX91ww0jt2e
TLSH
T12642B62EFD15697B6CCAD229FD227B53D7F5203121942E44EAFC8A2C15E76CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ecb48bb71f52e657e48db5385ca8f7baa077f76a45389f4b64b6a97a5ccf0bf
MD5 6558ce4dbf5166c1e1709979e08f2798
SHA1 c0dab1e6884c58ad8bad79294ef649e6d2eb2375
SHA512 9f68a34a89ada636b67b0e7421d7751d5675350034f06587b339b8067517a411cfaa05ca3a8b68acd6961fe2bbcf8ad421067dcf2b33cfc28e5c649c54b8bc12
SSDEEP 192:yRQBSeBB+OVev7MF+pgPRp6S9HHsb+WNnJu03Bckw3+VyIsnAUgraJ:yRQBlDagocXp1ww0GX2e
TLSH
T14242C72EFD15687B6CCAD229FD227B53D3F5203122942E44EAFC8A2C15E76CC621705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 407417ca70a69e3713d18c902bc7774d34b2c374fd039e0e5e43e8cdebc6164f
MD5 6a5df1796bde5daaa0f88166c9cd2032
SHA1 f071a5f3d7f30409ed843e97b0b8cb91a871c2aa
SHA512 02409e391da4bc9f7a425508ead8e93461477c71fedcc3c5248cc3d3c8cdee84f015e0b40d105dd6a35f3c8ebc5cd2fe89c24c3ee2f2ad7303ac9df1d3df43ef
TLSH
T139B0120080816512C04306B0156324C875545F119B1B574193E26A66C836265C015191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5966de.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5966de.TMP
Size 96B
SHA256 3f1963f9c358c28d79bc1100ca948a57ad2bf645dcb2a0291dda7c2744589c98
MD5 f10a1d56724376a7007982a2ce94c943
SHA1 f0a3c0a776363d944279b7e3c6ee0004becd5ba1
SHA512 149324bc0ca9abee62dd3e5826e6b1158625a5fb8674423f0f4b3c952a21f76a2f3df7b51c1265b572cda24f5c62b64890cbf18ee7e2fdfedc0ef15278b88260
TLSH
T144B02200C003A32BC00203F0208A80F83022EF23CA030322A3F33E33CC22330823C020
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 2fe8a63f4c9fa9e03ee96daa39e45ecb1c9c0acad352a471b8fb6bd1e0d4cb37
MD5 94711642fab118e00232dbb72d6937d6
SHA1 cdf8421889a77b4e51142bf95d1fbebea90ac0a7
SHA512 f2b78ce36fde3425679fa56865bf649843576d2365a99ee4a7b9de81f6db458333a7af33228420296593f43c1370eace68736f23456d525de97495f3e1fa7be3
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkGTVumB3na:1nbZeMrv/hGtkGVna
TLSH
T1CCD3884B3A747102DDE59A722CE051BB5E3CB16D4F51A1D438B620588EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 c239682f996c7d412e906057df21523b520e79acac930588adca1c41cd45892a
MD5 77a091904afb7e22d77ab5630cefcfde
SHA1 2e80a34692bcce69ee8001578a6bbba6353d957b
SHA512 b64b8bcb6d4f2b3239d5a55d0205f2bb9381719727abda8cbea53b36dc84a440694692f240d5d88e4141dd71c0a08be33a68180c2913012851a98feac44f2e22
SSDEEP 6144:MqVjVyX3RDzGbEbYIybJlm7Rkm1tYpBeh2BAoy:M+oBLbv9oBGcAoy
TLSH
T1023412736DB589724CBA7F19704E351E1CF19BB2EA29EA91E4D97B0032DE2858C07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 5cafb3f7b9f6921f7fd005edde44194a6bb5bbf8173e03de0bc366e8587676b5
MD5 d2e13684f08fa7d77d226b8767216007
SHA1 c5313803d5316c611d37731ba8860e8acf390e7a
SHA512 84cc03124c5774643bcee5183d5efa415baeb6745857e8e048aea8ca83a526a58b1917ae58f3af0e6586fc7960946567f60833fb62901adcc63c65d08b9bd718
SSDEEP 6144:M6jVyX3RDzGbEbYIybJlm7Rkm1tYpBeh2BAoy:M6oBLbv9oBGcAoy
TLSH
