hijackloader | 5c5e737d12640b9ad887f56fce1bf395894ad6dd5171b4a1fdaf6a7d5a731a25

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_6b7140bb84b94ab6bcc981c78f01dd1a_elex_wannacry.exe
Size 16.5MB
Sample260602-b48wdaay8s
SHA256 5c5e737d12640b9ad887f56fce1bf395894ad6dd5171b4a1fdaf6a7d5a731a25
MD5 6b7140bb84b94ab6bcc981c78f01dd1a
SHA1 49e269adc921d467ace0165297152a3448fd9900
SHA512 6edd0e92294a65904165d5738e44d656d4183885a3baf4a42e44f3bb5837d682fb437fb1cf58e4496cb696b778e50696168ca6cd3f2267abb2b70d1038ba838f
SSDEEP 393216:+pISOulerLq0PRCvW7L3xZBNgZLiQFebtNJKM/2rP6FtxzbOXDe/NbDAAoxtj:eIHPrPPRCvW3BNg8QFyN79Ft9OziDA7T
TLSH
T194073385738035A8F171D2F67F698320AAFEFB1C5B952E07174F5C892E878A1A3175C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\com_ext_control_64_test
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b4d9-100.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 27 IoCs

description	pid	Process	procid_target
PID 4852 created 4908	4852	SpectraValidato32.exe	89
PID 4852 created 2860	4852	SpectraValidato32.exe	90
PID 4852 created 2028	4852	SpectraValidato32.exe	91
PID 4852 created 1144	4852	SpectraValidato32.exe	92
PID 4852 created 2164	4852	SpectraValidato32.exe	93
PID 4852 created 2044	4852	SpectraValidato32.exe	94
PID 4852 created 1164	4852	SpectraValidato32.exe	95
PID 4852 created 1072	4852	SpectraValidato32.exe	96
PID 4852 created 2668	4852	SpectraValidato32.exe	101
PID 4852 created 4908	4852	SpectraValidato32.exe	89
PID 4852 created 4908	4852	SpectraValidato32.exe	89
PID 4852 created 1144	4852	SpectraValidato32.exe	92
PID 4852 created 1144	4852	SpectraValidato32.exe	92
PID 4852 created 3500	4852	SpectraValidato32.exe	102
PID 4852 created 5024	4852	SpectraValidato32.exe	103
PID 4852 created 5104	4852	SpectraValidato32.exe	104
PID 4852 created 1764	4852	SpectraValidato32.exe	105
PID 4852 created 4184	4852	SpectraValidato32.exe	106
PID 4852 created 2160	4852	SpectraValidato32.exe	108
PID 4852 created 720	4852	SpectraValidato32.exe	110
PID 4852 created 3392	4852	SpectraValidato32.exe	112
PID 4852 created 4436	4852	SpectraValidato32.exe	113
PID 4852 created 1216	4852	SpectraValidato32.exe	114
PID 4852 created 3500	4852	SpectraValidato32.exe	102
PID 4852 created 3500	4852	SpectraValidato32.exe	102
PID 4852 created 5104	4852	SpectraValidato32.exe	104
PID 4852 created 5104	4852	SpectraValidato32.exe	104

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 4 IoCs

resource	yara_rule
behavioral2/memory/4852-223-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4852-263-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4852-386-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4852-468-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Downloads MZ/PE file 1 IoCs

flow	pid	Process
53	4852	SpectraValidato32.exe

Executes dropped EXE 5 IoCs

pid	Process
1500	Data_D.exe
4144	Data_D.exe
4680	Injector_Stellar16.exe
564	7e399698.exe
3384	Data_D.exe

Loads dropped DLL 64 IoCs

pid	Process
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
1500	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4852	SpectraValidato32.exe
2424	TeraOrchest86.exe
3408	Crisp.exe
2732	Crisp.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe
3384	Data_D.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1679180529-4058988202-686829476-1000\desktop.ini	TeraOrchest86.exe
File opened for modification	C:\Program Files\desktop.ini	TeraOrchest86.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4852	SpectraValidato32.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 4852	4144	Data_D.exe	83
PID 4680 set thread context of 2424	4680	Injector_Stellar16.exe	84
PID 4144 set thread context of 3408	4144	Data_D.exe	85
PID 4680 set thread context of 2732	4680	Injector_Stellar16.exe	86
PID 2424 set thread context of 932	2424	TeraOrchest86.exe	115
PID 2424 set thread context of 996	2424	TeraOrchest86.exe	123
PID 3384 set thread context of 4564	3384	Data_D.exe	136
PID 2424 set thread context of 1908	2424	TeraOrchest86.exe	137
PID 3384 set thread context of 4732	3384	Data_D.exe	139

