hijackloader | 94db5892d51fa7f24c6f406591d5cc143f48f3f9f576c66d36a8682e3950102b

Analysis

max time kernel
150s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy1.exe
Size 6.2MB
Sample260604-ajf47afx9x
SHA256 94db5892d51fa7f24c6f406591d5cc143f48f3f9f576c66d36a8682e3950102b
MD5 162ff0e44be47582afbdb55d63f9a760
SHA1 4b044deef0ffb8120751dc28a80231d938d67e05
SHA512 ff426ecda13dd59a46bf994b35c119eafc2e170069c663b8e74b2bef60b7a958f30668b6d86717a1190c8b18cd7f129083b2625fd487e37165cfde6ee486c64a
SSDEEP 98304:+ppHzgns7ZEbnfIk/mUNm5Q8D0s7nWBT3NzSvu2nMsIaekBN33gQ7RFDy6gw7E:+pBzUs9Ebg5DbKLNzSvuSMPaekXpzBlA
TLSH
T12E56330937A4FCE5D231C2B3CF2CCB564472EB9692881E1347967E866DE34A5410F9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor credential_access discovery hijackloader snappyclient loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\guard
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

snappyclient

Attributes

additional_fields
false
buildID
main
cache_directory
naijaco
default_directory
%ALLUSERSPROFILE%\Mayanex
directory
Nata
events_db
Jifexabo
keylogger_file
Kapuq
shared_memory
true
software_db
Mitonico
tag
new

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: SnappyClient
SnappyClient is a C2 framework with information stealing capabilities, written in C++.
backdoor stealer snappyclient

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x002500000002b25f-25.dat	family_hijackloader
behavioral2/files/0x001900000002b4aa-72.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
3988	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
3952	FrameworSwitch32.exe

Loads dropped DLL 7 IoCs

pid	Process
3988	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
3952	FrameworSwitch32.exe
3176	VectorDrive128.exe
1792	FusionAna.exe
5056	Crisp.exe
2140	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\desktop.ini	VectorDrive128.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-125073035-2952146151-721812867-1000\desktop.ini	VectorDrive128.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1792	FusionAna.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 3176	3952	FrameworSwitch32.exe	86
PID 1036 set thread context of 1792	1036	FrameworSwitch32.exe	87
PID 3952 set thread context of 5056	3952	FrameworSwitch32.exe	88
PID 1036 set thread context of 2140	1036	FrameworSwitch32.exe	89
PID 3176 set thread context of 2852	3176	VectorDrive128.exe	93
PID 3176 set thread context of 2664	3176	VectorDrive128.exe	110
PID 3176 set thread context of 2852	3176	VectorDrive128.exe	93
PID 3176 set thread context of 4996	3176	VectorDrive128.exe	116