T1473423731DB68AB2487A7F65704E665F1CF196B1BA29EBA0D4D5AB0033DD3898C07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 6d4a0b1670e9c3ef4decfeec955f94bab3e9506f9d045d9af775719c6d2c5a00
MD5 08e2475cd976d6bd213501a63383e81f
SHA1 7f158d03dbd6f4c2052aa6af52bcfaa114864563
SHA512 38812ab0829d5f1739784ac486930b89078f01bb9734f31231de0535f97ec1e688801c6770503dcee558523cb6af73db7a4ea653d295a63af9e4064489307429
SSDEEP 6144:YqVjVyX3RDzGbEbYIybJlm7Rkm1tYpBeh2BAoy:Y+oBLbv9oBGcAoy
TLSH
T1453412736DB589724CBA7F19704E351E1CF19BB2EA29EA91E4D97B0032DE2858D07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 acb6c205bf5b8e94b9f84d61fb200453b7f354aaeb50a739bdda6365c5749430
MD5 fd3cf45b23b6f89c2de00adda59a49c9
SHA1 d66824b41595ef7cde7dbac8e1ea0441e0cc1fc3
SHA512 ea29635da31bddcf6322f575fcefdc49b46c676ec5d13e3ad0c558b645017d91f33c283ab612c9286a649a1f212a81acfff93455551d9d6d0d7fa38c9488b215
SSDEEP 3072:/3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/2m7Rkm1tYpBeh2BAoM
TLSH
T1D8C312275E75A8375878BB0EB48E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f5fb1b9bcf084f117ffa0503322276b6817deee4d260e928c79ad546b3401ea4
MD5 956c5a5a7eff4862a029a80b43348b04
SHA1 7c1837b4fa5475bdcb4cb6c60f653660af08e6a2
SHA512 2362adb489d1d8fbd33c25f8a46ddb0667c3509d3f5698c1cc747cf0ba0d65ea2252a70af2b195f80e00bf49c60a4040eff9c8edee949fba848d2c001282ce39
SSDEEP 6144:f6jVyX3RDzGbEbYIybJlm7Rkm1tYpBeh2BAoy:f6oBLbv9oBGcAoy
TLSH
T1B63423731EB68AB2487A7F65704E665F1CF156B1BA29E7A0D4C5AB0033DD3898C07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 8c48a2644c5bcc068056008f2b326e9191823b3de617cb9a2d4813f7d3a117b5
MD5 98daa4555c8d876d44d8be401348bf4d
SHA1 931877b1d88dc2a524a25712e4e14f6dbf7f9b39
SHA512 5eb8615c64fcd7e41a2b8ea9f2ef5673afa7a5c7920cc680a0199d39c702f0afacbcb750a437da9e80d57bdc88137e97d8540901c74deae7dcc444a1361782f7
SSDEEP 6144:MtojVyX3RDzGbEbYIybJlm7Rkm1tYpBeh2BAoy:MSoBLbv9oBGcAoy
TLSH
T1D83412735DB589724CBA7F59704E355E1CF19BB2EA29EA91E4C97B0032DE2858C07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 adbd594147831f433e499fce22b0cb3eb22ff9e592b6d5a4ff2609eee03543c1
MD5 3eabe1c045fc1c184ac3440b2bc0f651
SHA1 bff3672c3633c6da67e2d614cf9d48f64eda1320
SHA512 3b96ca467c9ae1e02face27d117139c350e0e51f5a3a7cee64f56233256d1591b59de03b8f6dad6ddf5981b9336db030eb9bd9abedff569df58e803f8ace767c
SSDEEP 192:lON76vMtPQmiUy6/ThTFp+FdLXKV847kGFU/u:lON76UtRVTOdLK1HU/u
TLSH
T16C020935AC786C7B9AB3BD86F48E27171FE4216BE6D11B54EAE82F1D00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 92cc5d7f9307a3dbb6c3f733f3429d17c7c9e3637bfecf74876473c913877995
MD5 3f62387d50cfd3cea67c1630c4cfef6a
SHA1 95a6c6576f92b824bf769272063c23d0336dcafd
SHA512 01a655d45af8fd44a23f987d4fc1b727775b8b989269470ded7746e9bc41959e16b68cdae115b19e0e686bee0cdff951a5443856df748348f2f674b195787448
SSDEEP 192:lONx6vMRPQmiUyx/shTFp+FdLXKxzSJrM80IkKqaU/u:lONx6URRcsOdLKoJrxDU/u
TLSH