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	TeraOrchest86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsFormsIntegration.resources.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\UIAutomationTypes.resources.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\tzmappings	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_FEMININE.pak	TeraOrchest86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pl_MASCULINE.pak	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml	TeraOrchest86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\net.properties	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sv_FEMININE.pak	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-CN_MASCULINE.pak	TeraOrchest86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	TeraOrchest86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sr_FEMININE.pak	TeraOrchest86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Input.Manipulations.resources.dll	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms	TeraOrchest86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg_NEUTER.pak	TeraOrchest86.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Tasks\tool_host_i386.job	Crisp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e399698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_6b7140bb84b94ab6bcc981c78f01dd1a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Injector_Stellar16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeraOrchest86.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1144	chrome.exe
5104	msedge.exe
2816	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SpectraValidato32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SpectraValidato32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248382608898445"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2424	TeraOrchest86.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1500	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4144	Data_D.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4680	Injector_Stellar16.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
3408	Crisp.exe
3408	Crisp.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
4852	SpectraValidato32.exe
2732	Crisp.exe
2732	Crisp.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4908	chrome.exe
4908	chrome.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
4852	SpectraValidato32.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe
2424	TeraOrchest86.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	TeraOrchest86.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4144	Data_D.exe
4680	Injector_Stellar16.exe
4144	Data_D.exe
4680	Injector_Stellar16.exe
3384	Data_D.exe
3384	Data_D.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	TeraOrchest86.exe
Token: SeDebugPrivilege	4852	SpectraValidato32.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeDebugPrivilege	2424	TeraOrchest86.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeDebugPrivilege	2424	TeraOrchest86.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
3500	msedge.exe
3500	msedge.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1500	1892	2026-06-02_6b7140bb84b94ab6bcc981c78f01dd1a_elex_wannacry.exe	80
PID 1500 wrote to memory of 4144	1500	Data_D.exe	81
PID 4144 wrote to memory of 4680	4144	Data_D.exe	82
PID 4144 wrote to memory of 4852	4144	Data_D.exe	83
PID 4144 wrote to memory of 4852	4144	Data_D.exe	83
PID 4680 wrote to memory of 2424	4680	Injector_Stellar16.exe	84
PID 4680 wrote to memory of 2424	4680	Injector_Stellar16.exe	84
PID 4144 wrote to memory of 3408	4144	Data_D.exe	85
PID 4144 wrote to memory of 3408	4144	Data_D.exe	85
PID 4680 wrote to memory of 2732	4680	Injector_Stellar16.exe	86
PID 4680 wrote to memory of 2732	4680	Injector_Stellar16.exe	86
PID 4852 wrote to memory of 4908	4852	SpectraValidato32.exe	89
PID 4908 wrote to memory of 2860	4908	chrome.exe	90
PID 4908 wrote to memory of 2028	4908	chrome.exe	91
PID 4908 wrote to memory of 2028	4908	chrome.exe	91
PID 4908 wrote to memory of 1144	4908	chrome.exe	92
PID 4908 wrote to memory of 2164	4908	chrome.exe	93
PID 4908 wrote to memory of 2164	4908	chrome.exe	93
PID 4908 wrote to memory of 2044	4908	chrome.exe	94
PID 4908 wrote to memory of 2044	4908	chrome.exe	94
PID 4908 wrote to memory of 1164	4908	chrome.exe	95
PID 4908 wrote to memory of 1164	4908	chrome.exe	95
PID 4908 wrote to memory of 1072	4908	chrome.exe	96
PID 4908 wrote to memory of 1072	4908	chrome.exe	96
PID 4448 wrote to memory of 2668	4448	chrome.exe	101
PID 4852 wrote to memory of 3500	4852	SpectraValidato32.exe	102
PID 3500 wrote to memory of 5024	3500	msedge.exe	103
PID 3500 wrote to memory of 5104	3500	msedge.exe	104
PID 3500 wrote to memory of 1764	3500	msedge.exe	105
PID 3500 wrote to memory of 4184	3500	msedge.exe	106
PID 3500 wrote to memory of 1764	3500	msedge.exe	105
PID 3500 wrote to memory of 1764	3500	msedge.exe	105
PID 3500 wrote to memory of 4184	3500	msedge.exe	106
PID 3500 wrote to memory of 4916	3500	msedge.exe	107
PID 3500 wrote to memory of 4916	3500	msedge.exe	107
PID 3500 wrote to memory of 4916	3500	msedge.exe	107
PID 3500 wrote to memory of 2160	3500	msedge.exe	108
PID 3500 wrote to memory of 2160	3500	msedge.exe	108
PID 3500 wrote to memory of 2160	3500	msedge.exe	108
PID 3500 wrote to memory of 720	3500	msedge.exe	110
PID 3500 wrote to memory of 720	3500	msedge.exe	110
PID 3500 wrote to memory of 720	3500	msedge.exe	110
PID 3500 wrote to memory of 4436	3500	msedge.exe	113
PID 3500 wrote to memory of 4436	3500	msedge.exe	113
PID 3500 wrote to memory of 4436	3500	msedge.exe	113
PID 3500 wrote to memory of 3392	3500	msedge.exe	112
PID 3500 wrote to memory of 3392	3500	msedge.exe	112
PID 3500 wrote to memory of 3392	3500	msedge.exe	112
PID 3500 wrote to memory of 1568	3500	msedge.exe	116
PID 3500 wrote to memory of 1568	3500	msedge.exe	116
PID 3500 wrote to memory of 1568	3500	msedge.exe	116
PID 2424 wrote to memory of 932	2424	TeraOrchest86.exe	115
PID 2424 wrote to memory of 932	2424	TeraOrchest86.exe	115
PID 2424 wrote to memory of 932	2424	TeraOrchest86.exe	115
PID 2424 wrote to memory of 932	2424	TeraOrchest86.exe	115
PID 2424 wrote to memory of 932	2424	TeraOrchest86.exe	115
PID 2424 wrote to memory of 932	2424	TeraOrchest86.exe	115
PID 3500 wrote to memory of 1216	3500	msedge.exe	114
PID 3500 wrote to memory of 1216	3500	msedge.exe	114
PID 3500 wrote to memory of 2476	3500	msedge.exe	117
PID 3500 wrote to memory of 2476	3500	msedge.exe	117
PID 3500 wrote to memory of 2608	3500	msedge.exe	118
PID 3500 wrote to memory of 2608	3500	msedge.exe	118
PID 4852 wrote to memory of 2256	4852	SpectraValidato32.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-06-02_6b7140bb84b94ab6bcc981c78f01dd1a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_6b7140bb84b94ab6bcc981c78f01dd1a_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\Data_D.exe
  "C:\Users\Admin\AppData\Local\Temp\Data_D.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\ProgramData\com_ext_control_64_test\Data_D.exe
    C:\ProgramData\com_ext_control_64_test\Data_D.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Users\Admin\AppData\Roaming\com_ext_control_64_test\LHIFCHEVPTGA\Injector_Stellar16.exe
      C:\Users\Admin\AppData\Roaming\com_ext_control_64_test\LHIFCHEVPTGA\Injector_Stellar16.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Users\Admin\TeraOrchest86.exe
        
        C:\Users\Admin\TeraOrchest86.exe
        5⤵
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:932
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Roaming\workerhost_v2_0_32\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\workerhost_v2_0_32\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\SpectraValidato32.exe
      C:\Users\Admin\AppData\Local\Temp\SpectraValidato32.exe
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Downloads MZ/PE file
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f13c728,0x7ffa1f13c734,0x7ffa1f13c740
        6⤵
        
        PID:2860
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,8905215142795369251,16388449900176383259,262144 --field-trial-handle=1960,i,11225313229991937220,16297424567957469772,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
        6⤵
        
        PID:2028
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,17462176128782782190,8241563047086638228,524288 --field-trial-handle=1960,i,11225313229991937220,16297424567957469772,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:1144
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,11039756950655102570,2388882439625590215,524288 --field-trial-handle=1960,i,11225313229991937220,16297424567957469772,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2700 /prefetch:13
        6⤵
        
        PID:2164
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2884,i,6172779823601200622,3148363614130260679,2097152 --field-trial-handle=1960,i,11225313229991937220,16297424567957469772,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3020 /prefetch:1
        6⤵
        
        PID:2044
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,13507782687622864811,17563652795235160243,2097152 --field-trial-handle=1960,i,11225313229991937220,16297424567957469772,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3036 /prefetch:1
        6⤵
        
        PID:1164
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4148,i,15937163935130873357,8040871320164743632,2097152 --field-trial-handle=1960,i,11225313229991937220,16297424567957469772,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4156 /prefetch:9
        6⤵
        
        PID:1072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa1b44c188,0x7ffa1b44c194,0x7ffa1b44c1a0
        6⤵
        