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	VectorDrive128.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fr_MASCULINE.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sk_MASCULINE.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\blacklist	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.dll.sig	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_MASCULINE.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaremr.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ml_NEUTER.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja	VectorDrive128.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationProvider.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sw_NEUTER.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW_NEUTER.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	VectorDrive128.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_FEMININE.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\uk_NEUTER.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\manifest.json	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	VectorDrive128.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.Serialization.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll	VectorDrive128.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\mr_NEUTER.pak	VectorDrive128.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms	VectorDrive128.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui	VectorDrive128.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\guard_framework.job	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VectorDrive128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kythy1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FrameworSwitch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FrameworSwitch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FrameworSwitch32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4664	chrome.exe
4488	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250057168501707"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3176	VectorDrive128.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3988	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
3952	FrameworSwitch32.exe
3952	FrameworSwitch32.exe
3952	FrameworSwitch32.exe
3952	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
1792	FusionAna.exe
1792	FusionAna.exe
1792	FusionAna.exe
1792	FusionAna.exe
1792	FusionAna.exe
1792	FusionAna.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
5056	Crisp.exe
5056	Crisp.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
2140	Crisp.exe
2140	Crisp.exe
2852	chrome.exe
2852	chrome.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe
3176	VectorDrive128.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3176	VectorDrive128.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3952	FrameworSwitch32.exe
1036	FrameworSwitch32.exe
3952	FrameworSwitch32.exe
1036	FrameworSwitch32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	VectorDrive128.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeDebugPrivilege	3176	VectorDrive128.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeDebugPrivilege	3176	VectorDrive128.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3988	1164	kythy1.exe	83
PID 3988 wrote to memory of 1036	3988	FrameworSwitch32.exe	84
PID 1036 wrote to memory of 3952	1036	FrameworSwitch32.exe	85
PID 3952 wrote to memory of 3176	3952	FrameworSwitch32.exe	86
PID 1036 wrote to memory of 1792	1036	FrameworSwitch32.exe	87
PID 3952 wrote to memory of 3176	3952	FrameworSwitch32.exe	86
PID 1036 wrote to memory of 1792	1036	FrameworSwitch32.exe	87
PID 3952 wrote to memory of 5056	3952	FrameworSwitch32.exe	88
PID 1036 wrote to memory of 2140	1036	FrameworSwitch32.exe	89
PID 3952 wrote to memory of 5056	3952	FrameworSwitch32.exe	88
PID 1036 wrote to memory of 2140	1036	FrameworSwitch32.exe	89
PID 2852 wrote to memory of 1480	2852	chrome.exe	95
PID 2852 wrote to memory of 4288	2852	chrome.exe	96
PID 2852 wrote to memory of 4288	2852	chrome.exe	96
PID 2852 wrote to memory of 4664	2852	chrome.exe	97
PID 2852 wrote to memory of 3020	2852	chrome.exe	99
PID 2852 wrote to memory of 3020	2852	chrome.exe	99
PID 2852 wrote to memory of 3584	2852	chrome.exe	100
PID 2852 wrote to memory of 3584	2852	chrome.exe	100
PID 2852 wrote to memory of 584	2852	chrome.exe	101
PID 2852 wrote to memory of 584	2852	chrome.exe	101
PID 2852 wrote to memory of 2724	2852	chrome.exe	103
PID 2852 wrote to memory of 2724	2852	chrome.exe	103
PID 2852 wrote to memory of 1304	2852	chrome.exe	104
PID 2852 wrote to memory of 1304	2852	chrome.exe	104
PID 2852 wrote to memory of 4364	2852	chrome.exe	105
PID 2852 wrote to memory of 4364	2852	chrome.exe	105
PID 2852 wrote to memory of 2432	2852	chrome.exe	106
PID 2852 wrote to memory of 2432	2852	chrome.exe	106
PID 2852 wrote to memory of 2164	2852	chrome.exe	107
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2664	3176	VectorDrive128.exe	110
PID 3176 wrote to memory of 2664	3176	VectorDrive128.exe	110
PID 3176 wrote to memory of 2664	3176	VectorDrive128.exe	110
PID 3176 wrote to memory of 2664	3176	VectorDrive128.exe	110
PID 3176 wrote to memory of 2664	3176	VectorDrive128.exe	110
PID 3176 wrote to memory of 2664	3176	VectorDrive128.exe	110
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 3176 wrote to memory of 2852	3176	VectorDrive128.exe	93
PID 2852 wrote to memory of 2228	2852	chrome.exe	113
PID 2852 wrote to memory of 3056	2852	chrome.exe	114
PID 2852 wrote to memory of 2340	2852	chrome.exe	115
PID 3176 wrote to memory of 4996	3176	VectorDrive128.exe	116
PID 3176 wrote to memory of 4996	3176	VectorDrive128.exe	116
PID 3176 wrote to memory of 4996	3176	VectorDrive128.exe	116
PID 3176 wrote to memory of 4996	3176	VectorDrive128.exe	116
PID 3176 wrote to memory of 4996	3176	VectorDrive128.exe	116
PID 3176 wrote to memory of 4996	3176	VectorDrive128.exe	116
PID 2852 wrote to memory of 4488	2852	chrome.exe	118

C:\Users\Admin\AppData\Local\Temp\kythy1.exe
"C:\Users\Admin\AppData\Local\Temp\kythy1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\FrameworSwitch32.exe
  "C:\Users\Admin\AppData\Local\Temp\FrameworSwitch32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\ProgramData\guard\FrameworSwitch32.exe
    C:\ProgramData\guard\FrameworSwitch32.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Roaming\guard\KGYHGSCXTDQNHC\FrameworSwitch32.exe
      C:\Users\Admin\AppData\Roaming\guard\KGYHGSCXTDQNHC\FrameworSwitch32.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Users\Admin\AppData\Local\VectorDrive128.exe
        