T1F6121A31AC785C67AAA3FE86F44B27135FE4616BAAC11A60EED92F1D00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7A98008.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A98008.tmp
Size 8.4MB
SHA256 f7800dec81061771ad0b72f6ddcbcfe1a6a5f112dfe876078a7440dfb6fb89f7
MD5 cfdef14af712b353f9b273c340f4eb48
SHA1 7cfe66e78b9f64c04dbe0c4a533e8485e338d3a2
SHA512 fd7b5bece26428dcfd0d10d04d68d74ed31a9b6646bd13ef4cd42ef8b7cc755984652f892896edbea7ff1e332710752e7937d12791430f84ba73fc7f08b9ee1c
SSDEEP 196608:fDiG0Vkj7iaWZgX8VOlKYGhrYMU4AYTOO67g1wzEldIL+fxM3:ri92i/ZgMeK7hrYvsq75zEl+iw
TLSH
T1899633026AD87384B66B27C495FC26EE72FD9DBE0580234354A87341BFA3D71768E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7A98008.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A98008.tmp
Size 8.4MB
SHA256 0b7bd619e635654f9f10d7cf03d33b75626e3fdaeb11d43979b24ff83c10a88f
MD5 50ee53787e0a38afea32746fc9ec890c
SHA1 6ec6c21554a0a609cfaee5247c07356110d41294
SHA512 6d07e8d3f6c751c3fc52ec9431957bff692c99d3d7c5a99b265546eb69c7103b2fb834f1fdfb0aed605450a6d95c74cad1e78caabdf328bd578f7b146e72ad9f
SSDEEP 196608:vHiG0Vkj7iaWZgX8VOlKYGhrYMU4AYTOO67g1wzEldIL+fxM3:vi92i/ZgMeK7hrYvsq75zEl+iw
TLSH
T1DE9633026AD87384B66B27C495FC26EE72FD9DBE0580234354A87341BFA3D71768E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7E982B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E982B8.tmp
Size 3.2MB
SHA256 68fe85d55acba2c928cc2719ccfc264c51333228e511b1c80f8b8c01274fb004
MD5 2ceae4ca30356297446e71ce6d468f23
SHA1 9e896b4610f0a45946403545936453bb8f6f3250
SHA512 c10fb3fa871e4c648440a2f403621c8d257acdf8ca57af3a44bfb60761e2cc5dfc6505106bfc27d8c116cb3fad1161a1db074fa2bdd16d68be5be36edbab14c8
SSDEEP 49152:Hn0GNi+NPisdZq5wL9ISilaRXvac7xZbRWATUHRpnBM40JUnsn70IdcJDOAxJ9Ur:Uz8PiG0silaRXCcLbRWAwHDAab/JaCa
TLSH
T1A4F533949D648BE1396EB9E8B8251BF47C9DBEC478046FA2191C37D7B9215C20BCC633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7E982B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E982B8.tmp
Size 3.2MB
SHA256 9b1223ea43f042b6596ca4c40b5b336a5e1ce89c532e0cafaf7a64c5a27e3597
MD5 d63d13b79724faeceeef3182dfca2165
SHA1 3af866316b823d4db09abbc283e2511faaf9c6e9
SHA512 0f68b692f5ba677051ae7b5f837c57ae005f27da8041f69d60ebbeec0518d638a92733bd4ee484fd6cc252eec039e01524af9c9146f2b559c19d0ec72b579d62
SSDEEP 49152:fn0GNi+NHisdZq5wL9ISilaRXvac7xZbRWATUHRpnBM40JUnsn70IdcJDOAxJ9Ur:8z8HiG0silaRXCcLbRWAwHDAab/JaCa
TLSH
T120F533949D648BE1396EB9E8B8251BF47C9DBEC478046FA2191C37D7B9215C20BCC633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BD4ABAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BD4ABAE.tmp
Size 40B
SHA256 d32a01f969d464bde28e84d12dd7dd789b29a7eea07244ababe7be8a70391bd0
MD5 c045a83e2f71754e2a18231c2e84100f
SHA1 8295b663d5cbede87c86990322d55b0aebe9c29f
SHA512 47802349c4dc760006fc71466a70d53cbbb66d20a550021216d811874ebf8b7f7257a7b1684843d8aefd8b6f051ca041fcc8bb825ced93a0ba2a984c829401d2
MD5 SHA1 SHA512