        PID:5024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,964518227027759648,13243307426164645267,524288 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1664,i,17068777194913171663,13073833191723265069,262144 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
        6⤵
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,15557957608041417041,2338949916508121813,524288 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
        6⤵
        
        PID:4184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,1590063400971231537,4072373097842135156,2097152 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
        6⤵
        
        PID:4916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11855024309711147105,9470590961402069049,2097152 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:2160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4016,i,17376711711028205604,387323109141269898,2097152 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:9
        6⤵
        
        PID:720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4004,i,2818911622502027153,13244822579644560773,2097152 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
        6⤵
        
        PID:1568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4028,i,4241069702786243875,455676005624360396,2097152 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
        6⤵
        
        PID:3392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4112,i,17318225839470821547,17966319537494237795,2097152 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
        6⤵
        
        PID:4436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,6018863428616249077,4686812501969104029,524288 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13269517855866441107,11468256097921570469,524288 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        6⤵
        
        PID:2476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16158027302024587501,9699094797646675727,524288 --field-trial-handle=2580,i,504468251160372681,13542385759248082038,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        6⤵
        
        PID:2608
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\24cf0607\7e399698.exe"
        5⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\24cf0607\7e399698.exe
        
        "C:\Users\Admin\AppData\Local\Temp\24cf0607\7e399698.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Data_D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Data_D.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3384
        
        C:\Users\Admin\XeAggregator.exe
        
        C:\Users\Admin\XeAggregator.exe
        8⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Roaming\XAML_amd64_stable\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\XAML_amd64_stable\Crisp.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
  - - C:\Users\Admin\AppData\Roaming\com_ext_control_64_test\Crisp.exe
      C:\Users\Admin\AppData\Roaming\com_ext_control_64_test\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xc4,0x10c,0x7ffa1f13c728,0x7ffa1f13c734,0x7ffa1f13c740
  2⤵
  PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1d1bc728,0x7ffa1d1bc734,0x7ffa1d1bc740
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,2674982302741603637,8280386902589590916,524288 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,735881813545432718,9234408100267991333,262144 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,104108783850161545,7307939307691828999,524288 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,12737626116847860725,13368586318379929568,2097152 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,17749009296118001731,15897022205429319468,2097152 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,14921956695956476538,3753507571086621878,2097152 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,12304242622375578523,17744355982380235282,2097152 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,16166265660637322761,8180552275023177410,524288 --field-trial-handle=2512,i,6631638696479377766,8018807133868981127,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a4ea8b8be1451fe88f812f0e136bf56744968adc22ba72ce7006f3e1e1037807
MD5 ba45f966ea54de57f69c358e0073dc0c
SHA1 667cba6254daad80766aff4069ea5b0a6b4f92be
SHA512 22c53a7139bda25ee80ce9f8c58aac52a8308f7366ea43f91344610f8b8b4acd1cb444d7ee6e647fa4cc932a876a7047c80822fec841ae05822048be846cc281
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7c78c8c6fd0c18ed4d7bc09af8b616e04d007c24fff42bfeffc15f47038cde43
MD5 b020f558e786661b04cfbf83f4079a8a
SHA1 80cbbd078afb7e7d557baa43ee4f1826a7fdff56
SHA512 467314bc606445166d165c36b33cbe670395509db17cdf1091ca65e7a254a6110f366dc9fc1027f81c09f24dfbb152c0a4d9db6ffdb0d4d4163bdfbf2cd47db9
TLSH
T1ADF0F9B6CE21AC271CFC471975944B4BEB5013672B40495F3B3D520D8FB1637498591C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6232b0b547405fafea192156b05f9bb6e7cfed01d4c7990710163ea92f32ffb0
MD5 38b4bf25407904b0a16ec039e60a1e7a
SHA1 4d5193f7bed49a7a73189c557a0703ceea465caf
SHA512 08c14ae319f3e17d8f647776b91155d4b2524643abf8f931998e872a34b58b8c06aa2f22df91a479e33ce83214cee74fd5f295733b9700097b8e578b23440c8d
SSDEEP 192:qR9p1yGXaP3Gv7sBpAPRp2Z9NHsb+WNnFi5b0vAg0kwCtVyIsnAUgtaJ:qR9fv2y8UXerwM0Y08
TLSH
T1C842B52FAE10653B5CDBC229FA227757E7F9202135D42E44E6F88A1C19D75CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e75bc07136175c94aab507d334c3674cf2e56b476f2a689af6653163c261ccb1
MD5 c314d33d14b35f2957b66237cdc2a757
SHA1 ac916b65340de4d9515f2ab0f192852ecff43b59
SHA512 70d2c57d67612e2606c4e9d1382f92171c7029828b0d6aa89eb44bec85593c046b43451cc96737ad8885c80875152f9faf658df58def3c95111f0cbc1d1ce0d9
TLSH
T137B0124184116311C00503B0155290D473609F34C2131B4A43D0693688312504413109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594f4f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594f4f.TMP
Size 96B
SHA256 2abeec42eb1d410db445bb895fedc241ddddbbfcd31f7e47bb2170e928c64c55
MD5 4803053f55fa4e35d410a6eed211480a
SHA1 9b2a6f20627e18f455826aee14aebcd613389a7f
SHA512 84c5c5a57b4309375c87646ab83965e1dccc4865a2686d2aefeb56440a227b76af9dd62e73b53ba26ffec18b7cabd2f317ce0d8a9778090ac6549f2271ffa490
TLSH
T1BDB022A2C002E223C08203B02F8088C83020CF30C203022A82E02F32CC38A300320220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 25df57dfc2e3ec8466cc94a8d6fe05f91632f1e83c9650bf61d060bbe0c8c213
MD5 b5dd7400365f4cf02565779a17c6a112
SHA1 57533db134714641b2e87e1d3a00fc5081460f6b
SHA512 0f9e5bca5298e942691c1003f1974c8c13cc130c54b84ad7582839bbe460cb62c33d42c256784024f68c23a05ba75c85b92837165a3fed4eee18bcb5c67a5040
SSDEEP 6144:uc8KxWksPIlMxzCVcsE3tIm7Rkm1tYpBeh2BAo5:1XxWkmIlMxecsE3B9oBGcAo5
TLSH
T1533412339DA52AFF45AAEB1EB40F1B5E5EF00F6AC426995484E15B017FEE9CC4A44C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ff1c7be557a335e474a94be14f7c844ceddef20346c541540e2548fabf8ef1f8
MD5 d882c07550ff1baca0b8ed0ca2a829c0
SHA1 133ff4f3bf22a77bcd16de95d8d7b0a952cc0d76
SHA512 9b36a0aabbe40b010f219c8a25ea760a2f64ce86d3091acfe6d1f5344b7dbdb9285b3885fd3068532c19d2e3f13e43f0081a2f1f7acdbde00c1ee45143d245d7
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Rm7Rkm1tYpBeh2BAoe
TLSH
T1BEC3122B5E75A9775DB5BB0EB08E0B1F1EF14EA7C920DE82C8D85B0427E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a653a013039d864953e157d3db4696991a7f97cfa72f736959e5a66a05ef05a2
MD5 fda0ace6ab1fc5288b0f3a9d9cc3b4f4
SHA1 e437e4d9611fb76570e4c5f765072ecfdbadc5e6
SHA512 f6e2f4477ab60c73e64385b25b2f7b2a31aa570fd618c95ef4dbcb7552cc49cf1e0ae585551f630e17370276b78a08cfa78fa61b86ac26a4432f05aed9178423
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMP:em7Rkm1tYpBeh2BAoP
TLSH
T16FC3122B5E65A97759B5AB0EB08E0B1F1EF14EA7C920DE82C8D85B0437E97CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8392839d6cdd94c2d95cafb626e2693b91d52a7c2911518a9868587c904054b5
MD5 5c20e92c2e6854460c83044aa3d1ba91
SHA1 87e570ddca69f9e510fdbb263714f50670481bee
SHA512 255d739eaa037595a66fa6ede87e61c881c563e323d1342da2b4330c6df6d73d002b83eb867a2ded8c83ab7f42b33dcafe84dfc1b63fa50a65610bacc288418f
SSDEEP 192:BGNM6P2UOcQmiUymIUZqGv0h6+Fd/wsNwSOJU6:BGNM6eXshIiqGshFd/wiiU6
TLSH
T14302D9396C782C7B8FA2AD45B88777134FE8106BDA962B84D6E45F0C00D765C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2f24a14e9fd6a270b673f9f7cc7623302d0c6a443d7741b3d8ce7676b72d8268
MD5 bbbeb4b8b346dd5ce6a5682ae5b0248f
SHA1 51d9501275cbb01d82a444d3e9d8ef8aed355f1e
SHA512 3dd4e5763dbbd805f49e62d3d9fc981d618f52a495aefe8a19504daad5c378f3a9f952af597c16e6c6d04f5a6c95fe982b3ca264d4c608314c9603dca6054233
SSDEEP 192:BGNT6P2UTQmiUyrEZRGv0h6+Fd/wsL6YU9c0BuqIU6:BGNT6e2+SRGshFd/w0juNUU6
TLSH
T1C612E939AD782C678FA2AD45F48777138FE8116BDACA2F94E5D44F0D01CBA5C2316836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fc412a8