        C:\Users\Admin\AppData\Local\VectorDrive128.exe
        5⤵
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3176
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2664
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Roaming\COMVpn\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\COMVpn\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5056
  - - C:\Users\Admin\AppData\Local\FusionAna.exe
      C:\Users\Admin\AppData\Local\FusionAna.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1792
  - - C:\Users\Admin\AppData\Roaming\guard\Crisp.exe
      C:\Users\Admin\AppData\Roaming\guard\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc496cc728,0x7ffc496cc734,0x7ffc496cc740
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,1823308091455145288,3283329995694125562,262144 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,17598028237145964852,4548679252430382943,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,9151302952131133142,16432399193507343360,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2800 /prefetch:13
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,4188588483082715837,9395904453963112184,2097152 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,6395851727004164179,15318935227083728901,2097152 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,11210372639139138427,6431678309533706073,2097152 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,6980862964444582962,2865664407301863086,2097152 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,6422832929563523376,9190261059524829547,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,584141850222389848,10815501949244981250,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,13136381680083840428,4231228460822850744,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,18012602525850317119,1248466449389571069,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5092,i,9610308016503853963,9020635449542219317,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,9238815185048587252,9463168577078504621,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,147605525082458337,9129980646900796670,524288 --field-trial-handle=1936,i,2333500241077659926,9116610894725349740,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1448 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FusionAna.exe

Path C:\Users\Admin\AppData\Local\FusionAna.exe
Size 217KB
SHA256 48b9596b3c7b1af2c0c5cd62a815f7e43deac03ae3e91da26e8dec2891c915be
MD5 4b26b4b4f38fee644baccefc81716c6c
SHA1 6036d5f882e7e189859e58fbbd4421a2b09b58dc
SHA512 76d2235e29a906c8973374d2ec3cb549222d431695daf6ceda2aaeee95fd5bb35dd57d53a73d9a7be04fe38d10f81eee398bb81bf3c104bd0fc17e871d081a60
SSDEEP 3072:MB1yXwSGX9Iu1NPDnmyIkGX91y1Wh3m7OaZBPvJrz3nYu9I:MB1uW1RDnmQoHyJC2ldYu9
TLSH
T178247C06B79900A5E4B79538D953A216F6727C610B348BCB43605B7A3F337E5BB3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 22b59532eac395774da150be2b3ff3b2eb96b6d4bc5c38ec2fc3c6ffdb16890b
MD5 d6370f9788764d650e04180c95ec4296
SHA1 094dc28eab4ca86357dce04403f31cf7a9f3bb1e
SHA512 6bd33610c9258916cc667610f75a1f72460472dda142539d68ff07b67de520890f44f6430fe4966d97b4563c77d5d11593eb38d586e90c6eaf22fa09724e2b24
TLSH
T1E6F0F9A9C921DC3718FC0B1C30A44B46F7A013672B41895F3B3C920C8F7573B429586C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 a05ac4aa5cb5981a8f174ce8fe06c9c4208e6aa4b3033dc9377bb54c01faf6c2
MD5 a95b2ceefe7bfdfaf19aa914169dee7a
SHA1 80e16bc331ca75089b85a671911dfaecc7ee92db