Submit Download

CABB488.tmp

Path C:\Users\Admin\AppData\Local\Temp\CABB488.tmp
Size 40B
SHA256 479c87e70820d1d56cfb623585bf39f828088f4eaef0b8d07b504f19db095ab3
MD5 ec3953adef7809625b624e67f957f0ca
SHA1 09133fabf16fdfd6dc675da2b14eedcf8fc67f61
SHA512 88002181b057f1dff37918e2e6c35bf67d6924720cbac1aed1615d7415e94e46ace6d34d1dc48c8c117ea0c454efe026f41a154392dbf79cbe476cd6857202f4
MD5 SHA1 SHA512

Submit Download

Vect_P16.exe

Path C:\Users\Admin\AppData\Local\Temp\Vect_P16.exe
Size 639KB
SHA256 0a0c09753b5103e86e32c2d8086dd1399f0d97a00e1525ec9c390067cdb242ba
MD5 fd3ce044ac234fdab3df9d7f492c470a
SHA1 a74a287d5d82a8071ab36c72b2786342d83a8ef7
SHA512 86d7e805fab0e5130003facbb1525ee261440846f342f53ae64c3f8d676d1208d5fd9bd91e3222c63cc30c443348eb5ddedab14c8847dae138fba7e9be69d08d
SSDEEP 6144:d2aVbQDwJdsnu08zrJU/3AsBzDxm4GBohATKER0u+GIIIIIIIhIIIIIIIIIIIIIE:d2aRQDw/snpCu3j+4GBo+Vm56Sv
TLSH
T126D4176466050DFCEBF1B638EBDD526593B13D51023785CF13D03F8A3A33A92AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd09-9cea-5026-c21e.tmp