Path C:\Users\Admin\AppData\Local\Temp\24cf0607\3fc412a8
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4041-dbbd-cc0d-5ee9.tmp

Path C:\Users\Admin\AppData\Local\Temp\4041-dbbd-cc0d-5ee9.tmp
Size 288KB
SHA256 57099bae0d034e12a16b781c0e84919c412e1a379f5d248ec69a9b1fc3e047da
MD5 387624ba3c6749e39b4c1f3a3f0312ca
SHA1 c509b8438fc6822be1f02cdd708f35f8abe87a9b
SHA512 2acde7d89aeba9ba8e24330935e6079342556d15a6a86f23939ad11369ef549cb5bcd91f88df4a03240ba5ec9ac580271ebb3555a8b3f7730895b956fabfaf39
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vkTJ9+CR0:f1zkVmvQhyn+Zoz67HTJ9TR0
TLSH
T11B54EB47EE85B50AD70A2830C6454DF37900AB0543815E2BDBFC1E7E1EB264DBAAD6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Temp\4daf-e9e7-4255-cbc6\background.js
Size 49KB
SHA256 4866fd1b8227ea359c75c5bac2d9e6c71a954b76f1d2659ec33ab995f0bb7816
MD5 e711165993e7b1c16e26352dd325f3d1
SHA1 73046266d51a26e815dda566fd753df601566757
SHA512 eb000b5641be9bd412877b028389b1ba140485e6b17674c25d99340e26f580c5c9f5a2cc029f168a4e0e2c9e2926caa19ba56de572f40c929b73611101aa0aa3
SSDEEP 384:Ciw7zd6JieeKv5Qu7k1JCuXi0Qq7vVtUhdn1TYnPJ37QWPUMXYM6MpLfX6GoWO5y:/ALKaWuS07vV+hd1s7Qrpr2cIcE
TLSH
T10333645C39F3AC200A62B958C53B9852762060133C0EEC90BFDD96E02F6D66DD5B6BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\4daf-e9e7-4255-cbc6\content.js
Size 1KB
SHA256 970b3f002e0510e9a3395239aa75facf9477ad56e8915c9a00514fbc4e1d0161
MD5 110bea5872bb9c6db3682ffcfc0dbc69
SHA1 b9dd88ecec91dbfe4faf8adbbb31481b12c50ec2
SHA512 6bc5e424f763b3cbe4d73d240ad385941a393754a09ec43e3d439a244d117bf535fc38bc7992d8a07bc54f1649e221b8da7e0675d22e60be5fb48743e5a67347
TLSH
T14321D04A3DE41828D81370BD761F95123239E08B359DBE21BBCC5E906F248B575B2795
MD5 SHA1 SHA512 TLSH

Submit Download

icon128.png

Path C:\Users\Admin\AppData\Local\Temp\4daf-e9e7-4255-cbc6\icons\icon128.png
Size 13KB
SHA256 08c8c679108d6a9200c1917a96fb7dd0857b060e3583c5e8b9226daae3dd783d
MD5 7acabb33e87e6b4bb1181a40f5ce3d97
SHA1 b464b5c3216f993504f60da83367f434e08d0aa3
SHA512 5867a9bcf51c3c51c4c327b672d77de48c36342f9f3962a22f2ec995aa272d59d229ffbcad41420f7acc1c39e79ab712179ff8399290ff086c7ff55579133d58
SSDEEP 384:W0u2SaV6mCuJQlp+rWB5awh8gBpBZpRyn4yeDq:WsSs3WgkdnB/Ns49q
TLSH
T12D52C0BB78946897034370AEA481BBA4CE717E18F18DE5B10D41E0078A0FAACE64DFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon16.png

Path C:\Users\Admin\AppData\Local\Temp\4daf-e9e7-4255-cbc6\icons\icon16.png
Size 2KB
SHA256 0b8057b09fd62bb08e81e81a4aa11ba7e3ad6a890f392bdac9edea2d07ff10bb
MD5 89a75f7f3e0813f690ff772619cfea23
SHA1 7b926d88b3e01c706dbcefa879d3b6da80b49aee
SHA512 0adcd03ea2d88d8ccec8db662ab941947e6aee37561d768b27344b481a6db2818d3a823e19715a30ac567dd55d7760ca3132120975c436a1bd4895ddb772e675
TLSH
T1D1514CCDEBE068B2C29F6BFE99243344C0622F483545016C7F4574428A2B3EC14EDF66
MD5 SHA1 SHA512 TLSH