SHA512 2f73c63821afabd3fc6c418286189d4af91d3850210cc39d5c1f59eb8acc9c0155fa780bc870ced05feac3c332c9e024c8a62f8fc34072a4464d516150174fed
SSDEEP 3:OlH/lbZvagZe/lzl/bK+vTMsblE1XamgMUWvSIytkvqK1caa+:KHAlzk+osBOkMPqIYg
TLSH
T156028C9E811E6C28C0CCE9BACA2403A0D3130E0183DC0F08B318B072201070327FF0A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 a69295c474393ac71e5062dca0ec4d985b5a3408a28867f8178ec541f2b62984
MD5 df2118e509181beac5f83ae44cc0778e
SHA1 30c63f81a43e13301717bed353de93579068e20b
SHA512 e42e5e13e4055c104192471cf87fe38c43182d43adad4c99e27edc5b7a4af853fadc5b253260ce3e43e795bd5c2caa3a57f949f35375f9db1f3636d56abef21f
TLSH
T162E0864974D9D3EE645984A383B8A34E8EE07448A6CA7E462705A44461D150462E0275
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 2KB
SHA256 c85eed2e0f4f4119f8572a6948c8bb17a0599a50a88fb4cbf2372d1508ea0b20
MD5 fade5841903ffdfb2f166c6a0a12eebe
SHA1 9ae5abaa80f95ea326bd8e6e3ee5484a906bf7b2
SHA512 b6a3fc797c158cb35828d5df29a93c33a7c5470af9e7efdebad64e6e183edc00156cafe808ec007a36277518bce849400e97895c8a55fb2764d5a4b564b36f27
TLSH
T1C041138D2AC027A3FE7F487AAC4253532FB9A16405E514D763F8AD812CCAF6513170A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 a41d9d9f6f581b8e334c21d1bd14b61665d2c2424f2ef32463ad636f660e26f4
MD5 32b2589e04038113b2ddaee5b63146e2
SHA1 066fd126e65d23225bbb3677a3d93adda654e593
SHA512 802d1e589b834877f2966fd69f406c6c386439660359c4ab0483535cdabcd1738fd8eb084a16de55418a6f807f702dc753ef87b4b65dc3b0fc355d7cc4a5f134
TLSH
T150E0CD4539EDD3EE6495801717B4E70DCED4744CD6DF15662701F88491C5404E3D1272
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0314a4033c09dc48046dd6dc7f417c0473df1190d89bff289f4d6859203543a2
MD5 337dd07287fa9039026bbaeec02165cc
SHA1 91d5908148c29ba0aebec17bfcbfb0bce9958000
SHA512 889eadaecc74d12200e022afb162644b8f2589acb6ecf416d1170841dbeb2baba053e08528937677cfdb056b741fe658db5c329f62ea002e6cccf53e9bdb1dd5
TLSH
T1FB518BB3C3D8C66D881152F4AB25AE1FCD390A28522C3C5688D4AF4F53E2872D60039E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 3e5c75ed6fc693d0b384f8273b431d1cc1ccdbf04399dcd3770fe0a984a8f326
MD5 0ff98bde644b07430fde98957b32048a
SHA1 5cb492c7e04b37af8a01727df49440d50fa7e717
SHA512 d77f73b0792f3f68ca1683e32228b2bac2e29a3fe735ab21cc87bd6c036eb82e2988c07247718ad78f53e31085011c55e2ebf331c6050139205bf71e1c959759
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOg:OIEumQv8m1ccnvS6VG
TLSH
T156F2E1FF07197601C0E49674D6810ECFFD2D051D4B9BBEC09AAC05F3AB865A3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9328069f9f21733aa76efc91aa95423fbd114fc70bd1797c82609cb2b01f8f6c
MD5 8bcbe4a10a4b067a6898d260ffb27bc4
SHA1 64827de07cf0f4b9e17d1e5ea15b2247db58e329
SHA512 4ebd0ec9d8106aebd9a0bd7c9b44e96e34a5a9d0d1c5d7e0aa861672ff545c527da0ca878094a9b58aa4d0e7652a17ad685352ff9a91404fbe94e4bac1ed0b45
SSDEEP 384:TRVUfGszSv2bVF7xy1CyoCiZUXKrwLdHj2IS0e:jUuszSv2bVF7xy1CyoCGjrwRHj2v
TLSH
T1D042B62EAA106D3B5CDBD219FEA57B53D7F5102125812E84EAFCCA5C18E79CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d63fcac952cfdf59b4978501fe4b0f88b8132c248acb45e8f8b356a70cae73c
MD5 4e3bdc8728371b526bacf0c4170ec331
SHA1 6feab403375f76622a26016b621ccb96e2bafcc4
SHA512 a0ee46d0db3fe44fb72b77c678e7ce6b2bb85fceb60ae1baa3ab3a02d19aa199f42598c0b1e2d3e671ed6e7ddf56443afa25b66feedc176e93a818b611841721
SSDEEP 384:TRVUfGszSv2bVF7xy1CyoCiZUXKrwLdd2ISa8:jUuszSv2bVF7xy1CyoCGjrwRd2n
TLSH
T13B42C72EAA10693B5CDBC219FEA57753D7F6102525842E84EAFCCA5C18E79CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dark_logo