Path C:\Users\Admin\AppData\Local\Temp\fd09-9cea-5026-c21e.tmp
Size 15KB
SHA256 34ef31448e0fbe8c567f33ca408fcce5a220fa62abab7b9e1164a99ca6b2d3ea
MD5 cca9bdb418996f5910ff688b7cb25ca8
SHA1 2f1bba3f8399e35785221a9291c5d695899744e9
SHA512 267b00146f2ce9ced5943513f767f4cdd30a993d9def376764984a80d8362838f1c59e878e31b5d0eaea1e1b2c8fc7dd38d8edbb7cae4c04dc97d16a1bda9799
SSDEEP 384:qpmgc88JuU5UkBiw0FP9PYIiatRAlI+F65rD62LdVaP6xBUMHIOf:h888OtgFlwIVtNE2rlLblxSG1
TLSH
T14072C06A3D80EB0284FC3562674F3274712462E3A764508B7703FA8FAAD4D706C113B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 621KB
SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
MD5 ec9f1cdd909f7c0bae4db21dcd2033de
SHA1 4c2a112e048fc75cd4c581836356e881552c9be2
SHA512 924022bb40c542a3ff0d09da35b8156113a83336d57924888d921f070f6192d83fcec6b89bde89957731e55e41118ca2affeb5885541bd345da7857996c22fd5
SSDEEP 12288:KXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZWPn:KXTC/Sf8IdQKQEKZm+jWodEEq6LZWf
TLSH
T1F9D42A26BB4D06B0D166A3BCA1C38706D7F1BC154722A3C7429BE26D1F6B7C56B3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

network-mon.map

Path C:\Users\Admin\AppData\Local\Temp\network-mon.map
Size 6.4MB
SHA256 78e6f6fcb276bae836309c5327e8dfc8e358b4330aead495c90880bec8d99569
MD5 e5829d2249590bd9b7bdb31765df3b14
SHA1 101b38fa6e22a06f61417960a501704ca4540186
SHA512 472730777c467b6040a0c885970cce25ee76ae19100293802d70da27d9f63299020e35a8363fa7e829e468a825402fd001e2f8fffaf3a51ddffa9d95253a3d2a
SSDEEP 98304:jNr9fhjMQVexE1gPZv0wsbkyn/RgJ6Ioxc8DeRrZ9CZ/2WS8fUGbg9ATxvl:jNr7MoemGBvjsR/SJKufi/vQWgCTRl
TLSH
T13666339BD0A15113D187803645DAA84793ED23FA69A03E2E6E20CDCDC539BFCD5B6F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

process.xml

Path C:\Users\Admin\AppData\Local\Temp\process.xml
Size 26KB
SHA256 e9d96e9722c5e516cdb2080f94e5f4802f240b39cf33ef09b27e19a2489dad79
MD5 bdba0b1ba148017990ef57912fb26a4e
SHA1 98a07dceae5d042b088244d414476127fdff1ec3
SHA512 ace2741a6b8780c084bb3be51baf9926a8c9288cfa74fa5700b19e310e1a0af8c30b10580565adb1093a96521162a22aa7615fd06f2bf14d118f352d1c628caf
SSDEEP 384:Q7zCJ7AzFlIDHkNFioiyDgtYmqtoWpU9adi8+U9alAQcsE9ArRzLot5PLsHLB+MD:QS7AcbWoyDV+h4iZUsE9oWLsrB+Ivr
TLSH
T1BCC27DB9766A2F82E8087CAC4538D1A6D3ECB0773E4297A1F948153FB461DE1C910DB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\qrGwS5\0FgPdt0\Default\eV5GbDiK\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tier0_s64.dll

Path C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll
Size 386KB
SHA256 c232a5d6699de18ecfe6cb98b0c49ab756022cc3ca3f9ba336841b191194e899
MD5 373f3e5455ce9fce15517e125b544ea1
SHA1 3d91ce2d1fce35b99e80ab203d3673da3d9a0d3c
SHA512 b5fb0e01712a19ba105a377d9855e8de6fc424fdca10848d551ac478075fa9b712c7de363878349923b8c7dff1ee0dbf7a4f923aaaf5c0bf890d4fa8d01c42c0
SSDEEP 6144:VkhSr+T2LX9rvzSrBAMVJizQi7Xa4BR9fDN4g/sLDQEobrF:ASr42LX+Q573fhN4gyH+F
TLSH
T1F5849D5EFBA824B8D477D139CAA2820FD2B27855076197EF57A9431A2F336D01A3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1021KB
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67
SSDEEP 24576:L1foGwlaDT22+Pk+j2ZXCE6cctEMmxvSZX0ypCD3:JfoBR2+PfXWrT
TLSH
T1F725AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vstdlib_s64.dll