Submit Download

icon48.png

Path C:\Users\Admin\AppData\Local\Temp\4daf-e9e7-4255-cbc6\icons\icon48.png
Size 5KB
SHA256 80f02bb1be8cd96ea7fd3312a5343b6c7cb9cd88e2c57e825165da6eb1298a09
MD5 8eb6c74332027c78bc68fb044c225587
SHA1 cbfe1bd0e1c4579ff9828f482b32a024d7613f7b
SHA512 c4e25f7fca9b9aa8fc47bf95f81f328620276fdc8cd811bad7f9aaa4d368f42c4763703e22f3a20c5ade22657fb5ee8474056b2770db4cd05d1fa184c39635a8
SSDEEP 96:6EPEj/NVSTFHzoErX9e5HDgRFvkuPQDzlP+PHizW7V5jyHU8TISPF8d2wg0YptBd:tMxVSTlzJKAFvtPmlP+KIVdI1g2wept3
TLSH
T168B16CD4FA91CAF1A0ED96FA5FAA3759C4E11B43477B28312A81D1019C4F7F88908A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\4daf-e9e7-4255-cbc6\manifest.json
Size 834B
SHA256 580d407048052152eb3661f451340f1a89856e377ca6e00c5b1f3fa707825d71
MD5 8afa5eb2ec10cc6af668bc63c801cad4
SHA1 69e1f3c2407b62b600bc4f29557be0431908375b
SHA512 cfb3ed09360f1ea8f2501809b34df6b16cb0f61f7caddae8da0953a6b994ab2f06ee18c368a6c8d44a54ce5de0aa70c536c8d47611eb7c781a3797b0d6de8cd4
TLSH
T1AC018920CC648C7B12DC573929B5A2434A2007479E843D1C37DF904C8FAD62F00BB38D
MD5 SHA1 SHA512 TLSH

Submit Download

62b0-9b7a-4173-343a.tmp

Path C:\Users\Admin\AppData\Local\Temp\62b0-9b7a-4173-343a.tmp
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a86-957c-d82a-8700.tmp

Path C:\Users\Admin\AppData\Local\Temp\9a86-957c-d82a-8700.tmp
Size 15KB
SHA256 dc0e0c37c3dea17edfd910e98b97eda15a82188ee1e6717ff36ef1be0e2a1922
MD5 af4867db01eeb4f59382e07c24b8d85f
SHA1 ca48201d6a2bde54ee39d125d1c3b956f7e56c1d
SHA512 33f4d18c540fcd21a78a3dd4f42b71eb133157c81ee6d3959c49301d38068f72793deaaae8c5f81b40dabe569603667d77474cbffdceb8f7b404d741669d6ff1
SSDEEP 384:D8mEd3l6RPwzM/ohFGmLCkLDP7WfOU/8Gt7rsC:Sl6leM/ofGmGkLDKfOUTX
TLSH
T1B062D1890F7B51B2B64F2C7C48CBCE24B461BB2534ADE43AF674ED447C15982921C27B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcDs.dll

Path C:\Users\Admin\AppData\Local\Temp\AcDs.dll
Size 280KB
SHA256 8acac41af1c58db23a3f815e7c398a80266a3a3aefc9e7eed0afa4bf3a118c22
MD5 41cd7a1565f0fa5cfdba56a3c4871dec
SHA1 789a3546ca594958e0e1c9ba26936364bf104b28
SHA512 93291923115a4938756a97ec2b5b558b9e95bcabf0fd70ff9c80c797f7425af28d42ca72e5f097fb0921c6550e1bf497bb3e840590a5f97b6234bf46b7fb55e8
SSDEEP 6144:DUIzHaQLGB9Q3P7LSiB58m1lrNdkRMYZE:wlGGjQ3PvemQZE
TLSH
T1D8544B1B72B80CA9E96BC07D89579909E7B378521761D7CF13A0462BAF1BFE06D3D210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcUt.dll

Path C:\Users\Admin\AppData\Local\Temp\AcUt.dll
Size 90KB
SHA256 8dd126b518972b566da26b5e65739a54138041876609c2520f9c832dd0665471
MD5 e26f059e9d1377cc275454df5096f2cf
SHA1 df5f0bad7742dffbeb344ebdd9da7c307a1cb7eb
SHA512 b233e2e9fa421b4f245ee289b3ef16735399a808be258201410ad62e7b011252a5a134e0609bbd5fc46d389ec6e7b1393868a0a5901ff2dd55ccd4d9f99c46fa
SSDEEP 1536:G2sqw7wZpBMfLxC+9Gr+GefM/icydQBcWjVwPQ+8iAuA:GHh7wZpBgLxC+9Gr+D5cYQeoVwMDx
TLSH
T1B793286BB27412E2E665D17CC04F4E05E6B13512472247EF42308E6E2E77BE26D3DB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdMigrator.exe.config

Path C:\Users\Admin\AppData\Local\Temp\AdMigrator.exe.config
Size 1KB
SHA256 44dde8891b1a206b5dd29129c955714855a400c3c22415ab3ddccb39ab387c7f
MD5 684fb7d37ec376e00e70b0b49e3d4bae
SHA1 b62cb6666c0760c5c9255004674cbb507847c376
SHA512 2a1b3a55a6d64cdd677500661a4f3acc94431d791a4e77fde141a8b04fb4315b2d90b5c4478ead31a15ead922ec787b356e281a99009eda155482b553a4b2872
TLSH
T1151112519AC55AEE7F3006E2393B1118E73A4BEB044D40ADB0BD155B7F53A550163171
MD5 SHA1 SHA512 TLSH

Submit Download

Data_D.exe

Path C:\Users\Admin\AppData\Local\Temp\Data_D.exe
Size 541KB
SHA256 8cda89bcb9c8e09a16f0f7792a2f4e51e3238690b465aca6c82642ce46576ece
MD5 2987e979e9ea4804d01a6d6b8eacdb45
SHA1 ffc2bff7a4844d4cc1f294a3eebd479bb1ab55ee
SHA512 ce22647dfedcee0e9c97e2989501909336279b9b41bdddf93b00ed8a73fc7d4b9be0572b397cae2ca1eda1d0f2f553ce91df71beea0bb174e74aa7d88a2da5a3
SSDEEP 6144:i6lD1HaJHltdeADeRLj53HBNyg5wEsN5nBKCO:dlD2FeRLRQJO
TLSH
T1AAC49445F2044AE5D82947B995935F111B32FDFAE720164F118E382F3EB23A30DBAA57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InventorServerMarshaling.manifest