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Search Logos\dark_logo
Size 36KB
SHA256 584c193757d0c6d17a78dbecd0c3437451bd962aff533b6447d0f85b461affab
MD5 786e6e1dd8a59cacf2b323f6a1a17aa4
SHA1 bdcfdfc373ef0181b74e56c8fdad63a8e8cddef0
SHA512 efee85a4b19022dd891f841147a466f7731274846b9b3e6569bbc5299498536d3af8b3a0dc68c43467d21fb1731f9d317fb8db91b2cd31efc7ef042912d63cf6
SSDEEP 768:kFWtUFEpVdqx01howzKNUnSOX58cDzhjEqsFgPrQMB6quqAbaFnVpx:kFWeedqxOEKSCSmhjRSeM5q5Fbx
TLSH
T17CF202D81959763CCF9AAAE610D37C4B8014FC998A2EEC9D41D53F257F7015A033ABE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Search Logos\logo
Size 36KB
SHA256 28ea6350fb9d5375a0c334aa1a3948c30c62bc2ee7f64838cc6f210b70e95743
MD5 f4d71f712be0e3585315570e0ae50676
SHA1 ce9bc4ec8deea1fd92e83d6f61c9ba959b101f5d
SHA512 4a0ebd0fad9ae171c51d5bace61552c537fd7ce49fcba33f8352cb9be493da8e3a1df91a236d600c38e0c27e5c0a59defb5922b460b327626d9f1bf5570beacb
SSDEEP 768:jlbCNmxkAVlpcqvVnQ7TUpO5CO0Gs/x8KHO8++hev8k9NLV:oskAbpcq1ToOhOKHO8Yv8k9NR
TLSH
T1D4F2F12E3D652C42FDF0011F67408C8CCA0F9C72E7298A694B60757E4F369B3392696B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Search Logos\metadata
Size 1KB
SHA256 83867f9fe51b3b0b0d499a8708694a481c1fde380cf048553bc4aa654e580c12
MD5 54535b2963ba94e54c53ec052f1a2e27
SHA1 e455f35ecbc19d8593840aa3432212afa49a90d8
SHA512 48391129c5e5b4c1dde8c8e4c2dce2f1aa558c51242a263586b91d3b33d8ab00f6e25fa45cecc1ab60c54a4a1d13c2253d968b5ef48ea781e61a7ba050ad5e03
TLSH
T176219ED37F0CC55B57C0A2E7704F0B0C9CDE600976A47842C2997D6C2AC89122B1E69F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 72867f59dcf231ba02aa06ba90767dca2ecb652a284b6bfa3dcd613652a29be4
MD5 90bc9282d65e2559107bed1b8da81920
SHA1 12d887335019e6443236aa9bb6d00c682911c66a
SHA512 d862ff711ea5fe6856caa3b44ecb40c4d6a9e780940149e5697779ce04d84d40b9f0cc8376b1c0a3d8bb135b45baf1fb58a39c8d692789f7b769306f1003972e
TLSH
T130B0120080015202C08303F033925588B2145F26A70E570143E07936CC2D1618014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5923ca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5923ca.TMP
Size 96B
SHA256 f6550ce669508469b620892c1a6391b657919bad5a83a983315e070ab8c8e156
MD5 b21801330d5eaaff0d3553954e11d075
SHA1 c2f3511290c34e02f6820d67a26dbb6cb4399660
SHA512 390ccaba498d803ef601354a10d86e3cbc5cf2236a98c36a5a409468e0001e88ece1356be1ef2ab537d31f66f1cc561671704b7b8d8d6327083e60be59240b37
TLSH
T13BB02200F80A3303C08303B033C0C0E8F220EF2CEA230202C2F00A32EC202300828220
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 274KB
SHA256 c0d6e65210d6d31a5388bf1c1ec3b9f5f999368804fcb7ee09f4b49117594d1c
MD5 ce50dbb36a03a52c0c9c43e548037fbe
SHA1 b6e20e6c633b9b38666d7f56df548521c0bad551
SHA512 c0b8653e53726c132b466e5df01079c0095723a9e330173336d1b8275498f315dbda06b61829b5b098c4cfb2cae64a5e0aad0e34f4cc8c06e620e07ddfb6f827
SSDEEP 6144:XbTikWzFZcj9AK9I0shvtVNYvvm7Rkm1tYpBeh2BAo/:XlWhCj959xQ/F9oBGcAo/
TLSH
T18C542377DE3EBD394DB8960DA0882B057EF157719948DE858CA42F48379E6C8490F0B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fad9c967378c7b6b5f102c8f7da80513867e6b74389793db511dfb224ac2685c
MD5 422e5cc0ba149aff5738c07ff4c878f0
SHA1 a7c4018d4a8b4471e28ffece13c7e3765f5bbc90
SHA512 1e252fcf9b87ca84d71ffd62fa1c8372f4951cd42474e8e50aca21ff9244d898b75f42419d2d4f7fee26661a083e61c83b979b7716803243e086308c38d4f1d7
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:wm7Rkm1tYpBeh2BAoi
TLSH
T1F7C312375E70E9765979AB0EB48E0B1F2EF149A6C920DE82C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 c216fa61dff7ba6a0acf1d4c026aa7db20c7cd1217007a1c34f44c35feefef0d
MD5 b796598ffa59ff5e87c2a655acb6cd56
SHA1 5b2ce6515c84ed15801a1fdec4d718d2fd0e5008
SHA512 3f173c042e2088af0a50d40f024b62fa013c571ee46d4f5b6d78f915645e7ef5d2a2288cb39d741a5c0aff4d5499354b63b9fc3b0bcd68a11c387a9e4cb764ce
SSDEEP 6144:u6TikWzFZcj9AK9I0shvtVNYvvm7Rkm1tYpBeh2BAo/:uAWhCj959xQ/F9oBGcAo/
TLSH
T1B03412378E39F9794AF9AA1DE09C2B092AF156218544DE85CCD42F4837EBBC8090F578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 8922a742cdd26e43ecbd3e43e661b497e77736ed20ec74302674cd720ca98e68
MD5 b941e6f9da2cb4289b473b7589fdbf4d
SHA1 93d82648412c0a703592822bea4988c58a51d02e
SHA512 bf7f7611efee3b4c23d8372faafe7d188755ff0dd86647f711b53315f6158e50557af83eaf976da1340ab3a00b5fb4ae7fb6acfd648437e213aba5f3c95d5ce7
SSDEEP 6144:b6TikWzFZcj9AK9I0shvtVNYvvm7Rkm1tYpBeh2BAo/:bAWhCj959xQ/F9oBGcAo/
TLSH
T1BD3412378E39F9794AF9AA1DE09C2B092AF156218544DE85CCD42F4837EBBC8090F578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2106956.tmp