Path C:\Users\Admin\AppData\Local\Temp\vstdlib_s64.dll
Size 689KB
SHA256 4bb95ee0a76b851410072d36e21364ac84bffd859ff2c49457a2e47dc078e212
MD5 0ed2a19c0c3164e864a09a9fc4168f3e
SHA1 e5e71c609ba16e9cb2f4d77e1cafdd3619dee64d
SHA512 beaae33ce4f182b15f862a337e02cd30470350c2fd1e3244777a9edcbb65bc58e8d60d2bf33968ddb37db1d25b13b3fe7952575e8738f55835ce8786227c7951
SSDEEP 6144:WlP8nkDByG+07BDBwJqxUfJU9EtCpyoJJWomQUzR3GI/EEBo:WelnAB8TfJU9TjJW/rcI3Bo
TLSH
T1A8E48C6AF7A014A8D5BBC134CC52D50ED2B239191B629BFB0694A77A7F337E0163E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\conigWorkr\c4369405\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\conigWorkr\c4369405\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\conigWorkr\c4369405\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\conigWorkr\c4369405\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\conigWorkr\c4369405\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\conigWorkr\c4369405\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

network-mon.map

Path C:\Users\Admin\AppData\Roaming\NETBuffer_v1_0_rc\NDZXZXMEEXNXNNIYST\network-mon.map
Size 2.7MB
SHA256 72ece1d079ba7dda954a988e2c96c57f1cffc43d4ba9f64de90186c907749ad1
MD5 7f88ef574f9a834f5a1c72dc6fa8f078
SHA1 614bb4867ee7581352a70bb285aff471d6445c3e
SHA512 f24cfae680f89dde724eba4ad120777c5bc9f4dc349b90f0b0cb09e05d6971d8579bbfedadde69c5ef80e972b1b4dd777cf0e3558be323359b3ffd9e6687fa55
SSDEEP 49152:In7veC9leXRrQQoJQPYhVuonGAKNum4VsAeC/NixXJNxX5zVcM8oqLI+3m+E37bG:o75lW5RPYhgCGAKNumyGo4XHxX5JTqX1
TLSH
T199D533F1FBDBA535C40BA8379068FF12D34464F10B227ED825654ACFBDB99066602BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\srv_router_starter\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JiFtyMe0Te0AD4LWgIsMsPqr.exe

Path C:\Users\Admin\Documents\Screenshot album\JiFtyMe0Te0AD4LWgIsMsPqr.exe
Size 6.9MB
SHA256 642ecaab44fc4a09fce541bc7c639e77a5f9aa5ef28ca87b595df3c87afb12f8
MD5 99f942f227f3c7595840593c1a77e5b1
SHA1 0307b9ea1e3f916e0f247cdb004cbe792d32fd9f
SHA512 16ddcdb566483bb608eeef046b186eb4452331d9541e0f2f64704f6f4d673e068f1cf1bf74aa71c4b3f983e3121681d7cb9a792e7c4f55eaae1ec344e984e567
SSDEEP 196608:+p8VXfNsbQPOSPyKxfKj37C5s6wxgqixWkSLFBVfvHaciH9:+p8VXf6bONPyA037C5waqgEl/Ud
TLSH
T1AC76334637A478FED939C0B28F1DC7A99732EA7412414DCB509C5F6B2EA7A2103DB1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uctmlruhl7snn7DbuNudJD71.exe