Path C:\Users\Admin\AppData\Local\Temp\InventorServerMarshaling.manifest
Size 323KB
SHA256 91855d410c72082251003daa39a888085f337e893c4504a177fc833bcfd1051b
MD5 474ea2d0ff44b41f159146591172c227
SHA1 8c9e1759232b0123e0e36f699d565183a0b94449
SHA512 6823f0a6c4d595f4000aec712a9c9ba76300ff695c049d924a0bf243154709b5b234ee5eebd1e38517929d15b5515cb231074f7b68547f7d9a3ecaf4af6c02fe
SSDEEP 1536:CaTn+ePkPd9wYLt9nbhxdZsVkhX+P6jjFxTMjAcIBM3y6xBa77w37yCBtxItDDAs:VqePNSd3Vgk+yoBa/HaxAD01BAnJxKc9
TLSH
T105646C4692421480D678034247397978959DF8DB2CE79C6C23BEFAC74ADB9DBCD03D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\QrEcAI\AC2AD7W9XB0\Default\5bL6YR8d8ww\Cookies
Size 20KB
SHA256 44451bca244147e52f655bd55cc38cdeffc45a803681e1c6d427bf73dc385c61
MD5 bbc524f9330d78a9a8abb6c8967ff6f4
SHA1 61e224e161eb9654519ac0e79c2cc519162f165a
SHA512 932c85cac1846339393296785bbcb38ddd0d964f2fa2cc0fce9c955f500698d5be457791b8eaf74a983caf4b2feac0b2cdb472d89996a51d51104e80cb0ad141
SSDEEP 48:TeW9aw/aHLopFMavU1iBNHridMtag89VtV:nPareMaZ5aMtax9x
TLSH
T16B92208F1F303620C0F48772E5C24AAB2E7C222C9327AD98EE4424B3CDD195BF5150A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\QrEcAI\AC2AD7W9XB0\Default\XAklUgeTlA\Web Data
Size 138KB
SHA256 fe0d3a460e5f622efc47a04f538a511a445ec62c56717ece783e282aa377f3e9
MD5 a323f76c648fe1230cca1056160035e2
SHA1 5bf20133ecb6074f436f850dd298739306415a54
SHA512 ef8a16e13a3a72c87ccbf720c81af4c645ae92e34f028b9b106d49a79bb7277bbc520ec8f68d318cd9c1e7bbd4d322938be4212726375308dbf9c42b9e4f2ed0
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Or6VumVLnH/:FnbZeMrv/hGtrEnf
TLSH
T17FD3994B3A743102DDE59A721CE050BB5D3CB16D8F55A5D4287620688EF2963B23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\QrEcAI\djRpOS7ML40\Default\5bL6YR8d8ww\Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\QrEcAI\djRpOS7ML40\Default\XAklUgeTlA\Login Data
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\QrEcAI\djRpOS7ML40\Default\XAklUgeTlA\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bL6YR8d8ww

Path C:\Users\Admin\AppData\Local\Temp\QrEcAI\nZ0gBu1\v1pny25i.default-release\5bL6YR8d8ww
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSOClient.config

Path C:\Users\Admin\AppData\Local\Temp\SSOClient.config
Size 390B
SHA256 a53387c5744e2b2421e4d0895bc3979b60711472c5c1842027c0dfecedda03b6
MD5 5d85cd374cf4aec6179ee2660b107721
SHA1 f5ed25fa3719a861edb8c3c2124449d4ba5227c6
SHA512 c69d24514c1fcc7def0b5af7dc3421c5ae96cf7e8a4e26f4b90629e250b05a89cd66ba2111f49149ca0d9c26f7fd27050b9bf6bd19fee166307366085a755e0f
TLSH
T1D8E020473584449FC37C03F5A839D5A38D9619BD43115C2DFDACBC50C5D6D1125C7E04
MD5 SHA1 SHA512 TLSH

Submit Download

UserData.dll

Path C:\Users\Admin\AppData\Local\Temp\UserData.dll
Size 122KB
SHA256 fbc515469a9f03e0b5b2810b432459fb52d6f9f42d3f1b7faf652506aa53ee5b
MD5 1b4cd535859770f8f5e3ca70afdb2b1f
SHA1 252525645a0c437ffb3a27c70180096e594a34ec
SHA512 5aae9c16f28d82e891aa3d1775cc46a3392934bf65f217de047be9f17010801864004a4139f148f7192dd6025184a82e114b89540c216efa3301419b844bf613
SSDEEP 3072:9Tw0jh+B7sBc3SBY7VFynOGlRYeG0HxNmE51pOmnDb:9TwShQABc97VxI8epO4
TLSH
T1EEC35C1776A802BCE167E2BCCA868907E3F3B845073547CF0750496A0F6BBC5AE7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac1st24.dll

Path C:\Users\Admin\AppData\Local\Temp\ac1st24.dll
Size 338KB
SHA256 3d7a9bbdea2e606b63a4eed1492c8fb14eb676b4349eac92096d5046a66809fc
MD5 75dabfe798a1a663824b3f0b079f7304
SHA1 0e74c34f8a446743caf9a3ddfda1070a05cc3bc3
SHA512 186f824802323661951ece5e1a8ad229ebc8c022dc61b3c9d301531043a68f953a3d0d3b879ff471a15b36bbf54c873383e427e9494cdda192a80e1b7cb6c7a8
SSDEEP 6144:u/okrVbjaATJyUbeITsGEp1GT8Gudy3WFR:urxvCpYm
TLSH
T15B743A5B73460DE2DC67E235CDC38685DBF2BC2A4B22D74F06A5035B5E273A16E2E205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acdb24.dll

Path C:\Users\Admin\AppData\Local\Temp\acdb24.dll
Size 17.0MB
SHA256 f85fba07e18c2d8dfc2a48d5c703713ba9a9f6a60166ed36fee5abb73907a33c
MD5 6c5e5120c65982f0fb600bb2bb4d0b07
SHA1 679d5e2551da141cf2166c1e6b485b25287fa5d1
SHA512 43510f42792d8f7cc75659a1d13b3ce13090ff6b3f23c6151b9802902cdbc0dc31fd226b0a4c9b1b0a7637b0dca55e1a5d28ce8aea30c80b7bca6622df5e9e8a
SSDEEP 196608:N/IvNSnfR6xKHSjtCZX3XQ8+k5zWR82aEe:OvNIf8xKH6cpHQ8XzWame
TLSH
T1A9079E1B73E542E6D22AE1B8CD57460AD7F2BC1A1337C39F0256899A1F6B3A15E1F301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acge24.dll