Path C:\Users\Admin\AppData\Local\Temp\2106956.tmp
Size 40B
SHA256 169b34bfee84308f5fe40365dfcb02c4f37d6e6e61f6e16ca11470448ab79310
MD5 24d57fea831a25dec78cd1e1c5f9750b
SHA1 1790ae4e6ca2e954a35aa5adc8b4bf6af4b9e350
SHA512 8940a0a4e9c50ee612a8201a1e7598463e45839ac27e0a4ec2c2bb413346a6930e19f332db7096fd9477f4efac6291668b72aa51d8214fdbc1eeeeb0aa1d7332
MD5 SHA1 SHA512

Submit Download

2FC72FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\2FC72FB.tmp
Size 40B
SHA256 e2b698cf1ab70651df4b5509ebd5515255272c80d51bb311c2737f6cd389b554
MD5 409278d88816c7138aab59ed93254fe7
SHA1 6e4ea21943f95223b1a7c5f37814769e571f5f63
SHA512 0d1cc94e836cdaddfecfbd66bd8254a97f56d7d351c55325084ab138f7d93681632f4dc9d3c2a480a69b140617889189fd9409b46ff79e4e5f44835ffadfa0b8
MD5 SHA1 SHA512

Submit Download

D0A34A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\D0A34A7.tmp
Size 7.1MB
SHA256 19782eacbf1e47d0c8171967b56bdc07037e85853f7943b0bf3dac9d06816fb0
MD5 07a683d7bc524aeb392bc2d8c9903737
SHA1 b1aa5ec3df7ee7bd81914da26a09424d1c81aaa3
SHA512 1c1d8e2bf6ebecd8ba29194e8fa816ba5a2a923dd31f37373ae65793ba704a0aaff9e6fec2c3f8f518ef429c9cbd6ee2f04af4ef8674f221f22f5f6bf3c0050d
SSDEEP 196608:JHySuWWtBsbyCJrVO14odeNZGwP5M1kQIVl/gJvRQSjLXDXi:JHvxeBse94od4Ye5XQW/uLXDS
TLSH
T1C376333BFC0AD0B3DCA198119AE2ECBFCFCC98C563D8C19178312F6196DD589569A09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0A34A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\D0A34A7.tmp
Size 7.1MB
SHA256 55cd6ed5fd8170a958408034eefc706c30ed4574f79049fd2b0bc276437fe7b2
MD5 55da41526668203c89839ec1f5e6fb05
SHA1 087c929bd36f0fd808b17e098fc8bdbc353e0f0f
SHA512 ec01ca073fc59af189fd1cf978c89a51c16bfb5f8815d73f0ed19b21004603a3c7c11101906bff6ef37b9ba5d65c90e82e4ab6a04e82e138d19991b29700268c
SSDEEP 196608:7JySuWWtBsbyCJrVO14odeNZGwP5M1kQIVl/gJvRQSjLXDXi:7JvxeBse94od4Ye5XQW/uLXDS
TLSH
T18C76333BFC0AD0B3DCE198119AE2ECBFCECC98C563D8C19178312F6196DD589569A09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF53E4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF53E4C.tmp
Size 2.8MB
SHA256 7a14601de27bd752c19c4ea5e2f0ce5e9dd7913bd94580e98ff6e6cae7358b23
MD5 ac830c29db143a7dbc235269e1dbd4a1
SHA1 0058d3dedeb9dbf47409735b3114bd9469912d49
SHA512 9d5f01c4d437c7adf6c2043627b239669b5c771f6528c4312c00ac64ce18224038216cf5650d0daa3a79e8c80cc086eaefd04d6095ec0ea69e64347d2db9da43
SSDEEP 49152:cP4r57UoyOmBy5b/CFOdE5EXtIKSgSCssuP5WqJjJ9SeRz9p1aS82adD9:w4dooyFByoFMChiNqJjJlRpB82ap9
TLSH
T17FD5331EAACE45BDF6F7C919CCA5C19638906EE5813002ED9C6B75F7BE8A8D0C41E431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF53E4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF53E4C.tmp
Size 2.8MB
SHA256 a4b94dc1613d6802e49f78f3006db199e62dc06a0533de9e15368f14eaafead0
MD5 17a2ded5981cbf7ebfac4b1469b3e1ab
SHA1 8159e39d0e9266fe2e945d2ca17805dc23af6f3b
SHA512 797d3fd7fa36e08c8e4826d2abdd4cdf02e1db09efd66f85b4f51e1815c6c14b05ca3b98b302473ea8897cd46c64dc25da083188ce8a6682c9ba4573ceb7ce89
SSDEEP 49152:fe4r570oyOmBy5b/CFOdE5EXtIKSgSCssuP5WqJjJ9SeRz9p1aS82adD9:24dYoyFByoFMChiNqJjJlRpB82ap9
TLSH
T17FD5331EAACE45BDF6F7C919CCA5C19A38906EE5813001ED9C6B75F7BE8A8D0C41E431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FrameworSwitch32.exe