Path C:\Users\Admin\Documents\Screenshot album\uctmlruhl7snn7DbuNudJD71.exe
Size 4.4MB
SHA256 8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce
MD5 d3493063d2f8d1f6d1c1d69893a67d71
SHA1 42c0c76b28357dc5a64cca1654f9c4f965379d4e
SHA512 4215de9e4ee6892c0486f495a833c32d11ebe52db0f57b97b248ad8acc6f326ba8181b23ba3d9a03075e12b4062e07ea18e97bd2d1ce1fdc33e47fbbbd69682b
SSDEEP 24576:ngFVlPGgCg/Lo9oWlbllm5rbD70RypFp0GG+B57WsKZKdk9a90NtDGqLb5WLCK3i:noVjWbleKkkZfySb5B4FgG8bsOoG/
TLSH
T1CB268C51FD8709B2E506233249E762AB6738AD054F329B9BEA44777EE9732C50C33346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RippleTr.exe

Path C:\Users\Admin\RippleTr.exe
Size 725KB
SHA256 fb1400d04aaec693fd67783063253c4b90b33e3c2e33166a472ec569856b711b
MD5 7411008bdd0b4507d7bbad958a8f1c42
SHA1 bc7cc61d6a0db0546f2cbf5f6bf197fe9030d7aa
SHA512 833a7da2a7c3e1404385facdfa8c309b7b5d5871c57b32d10317b7e9e596f7dcf1d668e22d910bd6a9126586a81b19ba4d2ea447c81a861b561d74ef5bd34882
SSDEEP 6144:W64tBD+TkgJwWA/bMgJoFlqh8VOsXLsACy1mM7Vk3XA161GsnjLMQM/bMEAJbHE+:WUTZFO6NmaO71G8ncbz6EGVvhkKo0f
TLSH
T143F44A43F1612DD6E3E28478CD59ED36E721382D53F795FB368481F63E03AA07A2A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-50-0x00007FF80F1A0000-0x00007FF80F200000-memory.dmp

Download

memory/1124-95-0x00007FF80F400000-0x00007FF80F460000-memory.dmp

Download

memory/1124-97-0x00007FF80F400000-0x00007FF80F460000-memory.dmp

Download

memory/1124-106-0x00007FF80F400000-0x00007FF80F460000-memory.dmp

Download

memory/1124-124-0x00007FF6B51F0000-0x00007FF6B5295000-memory.dmp

Download

memory/1556-111-0x00007FF7C97A0000-0x00007FF7C98DE000-memory.dmp

Download

memory/1556-126-0x00007FF7C97A0000-0x00007FF7C98DE000-memory.dmp

Download

memory/1556-264-0x00007FF7C97A0000-0x00007FF7C98DE000-memory.dmp

Download

memory/1556-161-0x00007FF7C97A0000-0x00007FF7C98DE000-memory.dmp

Download

memory/1556-502-0x00007FF7C97A0000-0x00007FF7C98DE000-memory.dmp

Download

memory/1556-479-0x00007FF7C97A0000-0x00007FF7C98DE000-memory.dmp

Download

memory/2620-69-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2620-0-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2800-629-0x0000000000750000-0x00000000009E5000-memory.dmp

Download

memory/2800-625-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/2800-624-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/2800-628-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/2800-630-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/2800-101-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/2800-118-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/2800-34-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

memory/3048-158-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/3152-99-0x00007FF80F400000-0x00007FF80F460000-memory.dmp

Download

memory/3152-72-0x00007FF80F400000-0x00007FF80F460000-memory.dmp

Download

memory/3152-70-0x00007FF80F400000-0x00007FF80F460000-memory.dmp

Download

memory/3796-165-0x0000000075070000-0x00000000750BF000-memory.dmp

Download

memory/3796-137-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/3952-478-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-525-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-613-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-133-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-602-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-560-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-505-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-501-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-117-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/3952-608-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-146-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-108-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-652-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-654-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-229-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-113-0x0000000001150000-0x000000000151A000-memory.dmp

Download

memory/3952-674-0x0000000001150000-0x000000000151A000-memory.dmp

Download