Path C:\Users\Admin\AppData\Local\Temp\acge24.dll
Size 1.4MB
SHA256 b30fa1dbc4255084324eca347c668037cad75b34f743f32fd892aba28e50921d
MD5 a05b222331f74261fcbad215ebe2f98a
SHA1 7f1811015b8c60685ff92a0d3441884038ba856d
SHA512 4b70dfd7b618a67da8cd93908456499823aa44ee4350c90993e35a0c56a89840844faf1d4e53d792dc84f9a47fb8ef45af6c67e6305d125979c5ee9271b3af4b
SSDEEP 24576:M0tjiNRZPrT7IJpBiSzaZ6YZT3SIPy+yF655KdBYI0HNVFbL/XuQwajn:M/NRZTMpYfTZT3SIq+yYNVVL/Zz
TLSH
T1E0655B1E7269129CC529F27C9A6A7402FAB230261356D6E707E64F142B0FBD27D7F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acpal.dll

Path C:\Users\Admin\AppData\Local\Temp\acpal.dll
Size 2.3MB
SHA256 cc5a8cb3887c0d0f8af4fe61267c85ce5b7f57aceb4e25d9be5ee93de8d53704
MD5 979455a4acc06e307d9aa1cbcfec7e9b
SHA1 633b1fc7034686c8044956e41b84059675075a13
SHA512 afdfc211e66889134be9212e8f1390387c426e1f45aa54a297d1ff6611c2eefd334f2e9435fef67e3e624a70dc827a0c5b83d560b8209c4cf2225cfa25998adc
SSDEEP 49152:cPx6NFSl7Q/zPqxw2ysRSJq42gE8caGoUaj5BPAF:66NFz/z8GJx5o
TLSH
T100B58D47B2B900FCD067C27886575617E7B274150720EBDF25A4866AEF63FE22A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apperr.dll

Path C:\Users\Admin\AppData\Local\Temp\apperr.dll
Size 44KB
SHA256 b2ffdd2e52c2a7dd52fb567c0d7c8f2e398c60c6470637bf236871edb2930419
MD5 d9406f30a56d1972ca98790156c07f6b
SHA1 122e2279e3a6bead10866c7830cf0938a2f267f3
SHA512 bdbafe0c8aaf3b7953dcc16da2782cf31439d3b221f3e8d41b1ecc1c84553d5811192113fe47d04f2f4fa1bae0464bf51495ef521e39cc06e14f74eb2ed4ff6e
SSDEEP 768:v8Pzoo4g0aXdmzCxIFmgOEa/DbVJvagOi+z7Wp9E+8iROK:v8hdmzCyFDOE6LOi+zKQ+8iAK
TLSH
T1C7134C1A675A00A5D5A282B4E6A70F17AF71F5E04B0853EF0372114E0FA3BC9BC7976D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcreg16.dll

Path C:\Users\Admin\AppData\Local\Temp\hcreg16.dll
Size 76KB
SHA256 7de87783c38494dadded37bc6ae4955c200a5fc6f9c732c218737d615470bea3
MD5 5d39e65ada6db1234ad9c6a3996ddcc7
SHA1 c0b679c0453d7e7cd0fe79cadf87e7742576a3f8
SHA512 d978a725f660a96eab777831b064a65023e4477dc987ebe3e93165cc0214b7bcc6a757f6caf39d6a05f13b23ec35bf70ccaf899b1388fc53648568f8bc77ec8c
SSDEEP 1536:poMgEUIVhZBrBhRa4YecwVux/wrPMerd+jCHp8Q+8iAz:iMZ9Z33a4Yz2ux/IPb+eHpjDz
TLSH
T17F73278DA6A95174E162D07CC5AB9F12EAB1781193108BDF03358E5F0F327D0AD3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heidi16.dll

Path C:\Users\Admin\AppData\Local\Temp\heidi16.dll
Size 1.4MB
SHA256 94e8b5c8cf7bed2bfb95afbc27565c2b389dd93b2311ccd7e3a76d51de89dff6
MD5 ef07d1baf17418b7cc47857d5b1f71c3
SHA1 7fbb742c27fe7ccea99a89f856d15afd194a0b83
SHA512 4ab9cad5db73aa60e9d58c6a6137d6c26244257071f9a66294e7cb704d8037154f816406abee68d6581ec6b8833ed12ec25d38129e8800abcb026bd8f801b4c4
SSDEEP 24576:dceuIENiRMf4HIpBgPC6FSbJAPkZCp9MdRGCeZMyZeSWVRVOCVgvd9zX6I8PXtxm:dcLYg4kiyi6Cp9MdRGCeKyqrtVgXWG
TLSH
T19B657C17B1A890C9E07AE038EA577507FA71385A072565E707A186D22F3BEE06DFF311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kernel-eng.dat

Path C:\Users\Admin\AppData\Local\Temp\kernel-eng.dat
Size 7.3MB
SHA256 906b26cba5102d1a4032788fa3360baf97ed6c312a9f9ae8a59b08ce430a46d7
MD5 8c8f30f79763a1389f64e3f8fa916181
SHA1 a316824f86db705d2b28c503f31374b351998ca0
SHA512 2f97bf3f50e46c62eac2cb3c288296472f93bdf299131dd13ab4fd8e5ad01770d5a2f7b917734e55aac538889e3f95a139e000f218fd02440b8f077e4af5fd54
SSDEEP 196608:v5+ZAvRTM4C1bumpnp5TXukk8GOIP/N6SmSnhoydsWx:v5+ZAvRSFY8GOKN6S9x
TLSH
T1347633C388304BE9FD2D1A7A5F2656908481F66A1E35BFE87505D70B012D7EE8E387E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\Temp\mfc140u.dll
Size 5.4MB
SHA256 d9b2064cfc76b0f78700c6736cd634b3095f3dd987ce9079d27a03677a991d62
MD5 f36e72d1a521c70d0a6d67bdbfe8961e
SHA1 1507b7b4c70132fc212fba1531f8ab396f00f878
SHA512 a54e724c745c0317bb546bc7ce27c1c7de882c786d063731741c435f81463eeab4ccb500f0c0c6b8c1f56af2049fcb17cd5be5a63e0fd962c35a79b337c3df4f
SSDEEP 98304:CUon/oeUxcmS6fd8kFLOAkGkzdnEVomFHKnPZ:pon/7yBpfHFLOyomFHKnPZ
TLSH
T126468D867AAD0494D569D07AC7678E5BD7B3FC50136183CF0162679EAF337D20A3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 626KB
SHA256 e1a99ac49449ef7fcf07ee571553870f3c7bb8b3fdad97ea93276987ecff0333
MD5 bc127f7392bd82f2937ec7d4eed0c5af
SHA1 b7b0b15ab99b1d14802251d43c0f4e59b5d27ce7
SHA512 1f45664867c05ccde52e13cda262d0f2a90928175cf9477bbd9f2dc8cd9db79323a54dc81d7ffb07ab51c2febfaa557f110c613aa20f57688d055e2fd566381d
SSDEEP 12288:O+TTIwt0B5483RXXoTk4iQKQEKZm+jWodEEVUsS8hx:f8wdKnIkPQEKZm+jWodEEmsSS
TLSH
T137D41827BB5906A1D16693BCA5C74306E3F1BC154721A3C742EBE26D2F2B7C8673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plcfmgr.dll