Path C:\Users\Admin\AppData\Local\Temp\FrameworSwitch32.exe
Size 804KB
SHA256 15363d9cd84c09e9b14abec25072b7c9f8bb4e5a0fd46aa36908691e6488775b
MD5 201560a73634159348f082c1c97ef6bc
SHA1 744256c55e1fd7a99c2d73add598e65d86475b0a
SHA512 27aa31616489075b9eff545123675be8beb39dcb0a44680b2bcc06df15b661e3e684606a875c533e91e5840df25b20061e905f10ca8ae22a6f34e52e433cfbb5
SSDEEP 6144:42ed5RxhhpNFEB22drOZXAAOn+OY2aQfQc4kxQEs/1vTzni+o8:42ed5RxhhBEB22sA1DYJZvTDi+1
TLSH
T14A0539D1B08042B1F7AB1E3020BAAE35066B6FBA9DD8B15FE64476753BF71C22123517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1d2-bfec-e560-0764.tmp

Path C:\Users\Admin\AppData\Local\Temp\d1d2-bfec-e560-0764.tmp
Size 18KB
SHA256 a0bde8c5d0c7ad1d0e1500eef24d9e32b91b4e19b5ce911b9e916911c48c6915
MD5 d085b4a7277d863baea4afea80efaeac
SHA1 9bcc244e44d5e224dcd1d247c43b11b16899647d
SHA512 b71a6010db2647b9bae1ae60f1a45111531e5eea1ee0bde2bdaecc6f94a8f0a06ece11654bc731fadd884abbc8f156c4002962880e6caf8d80f84468675e7ac5
SSDEEP 384:XMsBwO+OKYo1XrDDmtR8KwH7JwRMHGVbZHlbC5IAo4J2WXCxT1Jh6:X5Bw5ZX/DmEJwRMmVVO/oN5JM
TLSH
T14982D03F2ABBEB2BF4517ED520204384A88B9DED3409B914B52DF07C31D604A7172A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dll

Path C:\Users\Admin\AppData\Local\Temp\log.dll
Size 237KB
SHA256 c5bd69d4964c01e119f27bbb4a7f265e634270e9a91d40084b420c3afdd6e7b0
MD5 17d5018075cc00e23db76351d2384d04
SHA1 4044493df6de00ed2b8149c0f8ad3931825e1706
SHA512 0831e361cff4c197573285abb3a1beee9a66028a74aec4e10314f61b5e0f4bf01e3bd287c5f78d9eda2b182af67c8d16c797ce9eb2ebd883fa465727fa5c2162
SSDEEP 6144:f7it8SxdR2ZWtosRkXI0kAOvICZH25Qf5:WecdR2ZWbRkXaNI+H25Qf5
TLSH
T16B349D407982C436D1BE19355479E76219BCB8211F60CAEFA7E84E3D4F742C0A735ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

monitor.sym

Path C:\Users\Admin\AppData\Local\Temp\monitor.sym
Size 5.7MB
SHA256 8a8977431f998fc3f23825de4ac06841ea57fe8c38f77436f8f9ff1ea8f0fb46
MD5 7e2add83d52b3d1aa78ef26bdeb34d5b
SHA1 cc04c92e85a33076ee5ad714bc7a803c61337b06
SHA512 40ba75fe7443984aee3375d303fee415a1f0e936eccec12b279d05f35300df50d121bee247c43ba62340b9b4f730c20b36a6a9f86275117fe01c58441d90294d
SSDEEP 98304:uVkuZzLlg3lmdH74do15U7hJQ78k7u6YS5GjdkVrrFbB6O3c4cPkH0NHNjrTXQ:P8+3lEka7aJ4175Yy5FZbH8nc
TLSH
T17256330ABBBA5858F45689F25E4F58924854F164EB78C44D15B3FCA6F68C0CCE0F8FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sampler.xml

Path C:\Users\Admin\AppData\Local\Temp\sampler.xml
Size 33KB
SHA256 a2ae04f8a85a5be22fbcd1f03801679ad9466feb5577d44cb27f93520ca238b7
MD5 2e7b68b790dc8ffe13affa4678c8cb2d
SHA1 66f423f8be2bf233664bfcb980a4e3efa298735f
SHA512 348f4443afdb85fb4009f68139ab7e7c3d84837748c6ca6223d05182ab4788e03b351e6b7fc8f95b6ebf07f7dc5a1b498b4e9e3079ab7dc46a63600c02e975b8
SSDEEP 768:0rdruYPfJMPgjkzNIirdNXn5n4/jcFtqOlSAxI94p:8dr1JMlFbnmaxJp
TLSH
T17CF28DE54FAB6F567D097C66D528E0D3D204F4B87A0E017270EA181FB816DA9D821DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VectorDrive128.exe

Path C:\Users\Admin\AppData\Local\VectorDrive128.exe
Size 628KB
SHA256 c856e63ccd4da995fc4cf19ea9a37c7edde0109849d43260499e9a273e2faff1
MD5 a884ed9f2192dc66e1afece2d407924c
SHA1 bb469cc9687546133802798d225e9b8640dd9f0d
SHA512 6834c07e665c59782b5a5b0eb1171d748b612c52bfd05c89ceabec80f01337d940965bc16955e161f9afdc7166510c43604f695c952942e0cbbf89e6cd2d73a9
SSDEEP 12288:fSDYIAVwq1oFl1kGasvVKSIpLaLjhJ+NPlRx7TgIdwGTKyA97ePtX5cVZMM2MMg+:fS8IAPahc/f7xKyAgPtX50MM2MMgMMm5
TLSH
T1F1D49E406AB3E2F7E6A215B4517EBBE744B92F21C66480E776C07D697C392C0163722F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\COMVpn\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

monitor.sym

Path C:\Users\Admin\AppData\Roaming\guard\KGYHGSCXTDQNHC\monitor.sym
Size 2.5MB
SHA256 c97e689860936053b99eeb757367eafad3910689bd29e3e6aa25e8ffef396cf6
MD5 966b8e9aa62617323ad9305cd66b6cf4
SHA1 241485989b60c39542d5af4ea1fc017900cd34aa
SHA512 4073c602be1cd7fe938218903852166cda94539212197f9399a139c696b21bfee8df8678a3e86a501ddf39ec5b752cf18abcc04ddb46b8b086135fce8ed1366b
SSDEEP 49152:g7pI1dAgDp+Q95xvK9uUikA7xhHvLJ1qka+9fgTIfqbbRmz7xLZQFMJEXD:audAgDpX95xvKwHkA7xhHvLWW9oTiabl
TLSH
T11CC53375BCB935A0EB63A6F9F30CB006C345E51D64BB39DA0AD5C5AB0C8E404DFC4A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-57-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1036-45-0x00000000752A7000-0x00000000752A8000-memory.dmp

Download

memory/1036-81-0x00000000752A7000-0x00000000752A8000-memory.dmp

Download

memory/1036-48-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1036-64-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1036-65-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1036-51-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1036-54-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1036-44-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/1036-43-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/1792-140-0x00007FF6A8640000-0x00007FF6A877E000-memory.dmp

Download

memory/1792-168-0x00007FF6A8640000-0x00007FF6A877E000-memory.dmp

Download

memory/1792-98-0x00007FF6A8640000-0x00007FF6A877E000-memory.dmp

Download

memory/1792-106-0x00007FF6A8640000-0x00007FF6A877E000-memory.dmp

Download

memory/2140-128-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/3176-124-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-274-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-207-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-350-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-182-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-349-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-112-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-315-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-94-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/3176-91-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-89-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-230-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3176-308-0x0000000000B00000-0x0000000000ECA000-memory.dmp

Download

memory/3952-87-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/3952-74-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/3952-77-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/3952-73-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/3952-83-0x0000000075290000-0x00000000752DF000-memory.dmp

Download

memory/3952-97-0x00000000007A0000-0x0000000000868000-memory.dmp

Download

memory/3988-27-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/3988-26-0x0000000073C80000-0x0000000073CCF000-memory.dmp

Download

memory/5056-123-0x00007FFC69660000-0x00007FFC69869000-memory.dmp

Download

memory/5056-183-0x0000000075290000-0x00000000752DF000-memory.dmp

Download