Path C:\Users\Admin\AppData\Local\Temp\plcfmgr.dll
Size 720KB
SHA256 e2a191e64e029d17658b3c33b7c7ba5ec1758aada9c826d5f65a7af13d72fc30
MD5 9d22a945fba19a218c4ca4aeb6417e88
SHA1 4a41ab5ee1713e249eabeaeb6136f5a2ea5f1d03
SHA512 c8a690dfc3693e1e17e0ca25b39cbb720c132e564283dc6859333d68ef77db0aef372cd3879ab18c4923dd27a1d7fdaa9fb3388ce8a419d69561425989ba487b
SSDEEP 12288:HE1UM/mDhILkxMRo2lgfCfiFD1Jf/PvcQOs:HE1UlD/xMRo2lgfCfiFD1tPx
TLSH
T1DFF43A03ABA602EAE1A6C17D9A37CC21D6733485073597DB02A1D9774EAF7D0EEB5301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plotcfg16.dll

Path C:\Users\Admin\AppData\Local\Temp\plotcfg16.dll
Size 731KB
SHA256 c6d6e22f4d9c2e1d560fa26db27bff19fcb2241af38a42cc622429d046b52419
MD5 4861b01b500f1e3571a0d8d785d59e9f
SHA1 4a0719c8dcb231e262fb18530602c3c505de88fb
SHA512 f60dcf39a60c67765a703a4f3c4952a5b686f4e5cb07a79bd00858ce3303792d76d1c826202c5bc64fd73d9115e97216d50d184e78924d8d6ecf902f8325b6ef
SSDEEP 6144:71cRAwu0gJo2uIdpTS2IX+bXdWmzffQmthamq9YWZbWZJpYrJ0odcIOkT1GGigxR:75wSpb/S2IXKXdWmztUmqBbxt04ME
TLSH
T127F40A53B66D0192C096C2BECFA78812DE7534C51B17CBCB0AC0DAAB5E677D467BA700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolinit.pdb

Path C:\Users\Admin\AppData\Local\Temp\protocolinit.pdb
Size 36KB
SHA256 dfb4358175ae4aecd5dfd04dfe8c53451fcbbac7046f2d5079ba325208831e2b
MD5 9981176fb07ebb79907c1b4f96e23bd8
SHA1 9ef89518a10730310926803cafde6067c0382a3c
SHA512 dbb4093ce46a5c5453ab86ebf01c8f3593d9e8483f23f0f37cb74dc9b45fbb1e0128b5f1078b3567fa0ad9d9adf69d4419c363e0e68423bf3e48a87010255d35
SSDEEP 768:O7c4P7Yv5gET3nqZrAXIgByqcipg4IoqBGOaQhQLgOBXJpM027SaR:aTPERLTXkrAqX4uXxQzo
TLSH
T16AF29DFA896E1B78A90CAA5F5A2C74A3C240F836394F515772CD1C2F3825AC5E725CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.3MB
SHA256 db6bc090827c93a24ed59bd73a6889f99b284c59e9abc9ad8bf1985d0b6ad14d
MD5 40ddc069a568ecb3f9db9e8a439278be
SHA1 8e4c5187915e3c224e6e9e2e33ff1de1ba8b947b
SHA512 451ac7db53dfbcfc31ed9bccb754eb7066c114de88b752af72c0aae4a0430eaf6eadb2fb66e54cd7564d151cea4af413fa3d5e996a1ab311608b9190832cafdd
SSDEEP 24576:HM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszZ7ymxvSZX0ypOpT+R:HM622DUVOb+uiMfE+nzTv2Apvz4VpQ
TLSH
T17055BE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.dll
Size 208KB
SHA256 31af29c03643f8396a6f26bcd601c6369d26493d7d78b714827ab2801bd284c7
MD5 a0e2cc1573537419a7b9327f9062d448
SHA1 91fd74d0575834950daad76141a228f281b3eb14
SHA512 910cacccc219c097cff2536fd3bf8fdde54ba4b5b53302728558bd9fb87659af98a4a5234e82a598d15afe76c8c3b09bd1b2d942f61815d0abb6c424015f1e88
SSDEEP 3072:ph5JGDoLaBCE4OUeYgXqN8Ak8EwTJhdTvOx6zZlNJZYzZ/rBQCd9:pkDokCE4OUAoYeZ3JZy/rOi
TLSH
T1B0249F8972A4007AFD778234CA635A06E677B84607618BDF0390837AEF2F7D5653DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\XAML_amd64_stable\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1500-101-0x00007FFA26610000-0x00007FFA26670000-memory.dmp

Download

memory/2424-735-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-733-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-238-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-469-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-526-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-233-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-346-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-211-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/2424-208-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2424-736-0x0000000001000000-0x00000000013C9000-memory.dmp

Download

memory/2732-332-0x00000000753E0000-0x000000007542F000-memory.dmp

Download

memory/2732-241-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/3384-474-0x00007FFA19320000-0x00007FFA19380000-memory.dmp

Download

memory/3384-470-0x00007FFA19320000-0x00007FFA19380000-memory.dmp

Download

memory/3384-529-0x00007FFA19320000-0x00007FFA19380000-memory.dmp

Download

memory/3408-222-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/4144-157-0x00007FFA2DBA0000-0x00007FFA2DC00000-memory.dmp

Download

memory/4144-155-0x00007FFA2DBA0000-0x00007FFA2DC00000-memory.dmp

Download

memory/4144-181-0x00007FFA2DBA0000-0x00007FFA2DC00000-memory.dmp

Download

memory/4564-702-0x00007FF748A30000-0x00007FF748B6C000-memory.dmp

Download

memory/4564-531-0x00007FF748A30000-0x00007FF748B6C000-memory.dmp

Download

memory/4564-534-0x00007FF748A30000-0x00007FF748B6C000-memory.dmp

Download

memory/4680-186-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/4680-183-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4680-185-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/4680-206-0x00000000753E0000-0x000000007542F000-memory.dmp

Download

memory/4680-187-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/4680-192-0x00000000753E0000-0x000000007542F000-memory.dmp

Download

memory/4680-184-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/4680-188-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/4680-189-0x00000000753E0000-0x000000007542F000-memory.dmp

Download

memory/4680-190-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/4732-734-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/4852-263-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp

Download

memory/4852-468-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp

Download

memory/4852-386-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp

Download

memory/4852-223-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp

Download

memory/4852-209-0x00007FF7F62E0000-0x00007FF7F64D5000-memory.dmp

Download